odoo-devops-tools 1.24.2__tar.gz → 1.24.3__tar.gz

{odoo_devops_tools-1.24.2 → odoo_devops_tools-1.24.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: odoo-devops-tools
-Version: 1.24.2
+Version: 1.24.3
 Summary: Build reproducible Odoo workspaces from a single project definition.
 Author: Roman Lacko
 License-Expression: MIT
@@ -349,7 +349,7 @@ Restore a database dump with `pg_restore`:
 ./docker/local/scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 
@@ -787,7 +787,7 @@ Restore a database dump with `pg_restore`:
 ./odoo-scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 

{odoo_devops_tools-1.24.2 → odoo_devops_tools-1.24.3}/README.md

@@ -321,7 +321,7 @@ Restore a database dump with `pg_restore`:
 ./docker/local/scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 
@@ -759,7 +759,7 @@ Restore a database dump with `pg_restore`:
 ./odoo-scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 

odoo_devops_tools-1.24.3/odoo_devops_tools/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.24.3"

{odoo_devops_tools-1.24.2 → odoo_devops_tools-1.24.3}/odoo_devops_tools/env.py

@@ -1049,10 +1049,27 @@ def _parse_odoo_version(odoo_version: str) -> int:
 
 def _validate_docker_image(value: str, option: str) -> str:
     image = (value or "").strip()
-    if not image:
+    # This value is embedded directly into Dockerfile FROM instructions.
+    # Require a single Docker image reference (registry, tag and digest allowed).
+    component = r"[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*"
+    label = r"[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?"
+    registry = rf"(?:{label}(?:\.{label})*(?::[0-9]+)?|\[[0-9A-Fa-f:.]+\](?::[0-9]+)?)"
+    tag = r"[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}"
+    digest = r"[A-Za-z][A-Za-z0-9_+.-]*:[A-Za-z0-9=_-]{32,}"
+    if (
+        not image
+        or len(image) > 512
+        or "\n" in (value or "")
+        or "\r" in (value or "")
+        or re.fullmatch(
+            rf"(?:{registry}/)?{component}(?:/{component})*(?::{tag})?(?:@{digest})?",
+            image,
+            flags=re.ASCII,
+        ) is None
+    ):
         raise Exception(
             f"Invalid option '{option}' in section [docker] "
-            "(expected non-empty Docker image name/tag)."
+            "(expected a single Docker image reference, optionally with registry, tag or digest)."
         )
 
     return image
@@ -1271,6 +1288,13 @@ def load_project_config(
     for sec in cp.sections():
         if sec.startswith("addons."):
             name = sec.split(".", 1)[1]
+            # Git addon destinations are ROOT/odoo-addons/<name>. Keep the
+            # section name a single, portable path component (also on Windows).
+            if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]*", name) or name.endswith("."):
+                raise Exception(
+                    f"Invalid addon section name [{sec}]: use letters, digits, '.', '_' or '-' "
+                    "without path separators or traversal components."
+                )
 
             has_path = cp.has_option(sec, "path")
             has_repo = cp.has_option(sec, "repo")
@@ -2151,7 +2175,22 @@ def _validate_local_odoo_path(layout: Layout, spec: OdooSpec) -> Path:
 
 
 def _resolve_addon_path(layout: Layout, addon_name: str, spec: AddonSpec) -> Path:
-    return _resolve_workspace_path(layout, spec.path or "", layout.addons_root / addon_name)
+    if spec.is_local:
+        return _resolve_workspace_path(layout, spec.path or "", layout.addons_root / addon_name)
+    dest = layout.addons_root / addon_name
+    # Implicit Git destinations must not follow symlinks into another repo,
+    # outside the workspace, or back onto the addons root itself.
+    if (
+        not _is_path_within(layout.addons_root, layout.root)
+        or dest.is_symlink()
+        or not _is_path_within(dest, layout.addons_root)
+        or dest.resolve() == layout.addons_root.resolve()
+    ):
+        raise Exception(
+            f"Unsafe addon destination for [addons.{addon_name}]: {dest} "
+            f"must resolve inside {layout.addons_root}. Use an explicit 'path' for local addons."
+        )
+    return dest
 
