[FIX] base_import_module: CSRF handling

* disabled CSRF protection for login route
* return CSRF token from login and retransmit it during module upload

``deploy`` only sends CSRF token if given one by authenticate so that
the command can be used for non-updated modules.

Closes #9488

1 files changed, 4 insertions, 2 deletions

diff --git a/addons/base_import_module/controllers/main.py b/addons/base_import_module/controllers/main.py
index 0d2cdc1ab5b..4b51e69f096 100644
--- a/addons/base_import_module/controllers/main.py
+++ b/addons/base_import_module/controllers/main.py
@@ -21,7 +21,7 @@ class ImportModule(Controller):
         if not is_admin:
             raise openerp.exceptions.AccessError("Only administrators can upload a module")
 
-    @route('/base_import_module/login', type='http', auth='none', methods=['POST'])
+    @route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False)
     @webservice
     def login(self, login, password, db=None):
         if db and db != request.db:
@@ -30,7 +30,9 @@ class ImportModule(Controller):
         if not uid:
             return Response(response="Wrong login/password", status=401)
         self.check_user(uid)
-        return "ok"
+        return Response(headers={
+            'X-CSRF-TOKEN': request.csrf_token(),
+        })
 
     @route('/base_import_module/upload', type='http', auth='user', methods=['POST'])
     @webservice