diff options
| author | Xavier Morel <xmo@odoo.com> | 2015-11-09 14:17:51 +0530 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2016-01-12 19:05:43 +0100 |
| commit | 045b9019ef70d3fa2df0acb6ea3fd112c06bf7bb (patch) | |
| tree | 5d1f4d95fc4ec05efe804963674e6bc755ab9663 /addons/base_import_module/controllers/main.py | |
| parent | 33299fd689b7f61e8e7b83251d56cb00989e9777 (diff) | |
[FIX] base_import_module: CSRF handling
* disabled CSRF protection for login route
* return CSRF token from login and retransmit it during module upload
``deploy`` only sends CSRF token if given one by authenticate so that
the command can be used for non-updated modules.
Closes #9488
Diffstat (limited to 'addons/base_import_module/controllers/main.py')
| -rw-r--r-- | addons/base_import_module/controllers/main.py | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/addons/base_import_module/controllers/main.py b/addons/base_import_module/controllers/main.py index 0d2cdc1ab5b..4b51e69f096 100644 --- a/addons/base_import_module/controllers/main.py +++ b/addons/base_import_module/controllers/main.py @@ -21,7 +21,7 @@ class ImportModule(Controller): if not is_admin: raise openerp.exceptions.AccessError("Only administrators can upload a module") - @route('/base_import_module/login', type='http', auth='none', methods=['POST']) + @route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False) @webservice def login(self, login, password, db=None): if db and db != request.db: @@ -30,7 +30,9 @@ class ImportModule(Controller): if not uid: return Response(response="Wrong login/password", status=401) self.check_user(uid) - return "ok" + return Response(headers={ + 'X-CSRF-TOKEN': request.csrf_token(), + }) @route('/base_import_module/upload', type='http', auth='user', methods=['POST']) @webservice |