diff options
| author | Christophe Simonis <chs@odoo.com> | 2015-08-11 15:03:41 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2015-10-01 01:36:50 +0200 |
| commit | 7636b510a2cfc48bd0281374596f3c7caf1f7edf (patch) | |
| tree | ec6e2fd9ae83aa15f61f7db620c980c80197813d /addons/web/controllers/main.py | |
| parent | 058b33544ff5c89891cddf3b2060ab046a98d3f6 (diff) | |
[ADD] *: CSRF protection in forms and routes
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Diffstat (limited to 'addons/web/controllers/main.py')
| -rw-r--r-- | addons/web/controllers/main.py | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 77975d11006..8f00d97a254 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -736,7 +736,7 @@ class Database(http.Controller): def manager(self, **kw): return self._render_template() - @http.route('/web/database/create', type='http', auth="none") + @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False) def create(self, master_pwd, name, lang, password, **post): try: request.session.proxy("db").create_database(master_pwd, name, bool(post.get('demo')), lang, password) @@ -746,7 +746,7 @@ class Database(http.Controller): error = "Database creation error: %s" % e return self._render_template(error=error) - @http.route('/web/database/duplicate', type='http', auth="none") + @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False) def duplicate(self, master_pwd, name, new_name): try: request.session.proxy("db").duplicate_database(master_pwd, name, new_name) @@ -755,7 +755,7 @@ class Database(http.Controller): error = "Database duplication error: %s" % e return self._render_template(error=error) - @http.route('/web/database/drop', type='http', auth="none") + @http.route('/web/database/drop', type='http', auth="none", methods=['POST'], csrf=False) def drop(self, master_pwd, name): try: request.session.proxy("db").drop(master_pwd, name) @@ -764,7 +764,7 @@ class Database(http.Controller): error = "Database deletion error: %s" % e return self._render_template(error=error) - @http.route('/web/database/backup', type='http', auth="none") + @http.route('/web/database/backup', type='http', auth="none", methods=['POST'], csrf=False) def backup(self, master_pwd, name, backup_format = 'zip'): try: openerp.service.db.check_super(master_pwd) @@ -782,7 +782,7 @@ class Database(http.Controller): error = "Database backup error: %s" % e return self._render_template(error=error) - @http.route('/web/database/restore', type='http', auth="none") + @http.route('/web/database/restore', type='http', auth="none", methods=['POST'], csrf=False) def restore(self, master_pwd, backup_file, name, copy=False): try: data = base64.b64encode(backup_file.read()) @@ -792,7 +792,7 @@ class Database(http.Controller): error = "Database restore error: %s" % e return self._render_template(error=error) - @http.route('/web/database/change_password', type='http', auth="none") + @http.route('/web/database/change_password', type='http', auth="none", methods=['POST'], csrf=False) def change_password(self, master_pwd, master_pwd_new): try: request.session.proxy("db").change_admin_password(master_pwd, master_pwd_new) |