[MERGE] Merge from 7.0

bzr revid: jco@openerp.com-20130208162923-oqjt2pov0gtv7ynf

addons/crm/test/process/merge_opportunity.yml

@@ -41,7 +41,7 @@
     assert merge_id, 'Fail to create merge opportunity wizard'
     merge_result = self.browse(cr, uid, merge_id)[0]
     assert merge_result.partner_id.id == ref("base.res_partner_1"), 'Partner mismatch: when merging leads/opps with different m2o values, the first not null value prevails (the other are dropped)'
-    assert merge_result.description == 'This is the description of the test lead 1., This is the description of the test lead 2., This is the description of the test opp 1.', 'Description mismatch: when merging leads/opps with different text values, these values should get concatenated and separeted with ", "'
+    assert merge_result.description == 'This is the description of the test lead 1.\n\nThis is the description of the test lead 2.\n\nThis is the description of the test opp 1.', 'Description mismatch: when merging leads/opps with different text values, these values should get concatenated and separated with line returns'
     assert merge_result.type == 'opportunity', 'Type mismatch: when at least one opp in involved in the merge, the result should be a new opp (instead of %s)' % merge_result.type
 -
   The other (tailing) leads/opps shouldn't exist anymore.

addons/web_linkedin/web_linkedin.py

@@ -29,7 +29,12 @@ class Binary(openerp.addons.web.http.Controller):
     _cp_path = "/web_linkedin/binary"
 
     @openerp.addons.web.http.jsonrequest
-    def url2binary(self, req,url):
+    def url2binary(self, req, url):
+        if not url.startswith("http"):
+            raise Exception("Not allowed to load a file using this protocol")
+        if url.count("?") > 0 or url.count("&") > 0 or url.count("=") > 0:
+            raise Exception("Not allowed to use GET parameters")
+        req.session.assert_valid(force=True)
         bfile = urllib2.urlopen(url)
         return base64.b64encode(bfile.read())