 
 def _validate_local_addon_path(layout: Layout, addon_name: str, spec: AddonSpec) -> Path:
@@ -2498,11 +2537,44 @@ def _native_default_db_name(cfg: ProjectConfig) -> str:
     db_name = str(cfg.config.get("db_name") or "").strip()
     if not db_name:
         raise Exception("Native database helpers require [config].db_name.")
-    if db_name in (".", "..") or any(c in db_name for c in ("/", "\\", "\x00", "\r", "\n")):
-        raise Exception("Database helpers require a single database name, not a path.")
+    # These names become PostgreSQL identifiers, filesystem path components and
+    # Windows batch variables. Reject traversal, CMD metacharacters and names
+    # that PostgreSQL could silently truncate to another database name.
+    if len(db_name) > 63 or not re.fullmatch(r"[A-Za-z0-9_][A-Za-z0-9_.-]*", db_name):
+        raise Exception(
+            "Invalid [config].db_name: expected 1-63 ASCII letters, digits, "
+            "underscores, dots or hyphens, starting with a letter, digit or underscore."
+        )
     return db_name
 
 
+def _native_filestore_data_dir_sh(layout: Layout) -> str:
+    # Preserve workspace-relative paths when the workspace is moved.
+    try:
+        relative = layout.data_dir.relative_to(layout.root)
+    except ValueError:
+        return shlex.quote(str(layout.data_dir))
+    return f'"${{ROOT_DIR}}"/{shlex.quote(relative.as_posix())}'
+
+
+def _native_filestore_data_dir_bat(layout: Layout) -> str:
+    # Paths cannot contain double quotes on Windows; reject control characters
+    # rather than generating unsafe batch assignments.
+    if any(char in str(layout.data_dir) for char in ('"', '\r', '\n', '\x00')):
+        raise Exception("Native filestore data_dir contains invalid Windows path characters.")
+    try:
+        relative = layout.data_dir.relative_to(layout.root)
+    except ValueError:
+        value = str(layout.data_dir)
+    else:
+        suffix = '' if str(relative) == '.' else '\\' + str(relative)
+        value = '%ROOT_DIR%' + suffix
+    # Keep %ROOT_DIR% expandable while escaping literal percent signs in paths.
+    if value.startswith('%ROOT_DIR%'):
+        return '%ROOT_DIR%' + value[len('%ROOT_DIR%'):].replace('%', '%%').replace('^', '^^')
+    return value.replace('%', '%%').replace('^', '^^')
+
+
 def _native_pg_env(cfg: ProjectConfig) -> dict[str, str]:
     # libpq reads these environment variables, keeping passwords out of command
     # arguments. Missing/False options leave libpq defaults and .pgpass intact.
@@ -2857,6 +2929,7 @@ echo "INFO: Database neutralization completed: ${{DB_NAME}}"
 
 def write_native_backup_filestore_sh(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = shlex.quote(_native_default_db_name(cfg))
+    configured_data_dir = _native_filestore_data_dir_sh(layout)
     content = fr"""#!/usr/bin/env bash
 set -euo pipefail
 
@@ -2865,7 +2938,8 @@ ROOT_DIR="$(cd "${{SCRIPT_DIR}}/.." && pwd)"
 
 BACKUPS_DIR="${{ROOT_DIR}}/odoo-backups"
 DB_NAME={configured_db_name}
-FILESTORE_PATH="${{ROOT_DIR}}/odoo-data/filestore/${{DB_NAME}}"
+DATA_DIR={configured_data_dir}
+FILESTORE_PATH="${{DATA_DIR}}/filestore/${{DB_NAME}}"
 TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
 OUTPUT="${{1:-${{BACKUPS_DIR}}/${{DB_NAME}}_${{TIMESTAMP}}_filestore.tar.gz}}"
 TMP_OUTPUT="${{OUTPUT}}.tmp"
@@ -2887,6 +2961,7 @@ echo "INFO: Filestore backup created: ${{OUTPUT}}"
 
 def write_native_restore_filestore_sh(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = shlex.quote(_native_default_db_name(cfg))
+    configured_data_dir = _native_filestore_data_dir_sh(layout)
     content = fr"""#!/usr/bin/env bash
 set -euo pipefail
 
@@ -2894,7 +2969,8 @@ SCRIPT_DIR="$(cd "$(dirname "${{BASH_SOURCE[0]}}")" && pwd)"
 ROOT_DIR="$(cd "${{SCRIPT_DIR}}/.." && pwd)"
 
 DB_NAME={configured_db_name}
-FILESTORE_PATH="${{ROOT_DIR}}/odoo-data/filestore/${{DB_NAME}}"
+DATA_DIR={configured_data_dir}
+FILESTORE_PATH="${{DATA_DIR}}/filestore/${{DB_NAME}}"
 FORCE=false
 SOURCE=""
 
