Letting Odoo users chart external data without opening a security hole

Nadia Atiq — Tue, 10 Nov 2026 14:25:12 +0000

Our Odoo dashboard module can now chart data that does not live in Odoo: a CSV someone exports every Monday, a JSON endpoint, a read-only view in another database. Building it took a day. Making it safe took three. Notes for anyone doing the same.

1. A URL field is an SSRF hole by default.
If any user can type a URL and your server fetches it, they can point it at http://127.0.0.1:8069/web/database/manager or your cloud metadata IP. We resolve the hostname first and refuse private, loopback, link-local and reserved addresses:

for info in socket.getaddrinfo(host, None):
    ip = ipaddress.ip_address(info[4][0])
    if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
        raise UserError('Internal network addresses are not allowed.')

Also allow_redirects=False, otherwise a public URL can just 302 you to an internal one.

2. Who may create the source matters more than who may view it.
Regular dashboard managers can upload a file. Only Settings admins can create URL, database or Python sources. We check this in create and write, not only in the view, because the view is not a security layer.

3. Secrets get field-level groups.
Headers (API tokens) and the DB password have groups='base.group_system'. Everyone else can use the source, nobody else can read the secret back.

4. External databases: read-only and a timeout.
PostgreSQL connections get set_session(readonly=True) and statement_timeout=30000. We still reject anything that is not a single SELECT, belt and braces.

5. Cap everything.
50,000 rows, 30 second HTTP timeout, errors stored on the record instead of crashing the cron. One bad source should never stop the hourly refresh of the others.

6. The Python transform runs in safe_eval.
Users can add a column or filter rows, but they get rows and a few builtins, nothing else.

None of this is exotic, but every item was missing in at least one module we reviewed for clients. If you build anything that fetches URLs from user input inside Odoo, start with point 1.

The module is here if you want to see it in action: https://technoversesystems.com/odoo-dashboard-studio

Porting one Odoo module from 14 to 20: the changes that actually broke it

Nadia Atiq — Tue, 10 Nov 2026 13:48:15 +0000

We sell a dashboard module for Odoo and ship it for seven versions, 14 through 20. Same features, one codebase, a small script that rewrites the bits that differ. Most of the port is boring. A few things are not, and they cost us hours each time, so here is the list.

safe_eval changed shape in 19.
Up to 18 you call safe_eval(code, ctx, mode='exec', nocopy=True) if you want the script to change your context. In 19 the signature is safe_eval(expr, /, context, *, mode) and it updates the dict in place, nocopy is gone. We just try the old call and fall back on TypeError:

try:
    safe_eval(code, ctx, mode='exec', nocopy=True)   # <= 18
except TypeError:
    safe_eval(code, ctx, mode='exec')                # 19+

Users: groups_id became group_ids.
Any test that creates a user with groups breaks. 'group_ids' if 'group_ids' in Users._fields else 'groups_id' fixes it without version checks.

Binary fields in 20 are not base64 anymore.
Reading record.file gives you a BinaryValue with the raw bytes. Writing plain bytes in a test fails with "use BinaryValue instead of bytes". We now read with base64.b64decode(f) if isinstance(f, (bytes, str)) else bytes(f).

Recursion checks.
_check_recursion() is replaced by _has_cycle() from 17. Easy, but it fails silently in a constraint if you forget.

The frontend is the real port.
14 to 16 still ship Chart.js 2. Options like plugins.legend and indexAxis simply do nothing there, so a horizontal bar quietly renders vertical. We keep two chart config builders and the port script swaps them. Also /** @odoo-module */ must be the first line on 15/16. Our script once wrote that header and emptied the file in the same line (open for write before reading). The module installed fine and one button was just missing. Test the UI, not only the Python.

Our routine now

Build on 19, write tests there.
Run the port script per version, run the tests on 15 to 20.
Open the UI on the oldest and newest version and click through.

If you want to see where all of this ended up, the module is Dashboard Studio Pro: https://technoversesystems.com/odoo-dashboard-studio . We do Odoo work at Technoverse Systems (https://technoversesystems.com), happy to compare notes in the comments.

DEV Community: Nadia Atiq

Letting Odoo users chart external data without opening a security hole

Porting one Odoo module from 14 to 20: the changes that actually broke it