| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Lines of code | 97 |
| Technical Name |
database_delete_guard |
| License | LGPL-3 |
Why this module?
Odoo's built-in database manager exposes a Delete button and an RPC endpoint that can drop a database with a single confirmation. On shared or production servers, one wrong click — or one stolen master password — can wipe out a live database in seconds.
Database Delete Guard patches the database service at the server layer and disables the Delete button in the UI for databases you mark as protected.
Key Features
Server-side enforcement
Blocks exp_drop and exp_rename calls at the Odoo service layer,
so RPC, JSON-RPC, and database manager calls are all covered — not just the UI.
Pattern matching
Protect specific names (prod, main_live) or use shell-style
wildcards (prod_*, *) to cover whole groups of databases.
UI feedback
The Delete button in the database manager is replaced with a disabled Protected indicator, so operators see at a glance that the database is guarded.
Zero-database config
Configured via odoo.conf. Works as a server-wide module — active even
before any database is selected.
Rename protection
Protected databases also cannot be renamed, which prevents the common "rename then delete" workaround.
Legacy alias support
Reads db_delete_restrict as a fallback, so migrations from older
in-house modules work without rewriting odoo.conf.
Configuration
Add the module to server_wide_modules so the guard is active even when no
database is selected, then list the databases (or patterns) to protect:
[options]
server_wide_modules = web,database_delete_guard
db_delete_guard = prod,main_live,prod_*
db_delete_guard accepts comma-separated database names or shell-style
patterns (fnmatch syntax). Use * to block deletion of
every database through Odoo.
After updating odoo.conf, restart the Odoo service.
See it in action
Guarded databases show a disabled Protected button in place of Delete. Unguarded databases keep the standard Delete action.
How it works
- On Odoo startup the module monkey-patches
odoo.service.db.exp_dropandodoo.service.db.exp_rename. - Each call checks the target database name against the configured patterns.
- If a match is found, a
DatabaseDeleteGuardErroris raised before the underlying drop/rename runs. - The database manager controller is extended to swap the Delete button for a disabled "Protected" button for guarded databases.
Scope & limitations
This module protects Odoo's database manager and RPC deletion/rename endpoints only.
It cannot stop a PostgreSQL superuser from dropping databases directly
with DROP DATABASE outside Odoo. Combine it with proper PostgreSQL role
management for full protection.
Support
Need help or want to report an issue? Get in touch:
Please log in to comment on this module