@@ -2959,6 +3035,7 @@ echo "INFO: Filestore restore completed: ${{DB_NAME}}"
 
 def write_native_backup_filestore_restic_sh(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = shlex.quote(_native_default_db_name(cfg))
+    configured_data_dir = _native_filestore_data_dir_sh(layout)
     content = fr'''#!/usr/bin/env bash
 set -euo pipefail
 
@@ -2967,7 +3044,8 @@ ROOT_DIR="$(cd "${{SCRIPT_DIR}}/.." && pwd)"
 RESTIC="${{SCRIPT_DIR}}/restic.sh"
 DB_NAME={configured_db_name}
 RESTIC_HOST_NAME="${{RESTIC_HOST:-$(hostname -f 2>/dev/null || hostname)}}"
-FILESTORE_PATH="${{ROOT_DIR}}/odoo-data/filestore/${{DB_NAME}}"
+DATA_DIR={configured_data_dir}
+FILESTORE_PATH="${{DATA_DIR}}/filestore/${{DB_NAME}}"
 
 if [[ ! -x "${{RESTIC}}" ]]; then
   echo "ERROR: restic helper not found: ${{RESTIC}}" >&2
@@ -2994,6 +3072,7 @@ echo "INFO: Backing up filestore for database '${{DB_NAME}}' with restic."
 
 def write_native_restore_filestore_restic_sh(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = shlex.quote(_native_default_db_name(cfg))
+    configured_data_dir = _native_filestore_data_dir_sh(layout)
     restic_command = _native_restic_command_sh()
     content = fr'''#!/usr/bin/env bash
 set -euo pipefail
@@ -3008,8 +3087,9 @@ RESTIC_HOST_NAME="${{RESTIC_HOST:-$(hostname -f 2>/dev/null || hostname)}}"
 FORCE=false
 SNAPSHOT="latest"
 SNAPSHOT_SET=false
-SOURCE_FILESTORE_PATH="${{ROOT_DIR}}/odoo-data/filestore/${{SOURCE_DB_NAME}}"
-TARGET_FILESTORE_PATH="${{ROOT_DIR}}/odoo-data/filestore/${{DB_NAME}}"
+DATA_DIR={configured_data_dir}
+SOURCE_FILESTORE_PATH="${{DATA_DIR}}/filestore/${{SOURCE_DB_NAME}}"
+TARGET_FILESTORE_PATH="${{DATA_DIR}}/filestore/${{DB_NAME}}"
 
 usage() {{
   echo "Usage: $(basename "$0") [--force] [SNAPSHOT]" >&2
@@ -3371,6 +3451,7 @@ exit /b 0
 
 def write_native_backup_filestore_bat(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = _native_default_db_name(cfg).replace("%", "%%")
+    configured_data_dir = _native_filestore_data_dir_bat(layout)
     content = rf"""@echo off
 setlocal DisableDelayedExpansion
 
@@ -3379,7 +3460,8 @@ if "%SCRIPT_DIR:~-1%"=="\" set "SCRIPT_DIR=%SCRIPT_DIR:~0,-1%"
 for %%I in ("%SCRIPT_DIR%\..") do set "ROOT_DIR=%%~fI"
 set "BACKUPS_DIR=%ROOT_DIR%\odoo-backups"
 set "DB_NAME={configured_db_name}"
-set "FILESTORE_PATH=%ROOT_DIR%\odoo-data\filestore\%DB_NAME%"
+set "DATA_DIR={configured_data_dir}"
+set "FILESTORE_PATH=%DATA_DIR%\filestore\%DB_NAME%"
 
 for /f %%I in ('powershell -NoProfile -Command "Get-Date -Format yyyyMMdd_HHmmss"') do set "TIMESTAMP=%%I"
 if "%~1"=="" (
@@ -3412,6 +3494,7 @@ endlocal
 
 def write_native_restore_filestore_bat(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = _native_default_db_name(cfg).replace("%", "%%")
+    configured_data_dir = _native_filestore_data_dir_bat(layout)
     content = rf"""@echo off
 setlocal DisableDelayedExpansion
 
@@ -3419,7 +3502,8 @@ set "SCRIPT_DIR=%~dp0"
 if "%SCRIPT_DIR:~-1%"=="\" set "SCRIPT_DIR=%SCRIPT_DIR:~0,-1%"
 for %%I in ("%SCRIPT_DIR%\..") do set "ROOT_DIR=%%~fI"
 set "DB_NAME={configured_db_name}"
-set "FILESTORE_PATH=%ROOT_DIR%\odoo-data\filestore\%DB_NAME%"
+set "DATA_DIR={configured_data_dir}"
+set "FILESTORE_PATH=%DATA_DIR%\filestore\%DB_NAME%"
 set "FORCE=false"
 set "SOURCE="
 
