Regression : Incorrect use of subprocess module

[Michael Telahun Makonnen]

I'm using OpenERP 5.0.15

In tools/misc.py: exec_pg_command_pipe() and exec_command_pipe() in the arguments to the subprocess.Popen() function the command name is supplied as the executable parameter and shell=True. This is wrong. If shell=True, then executable has to be the path to the shell, as explained in the following paragraph from http://docs.python.org/library/subprocess.html :

The executable argument specifies the program to execute. It is very seldom needed: Usually, the program to execute is defined by the args argument. If shell=True, the executable argument specifies which shell to use. On Unix, the default shell is /bin/sh.

The above two functions have been working up to now only by accident. The subprocess module will spawn the /bin/sh shell and try to execute the first element in the argument list tuple. The first element is the command name (without the full path), but since the command is usually in the shell's path it will succeed. However if , for example, the pg_* commands were not in the shell's path (for example in /usr/lib/pgsql/bin) then it would fail.

Patch is attached.

[Michael Telahun Makonnen (mmakonnen)]

Update: Please disregard my analysis for why the two functions appear to be functioning up to now. It is wrong since the first element in the argument list is *not* the command name. The bug is real none the less and should be fixed.

[Olivier Dony (Odoo) (odo-openerp)]

Hello Michael,

You're right, thanks for the analysis and the proposed patch!
This has been fixed in trunk in revision 3075 - <email address hidden> from ~xrg (author of the original Popen patch)

I am assigning to maintenance team as well for backport to 5.0, as the original patch had been applied there as well.

[Olivier Dony (Odoo) (odo-openerp)]

Note to maintenance team: keep in mind that this bug has many consequences, e.g. not being able to print workflows (see duplicated bug #684661) and probably breaking other things that call external tools, e.g. backup/restore, etc.

[Jay Vora (Serpent Consulting Services) (jayvora)]

Thanks Michael, Panos and Olivier.

I have tested with the patch and fix has landed to stable by revision 2165 <email address hidden>.

Thanks.