diff options
| author | Jérome Maes <jem@openerp.com> | 2015-09-25 10:33:51 +0200 |
|---|---|---|
| committer | Jérome Maes <jem@openerp.com> | 2015-09-25 16:03:49 +0200 |
| commit | 6bba311d8cc8dea750bd386f0fecd2ddb8dcb1e3 (patch) | |
| tree | 0cb72afeae65eaf99b43382c59186578c36cf008 /addons/web/static/src/js/widgets | |
| parent | c436c56148a386e7121358d9bc7db3b7d0f88052 (diff) | |
[FIX] website_mail : force login to post comment
Transform POST param into GET param when redirecting to login page can cause security issues. Now, instead of displaying textarea (even if public user) and the redirect to login page keeping written comment, we display the login button with a redirection to the page to comment.
The redirection happen before commenting, avoiding to remenber param such comment text, rating, ...
To post a comment, the user must:
- be connected
- have a token
- or have a sha_sign
Diffstat (limited to 'addons/web/static/src/js/widgets')
0 files changed, 0 insertions, 0 deletions