Hide Database Manager Link & Domain Restrictor
Production Cyber Security Hardening & Route Access Control
Lock down your production database endpoints.
Hide the "Manage Databases" link from the Odoo login page and block unauthorized exposure by restricting all database management routes to a single secure administrator domain.
The High Risk of Exposed Odoo Database Management Routes
Leaving your database selector, backup, and restore options open to the public internet is a major vulnerability. Malicious actors scan for `/web/database/manager` endpoints to brute-force your master password, download raw database backups, or drop systems entirely. Simply hiding the visual link does not fix securityâtech-savvy users can still type the direct URL. You need an automated system that enforces network isolation and strictly limits administrative tasks to an internal domain.
Comprehensive Defensive Security
Two independent layers of protection designed to keep your production instances fully safe without disrupting IT operations.
Visual Link Suppression
Instantly strip away the "Manage Databases" link at the bottom of the default Odoo login panel. This eliminates casual entry points for public users while preserving standard interface aesthetics.
Host-Based Domain Restriction
Block back-door attempts entirely. Every request targeting backup, drop, list, or duplicate endpoints is evaluated against the `Host` header. If it doesn't match your exact authorized domain, Odoo returns a swift 403 Forbidden message.
Granular Configuration Control
Manage all features cleanly inside General Settings â Database Manager Security. Only accessible to system accounts in the "Administration / Settings" group. Features can be easily toggled off for testing purposes.
Multi-Database Resiliency
Engineered for large-scale multi-tenant environments. If no specific dbfilter matches, the fallback engine scans local instances sequentially to ensure security rules are actively preserved across the cluster.
IT Infrastructure Specifications
Complements native server configurations perfectly, giving network administrators flexible operational control.
Coexists with list_db Parameter
Does not override your native `list_db = False` parameter in `odoo.conf`. Instead, it provides a dynamic, user-configurable security blanket directly over web requests targeting active controllers.
Reverse Proxy Friendly
Fully compatible with enterprise proxy configurations like Nginx, Apache, or Cloudflare. Simply configure your proxy to pass the original `Host` header directly down to the Odoo application server.
Configuration Guide
| 1. | Navigate to Settings > General Settings with an Admin account. |
| 2. | Scroll to the Database Manager Security section. |
| 3. | Toggle "Manage Databases Link" to instantly remove the interface link from your login view. |
| 4. | In the "Database Manager Access" field, enter your explicit management domain (e.g., `secure-db.mycompany.com`) and click Save. |
| Warning: Ensure the specified domain resolves properly to your Odoo server instance before deploying to live environments. |
Developed with by SyncSoft Team
Looking for specialized infrastructure architecture audits, custom server-level security wrappers, or cloud proxy integrations?
Our enterprise security engineers are ready to support you!
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module