From b7c92ecaac0a76f64f3c304c7c444ed19f3ed2e5 Mon Sep 17 00:00:00 2001 From: Aaron Bohy Date: Fri, 1 Sep 2017 21:22:38 +0200 Subject: [FIX] web: dialog: remove setTimeout making tests fail ... sometimes. When a dialog is destroyed, the last opened dialog (the one which is just below), if any, is focused. This allows to close it directly by pressing ESC. For an unknown reason, this was done in a setTimeout (delay 0). The problem is that the setTimeout made some JS tests fail randomly, when a test ending by closing a dialog was executed right before a test using a many2one inside a dialog. When this happened, the second test failed sometimes because its dialog was focused (because of the previous test) while waiting for the autocomplete dropdown to open, triggering a blur event on the m2o input, and thus making jquery autocomplete aborting the search, and the opening of the dropdown. --- addons/web/static/src/js/core/dialog.js | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'addons/web/static/src/js/core') diff --git a/addons/web/static/src/js/core/dialog.js b/addons/web/static/src/js/core/dialog.js index 6214c99483e..11ce34770de 100644 --- a/addons/web/static/src/js/core/dialog.js +++ b/addons/web/static/src/js/core/dialog.js @@ -151,13 +151,12 @@ var Dialog = Widget.extend({ this.$modal.modal('hide'); this.$modal.remove(); - setTimeout(function () { // Keep class modal-open (deleted by bootstrap hide fnct) on body to allow scrolling inside the modal - var modals = $('body > .modal').filter(':visible'); - if(modals.length) { - modals.last().focus(); - $('body').addClass('modal-open'); - } - }, 0); + var modals = $('body > .modal').filter(':visible'); + if (modals.length) { + modals.last().focus(); + // Keep class modal-open (deleted by bootstrap hide fnct) on body to allow scrolling inside the modal + $('body').addClass('modal-open'); + } } }); -- cgit v1.2.3 From f4d541e51abd7fcb3cd17d3e023b3132b9293d2a Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 5 Sep 2017 01:26:15 +0200 Subject: [IMP] http: set HTTPonly flag on session cookie This will reinforce the framework against potential XSS exploits escalating to session hijack --- addons/web/static/src/js/core/session.js | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'addons/web/static/src/js/core') diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js index 033d7995c9c..84d3234d8ba 100644 --- a/addons/web/static/src/js/core/session.js +++ b/addons/web/static/src/js/core/session.js @@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, { }).always(function () { self.avoid_recursion = false; }); - } else { - // normal use case, just use the cookie - self.session_id = utils.get_cookie("session_id"); - return $.when(); } + return $.when(); }, /** * Executes an RPC call, registering the provided callbacks. -- cgit v1.2.3