diff options
| author | Olivier Dony <odo@openerp.com> | 2015-10-01 02:39:28 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2015-10-01 02:45:34 +0200 |
| commit | 8932c52e672ef106d5614643511ea2b8cbe54473 (patch) | |
| tree | 71643b791ac5904d8f9bd0e4631d7462c8bc46f8 /addons/web/static/src/xml/base.xml | |
| parent | 88b63a9b1957076bc05ce93270099b11e15cc851 (diff) | |
| parent | afa9f4b5fd5cd78336ec27a862dc626f7353ab24 (diff) | |
[MERGE] CSRF protection support in routes and forms
* make CSRF protection the default on all non-SAFE methods
(any method besides GET, HEAD, TRACE and OPTIONS )
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get
the CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before
hashing/validating the CSRF token
* opt-out database manager from CSRF: the super-admin password
serves the purpose of a CSRF token in the database manager screens.
Implementation by xmo@odoo.com and chs@odoo.com
Diffstat (limited to 'addons/web/static/src/xml/base.xml')
| -rw-r--r-- | addons/web/static/src/xml/base.xml | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml index cae5392cf3b..0ce2ab0f08f 100644 --- a/addons/web/static/src/xml/base.xml +++ b/addons/web/static/src/xml/base.xml @@ -988,7 +988,8 @@ <t t-name="HiddenInputFile"> <div t-attf-class="oe_hidden_input_file #{fileupload_class or ''}" t-att-style="fileupload_style"> <form class="o_form_binary_form" t-att-target="fileupload_id" - method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'"> + method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'"> + <input type="hidden" name="csrf_token" t-att-value="csrf_token"/> <input type="hidden" name="session_id" value="" t-if="widget.session.override_session"/> <input type="hidden" name="callback" t-att-value="fileupload_id"/> <t t-raw="0"/> |