diff options
| author | Robot Odoo <xmo+roboto@odoo.com> | 2019-02-13 14:16:25 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-02-13 14:16:25 +0100 |
| commit | 2d3dbff9653ed2b2a35e997f5c1faa99007085c5 (patch) | |
| tree | 0ce58a74fde6024cd654ab04390775eaf93e9bf7 /addons/mail/static/src/xml | |
| parent | 984bf2492a16f0ff357b3fc03712c68f1a011f96 (diff) | |
| parent | 7abeaf56b3ae544dbe24c4a9fe4fa6d919582aba (diff) | |
[IMP] web, *: remove explicit references to `session_id`
Before this rev. the `session_id` was provided by the server to the webclient (in
session_info, mostly) and was stored and accessible. This made XSS injection more
dangerous than they should be as it was very easy to steal the `session_id`.
As the browser automatically set the `session_id` on every request to the server,
the webclient shouldn't need any explicit reference.
Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so
it cannot be accessed through client side script.
Task 1905359
closes odoo/odoo#30098
Diffstat (limited to 'addons/mail/static/src/xml')
| -rw-r--r-- | addons/mail/static/src/xml/activity.xml | 1 | ||||
| -rw-r--r-- | addons/mail/static/src/xml/composer.xml | 1 | ||||
| -rw-r--r-- | addons/mail/static/src/xml/web_kanban_activity.xml | 1 |
3 files changed, 0 insertions, 3 deletions
diff --git a/addons/mail/static/src/xml/activity.xml b/addons/mail/static/src/xml/activity.xml index dafad00b008..217e1a39f5c 100644 --- a/addons/mail/static/src/xml/activity.xml +++ b/addons/mail/static/src/xml/activity.xml @@ -98,7 +98,6 @@ <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t> <input type="hidden" name="model" t-att-value="activity.res_model"/> <input type="hidden" name="id" t-att-value="activity.res_id"/> - <input type="hidden" name="session_id" t-att-value="session.session_id"/> </t> </span> <a role="button" href="#" class="btn btn-link btn-secondary text-muted o_edit_activity o_activity_link" t-att-data-activity-id="activity.id"> diff --git a/addons/mail/static/src/xml/composer.xml b/addons/mail/static/src/xml/composer.xml index b9de0194e93..f405617affa 100644 --- a/addons/mail/static/src/xml/composer.xml +++ b/addons/mail/static/src/xml/composer.xml @@ -37,7 +37,6 @@ <t t-set="multi_upload" t-value="true"/> <input type="hidden" name="model" value="mail.compose.message"/> <input type="hidden" name="id" value="0"/> - <input type="hidden" name="session_id" t-att-value="widget.getSession().session_id"/> </t> </span> </div> diff --git a/addons/mail/static/src/xml/web_kanban_activity.xml b/addons/mail/static/src/xml/web_kanban_activity.xml index 698091e9875..4d6c290f11f 100644 --- a/addons/mail/static/src/xml/web_kanban_activity.xml +++ b/addons/mail/static/src/xml/web_kanban_activity.xml @@ -92,7 +92,6 @@ <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t> <input type="hidden" name="model" t-att-value="log.res_model"/> <input type="hidden" name="id" t-att-value="log.res_id"/> - <input type="hidden" name="session_id" t-att-value="session.session_id"/> </t> </span> </t> |