From 31664422c11ab1e9c34ad6b2eb1dfba2af72e359 Mon Sep 17 00:00:00 2001 From: Martin Geubelle Date: Thu, 10 Jan 2019 11:25:13 +0000 Subject: [IMP] web, *: remove explicit references to `session_id` Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so it cannot be accessed through client side script. But before this rev. the `session_id` was still provided by the server to the webclient (in session_info, mostly) and was stored and accessible. This made XSS injection more dangerous than they should be as it was very easy to steal the `session_id`. As the browser automatically set the `session_id` on every request to the server, the webclient shouldn't need any explicit reference. --- addons/web/static/src/js/fields/basic_fields.js | 1 - 1 file changed, 1 deletion(-) (limited to 'addons/web/static/src/js/fields/basic_fields.js') diff --git a/addons/web/static/src/js/fields/basic_fields.js b/addons/web/static/src/js/fields/basic_fields.js index b3cd17a38ee..ae080f45a11 100644 --- a/addons/web/static/src/js/fields/basic_fields.js +++ b/addons/web/static/src/js/fields/basic_fields.js @@ -1446,7 +1446,6 @@ var AbstractFieldBinary = AbstractField.extend({ self.on_file_uploaded(file.size, file.name, file.type, data); }; } else { - this.$('form.o_form_binary_form input[name=session_id]').val(this.getSession().session_id); this.$('form.o_form_binary_form').submit(); } this.$('.o_form_binary_progress').show(); -- cgit v1.2.3