From 31664422c11ab1e9c34ad6b2eb1dfba2af72e359 Mon Sep 17 00:00:00 2001
From: Martin Geubelle <mge@odoo.com>
Date: Thu, 10 Jan 2019 11:25:13 +0000
Subject: [IMP] web, *: remove explicit references to `session_id`

Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so
it cannot be accessed through client side script. But before this rev. the
`session_id` was still provided by the server to the webclient (in session_info,
mostly) and was stored and accessible. This made XSS injection more
dangerous than they should be as it was very easy to steal the `session_id`.

As the browser automatically set the `session_id` on every request to the server,
the webclient shouldn't need any explicit reference.
---
 addons/project/static/src/xml/project.xml | 1 -
 1 file changed, 1 deletion(-)

(limited to 'addons/project/static/src/xml/project.xml')

diff --git a/addons/project/static/src/xml/project.xml b/addons/project/static/src/xml/project.xml
index ea69825c5a7..4be07b70fcd 100644
--- a/addons/project/static/src/xml/project.xml
+++ b/addons/project/static/src/xml/project.xml
@@ -15,7 +15,6 @@
                 <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t>
                 <input type="hidden" name="model" t-att-value="widget.modelName" />
                 <input type="hidden" name="id" t-att-value="widget.id" />
-                <input type="hidden" name="session_id" t-att-value="widget.getSession().session_id" />
             </t>
         </span>
     </t>
-- 
cgit v1.2.3