diff --git a/CHANGELOG b/CHANGELOG index 60c8b5b15e..391065ef77 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,4 @@ +* Remove IDENTIFIER regexp on ir.model and ir.model.field * Enforce suffix and prefix to have id or name * Sanitize path in file_open (CVE-2016-1242) * Prevent read of user password hash (CVE-2016-1241) diff --git a/trytond/ir/model.py b/trytond/ir/model.py index ad15fdb177..d6a710a04d 100644 --- a/trytond/ir/model.py +++ b/trytond/ir/model.py @@ -34,8 +34,6 @@ __all__ = [ 'ModelWorkflowGraph', ] -IDENTIFIER = re.compile(r'^[a-zA-z_][a-zA-Z0-9_]*$') - class Model(ModelSQL, ModelView): "Model" @@ -70,10 +68,6 @@ class Model(ModelSQL, ModelView): ('model_uniq', Unique(table, table.model), 'The model must be unique!'), ] - cls._error_messages.update({ - 'invalid_module': ('Module name "%s" is not a valid python ' - 'identifier.'), - }) cls._order.insert(0, ('model', 'ASC')) cls.__rpc__.update({ 'list_models': RPC(), @@ -114,20 +108,6 @@ class Model(ModelSQL, ModelView): where=ir_model.id == model_id)) return model_id - @classmethod - def validate(cls, models): - super(Model, cls).validate(models) - cls.check_module(models) - - @classmethod - def check_module(cls, models): - ''' - Check module - ''' - for model in models: - if model.module and not IDENTIFIER.match(model.module): - cls.raise_user_error('invalid_module', (model.rec_name,)) - @classmethod def list_models(cls): 'Return a list of all models names' @@ -256,10 +236,6 @@ class ModelField(ModelSQL, ModelView): ('name_model_uniq', Unique(table, table.name, table.model), 'The field name in model must be unique!'), ] - cls._error_messages.update({ - 'invalid_name': ('Model Field name "%s" is not a valid python ' - 'identifier.'), - }) cls._order.insert(0, ('name', 'ASC')) @classmethod @@ -329,20 +305,6 @@ class ModelField(ModelSQL, ModelView): def default_field_description(): return 'No description available' - @classmethod - def validate(cls, fields): - super(ModelField, cls).validate(fields) - cls.check_name(fields) - - @classmethod - def check_name(cls, fields): - ''' - Check name - ''' - for field in fields: - if not IDENTIFIER.match(field.name): - cls.raise_user_error('invalid_name', (field.name,)) - @classmethod def read(cls, ids, fields_names=None): pool = Pool()