diff options
| author | Martin Geubelle <mge@odoo.com> | 2019-01-10 11:25:13 +0000 |
|---|---|---|
| committer | Martin Geubelle <mge@odoo.com> | 2019-02-13 09:38:30 +0000 |
| commit | 31664422c11ab1e9c34ad6b2eb1dfba2af72e359 (patch) | |
| tree | 15e14b87f3c99ae1fbe88a01aeeb54ff2884e1e3 /addons/base_import/static/src/xml/base_import.xml | |
| parent | 984bf2492a16f0ff357b3fc03712c68f1a011f96 (diff) | |
[IMP] web, *: remove explicit references to `session_id`
Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so
it cannot be accessed through client side script. But before this rev. the
`session_id` was still provided by the server to the webclient (in session_info,
mostly) and was stored and accessible. This made XSS injection more
dangerous than they should be as it was very easy to steal the `session_id`.
As the browser automatically set the `session_id` on every request to the server,
the webclient shouldn't need any explicit reference.
Diffstat (limited to 'addons/base_import/static/src/xml/base_import.xml')
| -rw-r--r-- | addons/base_import/static/src/xml/base_import.xml | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/addons/base_import/static/src/xml/base_import.xml b/addons/base_import/static/src/xml/base_import.xml index 951002b279f..c475a30036d 100644 --- a/addons/base_import/static/src/xml/base_import.xml +++ b/addons/base_import/static/src/xml/base_import.xml @@ -3,8 +3,6 @@ <t t-set="_id" t-value="_.uniqueId('export')"/> <form action="" method="post" enctype="multipart/form-data" class="oe_import"> <input type="hidden" name="csrf_token" t-att-value="csrf_token"/> - <input type="hidden" name="session_id" - t-att-value="widget.session.session_id"/> <input type="hidden" name="import_id"/> <div class="oe_import_box col-lg-12 d-none"> <input accept=".csv, .xls, .xlsx, .xlsm, .ods" t-attf-id="file_#{_id}" |