| Age | Commit message (Collapse) | Author |
|
Note: move test models file in models to not import tests
directory, which breaks the mute_logger of test cases
|
|
|
|
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
|
|
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes #6940
|
|
bzr revid: al@openerp.com-20131027173143-tfxc7e7vqn7re6wb
|
|
all, replace with @route
bzr revid: xmo@openerp.com-20131015095331-r2xm2198zrwax0c7
|
|
bzr revid: xmo@openerp.com-20121127164543-xizox8d20e93lx21
|
|
bzr revid: al@openerp.com-20121010204617-ah29rz616xo7i2dr
|
|
bzr revid: xmo@openerp.com-20120830103928-rjtrdvkzrybfpi0c
|
|
bzr revid: xmo@openerp.com-20120830103215-trv5cjg9jvj8ano1
|
|
displaying the preview
bzr revid: xmo@openerp.com-20120814121610-j2rpg7u5zh4h93j1
|