From 045b9019ef70d3fa2df0acb6ea3fd112c06bf7bb Mon Sep 17 00:00:00 2001 From: Xavier Morel Date: Mon, 9 Nov 2015 14:17:51 +0530 Subject: [FIX] base_import_module: CSRF handling * disabled CSRF protection for login route * return CSRF token from login and retransmit it during module upload ``deploy`` only sends CSRF token if given one by authenticate so that the command can be used for non-updated modules. Closes #9488 --- addons/base_import_module/controllers/main.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'addons/base_import_module/controllers/main.py') diff --git a/addons/base_import_module/controllers/main.py b/addons/base_import_module/controllers/main.py index 0d2cdc1ab5b..4b51e69f096 100644 --- a/addons/base_import_module/controllers/main.py +++ b/addons/base_import_module/controllers/main.py @@ -21,7 +21,7 @@ class ImportModule(Controller): if not is_admin: raise openerp.exceptions.AccessError("Only administrators can upload a module") - @route('/base_import_module/login', type='http', auth='none', methods=['POST']) + @route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False) @webservice def login(self, login, password, db=None): if db and db != request.db: @@ -30,7 +30,9 @@ class ImportModule(Controller): if not uid: return Response(response="Wrong login/password", status=401) self.check_user(uid) - return "ok" + return Response(headers={ + 'X-CSRF-TOKEN': request.csrf_token(), + }) @route('/base_import_module/upload', type='http', auth='user', methods=['POST']) @webservice -- cgit v1.2.3