Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[bitnami/odoo] Odoo should have list_db set to False (or --no-database-list) #67349

Closed
OdyX opened this issue May 30, 2024 · 5 comments · Fixed by #67540
Closed

[bitnami/odoo] Odoo should have list_db set to False (or --no-database-list) #67349

OdyX opened this issue May 30, 2024 · 5 comments · Fixed by #67540
Assignees
@jotamartos
Labels
odoo solved stale 15 days without activity tech-issues The user has a technical issue about an application

Comments

@OdyX
Copy link
Contributor

OdyX commented May 30, 2024

Name and Version

bitnami/odoo:16.0.20240315-debian-12-r0

What architecture are you using?

amd64

What steps will reproduce the bug?

When deploying an odoo with https://github.com/bitnami/charts/tree/main/bitnami/odoo, the /web/database/manager endpoint will be accessible and allow new databases' setup.

What is the expected behavior?

According to https://www.odoo.com/documentation/16.0/administration/on_premise/deploy.html?highlight=list_db%20no-database-list#security :

Once your db_name and db_filter are configured and only match a single database per hostname, you should set list_db configuration option to False, to prevent listing databases entirely, and to block access to the database management screens (this is also exposed as the --no-database-list command-line option)

This is precisely the state post-initial configuration.

What do you see instead?

The /web/database/manager is accessible, and shouldn't.

Additional information

It's possible to "fix" this by setting:

odoo:
  command:
    - "/opt/bitnami/scripts/odoo/entrypoint.sh"
    - "/opt/bitnami/scripts/odoo/run.sh"
    - --no-database-list

It would be better if an environment variable ODOO_LIST_DB could be set to True (with a default to False).
@OdyX OdyX added the tech-issues The user has a technical issue about an application label May 30, 2024
@github-actions github-actions bot added the triage Triage is needed label May 30, 2024
@javsalgar javsalgar changed the title Odoo should have list_db set to False (or --no-database-list) [bitnami/odoo] Odoo should have list_db set to False (or --no-database-list) Jun 3, 2024
@github-actions github-actions bot removed the triage Triage is needed label Jun 3, 2024
@github-actions github-actions bot assigned jotamartos and unassigned javsalgar Jun 3, 2024
@jotamartos
Copy link
Contributor

Hi @OdyX,

You are right, you can overwrite the command in the container to add any flag you want

  odoo:
    image: docker.io/bitnami/odoo:17
    command:
      - "/opt/bitnami/scripts/odoo/run.sh"
      - --no-database-list
...

Note: You do not need to add the entrypoint line there

However, adding a new env var to configure that is a great idea, would you like to contribute? You can follow our guidelines to do so and the whole community will benefit from that. You will need to make the following changes:

@OdyX OdyX mentioned this issue Jun 5, 2024
Merged
@github-actions GitHub Actions
Copy link

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Jun 20, 2024
@OdyX
Copy link
Contributor Author

OdyX commented Jun 20, 2024

That's really not cool @github-actions… I proposed a PR, and it had no review so far.

@jotamartos
Copy link
Contributor

Sorry for the delay in reviewing the PR and thanks for your contribution. We will review it soon and will get back to you.

@github-actions GitHub Actions
Copy link

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

@bitnami-bot bitnami-bot closed this as not planned Won't fix, can't repro, duplicate, stale Jun 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jotamartos jotamartos

Labels
odoo solved stale 15 days without activity tech-issues The user has a technical issue about an application
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[bitnami/odoo] Add ODOO_LIST_DB envvar, defaulting to False liip-forks/bitnami-containers
4 participants
@OdyX @javsalgar @jotamartos @bitnami-bot