diff options
| author | Christophe Simonis <chs@odoo.com> | 2015-08-11 15:03:41 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2015-10-01 01:36:50 +0200 |
| commit | 7636b510a2cfc48bd0281374596f3c7caf1f7edf (patch) | |
| tree | ec6e2fd9ae83aa15f61f7db620c980c80197813d /addons/web_editor/static/src | |
| parent | 058b33544ff5c89891cddf3b2060ab046a98d3f6 (diff) | |
[ADD] *: CSRF protection in forms and routes
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Diffstat (limited to 'addons/web_editor/static/src')
| -rw-r--r-- | addons/web_editor/static/src/xml/editor.xml | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml index f8de06e6937..2146f916937 100644 --- a/addons/web_editor/static/src/xml/editor.xml +++ b/addons/web_editor/static/src/xml/editor.xml @@ -88,6 +88,8 @@ enctype="multipart/form-data" target="fileframe" class="form-inline"> + <!-- why is this template rendered client side? --> + <!-- input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/--> <div class="well"> <div class="form-group pull-left"> <input type="file" name="upload" t-att-accept="widget.accept" multiple="multiple" style="position: absolute; opacity: 0; width: 1px; height: 1px;"/> |