diff options
| author | Xavier Morel <xmo@odoo.com> | 2015-09-23 15:55:24 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2015-10-01 01:36:50 +0200 |
| commit | cea29e0c0176657f094ab80b460be503affe8a1b (patch) | |
| tree | 445bbe02c60a5f5a3d6638b38888591fe452a08c /addons/web_editor/static/src/xml | |
| parent | 7753ed7ce4b8e6eb06dc42e284af39fbd9ccefd5 (diff) | |
[ADD] client-side CSRF support
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
Diffstat (limited to 'addons/web_editor/static/src/xml')
| -rw-r--r-- | addons/web_editor/static/src/xml/editor.xml | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml index 2146f916937..44abb32caf1 100644 --- a/addons/web_editor/static/src/xml/editor.xml +++ b/addons/web_editor/static/src/xml/editor.xml @@ -88,8 +88,7 @@ enctype="multipart/form-data" target="fileframe" class="form-inline"> - <!-- why is this template rendered client side? --> - <!-- input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/--> + <input type="hidden" name="csrf_token" t-att-value="csrf_token"/> <div class="well"> <div class="form-group pull-left"> <input type="file" name="upload" t-att-accept="widget.accept" multiple="multiple" style="position: absolute; opacity: 0; width: 1px; height: 1px;"/> |