@@ -3484,6 +3568,7 @@ exit /b 2
 
 def write_native_backup_filestore_restic_bat(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = _native_default_db_name(cfg).replace("%", "%%")
+    configured_data_dir = _native_filestore_data_dir_bat(layout)
     content = rf"""@echo off
 setlocal DisableDelayedExpansion
 
@@ -3497,7 +3582,8 @@ if defined RESTIC_HOST (
 ) else (
   for /f "delims=" %%H in ('hostname') do set "RESTIC_HOST_NAME=%%H"
 )
-set "FILESTORE_PATH=%ROOT_DIR%\odoo-data\filestore\%DB_NAME%"
+set "DATA_DIR={configured_data_dir}"
+set "FILESTORE_PATH=%DATA_DIR%\filestore\%DB_NAME%"
 
 if not exist "%RESTIC%" (
   echo ERROR: restic helper not found: %RESTIC%
@@ -3519,6 +3605,7 @@ exit /b %ERRORLEVEL%
 
 def write_native_restore_filestore_restic_bat(layout: Layout, cfg: ProjectConfig) -> Path:
     configured_db_name = _native_default_db_name(cfg).replace("%", "%%")
+    configured_data_dir = _native_filestore_data_dir_bat(layout)
     restic_command = _native_restic_command_bat()
     content = rf"""@echo off
 setlocal DisableDelayedExpansion
@@ -3541,8 +3628,9 @@ if defined RESTIC_HOST (
 set "FORCE=false"
 set "SNAPSHOT=latest"
 set "SNAPSHOT_SET=false"
-set "SOURCE_FILESTORE_PATH=%ROOT_DIR%\odoo-data\filestore\%SOURCE_DB_NAME%"
-set "TARGET_FILESTORE_PATH=%ROOT_DIR%\odoo-data\filestore\%DB_NAME%"
+set "DATA_DIR={configured_data_dir}"
+set "SOURCE_FILESTORE_PATH=%DATA_DIR%\filestore\%SOURCE_DB_NAME%"
+set "TARGET_FILESTORE_PATH=%DATA_DIR%\filestore\%DB_NAME%"
 
 goto parse_args
 
@@ -4308,9 +4396,16 @@ def write_docker_compose(layout: Layout, cfg: ProjectConfig) -> Path:
 
 def _docker_default_db_name(cfg: ProjectConfig) -> str:
     db_name = cfg.config.get("db_name")
-    if isinstance(db_name, str) and db_name.strip():
-        return db_name.strip()
-    return "odoo"
+    if not isinstance(db_name, str) or not db_name.strip():
+        return "odoo"
+    db_name = db_name.strip()
+    # The same name is used by database and destructive filestore helpers.
+    if len(db_name) > 63 or not re.fullmatch(r"[A-Za-z0-9_][A-Za-z0-9_.-]*", db_name):
+        raise Exception(
+            "Invalid [config].db_name: expected 1-63 ASCII letters, digits, "
+            "underscores, dots or hyphens, starting with a letter, digit or underscore."
+        )
+    return db_name
 
 
 def _write_docker_local_script(

{odoo_devops_tools-1.24.2 → odoo_devops_tools-1.24.3}/odoo_devops_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: odoo-devops-tools
-Version: 1.24.2
+Version: 1.24.3
 Summary: Build reproducible Odoo workspaces from a single project definition.
 Author: Roman Lacko
 License-Expression: MIT
@@ -349,7 +349,7 @@ Restore a database dump with `pg_restore`:
 ./docker/local/scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 
@@ -787,7 +787,7 @@ Restore a database dump with `pg_restore`:
 ./odoo-scripts/restore-db.sh ./odoo-backups/pre-upgrade.dump
 ```
 
-Database restores use copy semantics by default, matching `click-odoo-restoredb --copy`.
+Database restores use copy semantics by default.
 After `pg_restore`, Odoo database identity parameters are regenerated so the restored
 database can coexist with the source database:
 

{odoo_devops_tools-1.24.2 → odoo_devops_tools-1.24.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "odoo-devops-tools"
-version = "1.24.2"
+version = "1.24.3"
 description = "Build reproducible Odoo workspaces from a single project definition."
 readme = "README.md"
 license = "MIT"

odoo_devops_tools-1.24.2/odoo_devops_tools/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.24.2"