From 31664422c11ab1e9c34ad6b2eb1dfba2af72e359 Mon Sep 17 00:00:00 2001
From: Martin Geubelle <mge@odoo.com>
Date: Thu, 10 Jan 2019 11:25:13 +0000
Subject: [IMP] web, *: remove explicit references to `session_id`

Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so
it cannot be accessed through client side script. But before this rev. the
`session_id` was still provided by the server to the webclient (in session_info,
mostly) and was stored and accessible. This made XSS injection more
dangerous than they should be as it was very easy to steal the `session_id`.

As the browser automatically set the `session_id` on every request to the server,
the webclient shouldn't need any explicit reference.
---
 addons/web/static/src/xml/base.xml | 4 ----
 1 file changed, 4 deletions(-)

(limited to 'addons/web/static/src/xml')

diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index 5e2f27ccc66..dc40c962333 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -378,7 +378,6 @@
                         <t t-set="multi_upload" t-value="true"/>
                         <input type="hidden" name="model" t-att-value="widget.env and widget.env.model"/>
                         <input type="hidden" name="id" t-att-value="widget.env.activeIds[0]"/>
-                        <input type="hidden" name="session_id" t-att-value="widget.getSession().session_id" t-if="widget.getSession().override_session"/>
                         <span>Add...</span>
                     </t>
                 </div>
@@ -998,7 +997,6 @@
         <form class="o_form_binary_form" t-att-target="fileupload_id"
               method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
             <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
-            <input type="hidden" name="session_id" value="" t-if="widget.getSession().override_session"/>
             <input type="hidden" name="callback" t-att-value="fileupload_id"/>
             <input t-if="widget.image_only" type="file" class="o_input_file" name="ufile" accept="image/*"/>
             <input t-if="!widget.image_only" type="file" class="o_input_file" name="ufile" t-att="{'multiple': multi_upload ? 'multiple' : null}"/>
@@ -1042,7 +1040,6 @@
             <t t-set="multi_upload" t-value="true"/>
             <input type="hidden" name="model" t-att-value="widget.model"/>
             <input type="hidden" name="id" value="0"/>
-            <input t-if="widget.getSession().override_session" type="hidden" name="session_id" t-att-value="widget.getSession().session_id"/>
         </t>
     </div>
 </div>
@@ -1567,7 +1564,6 @@
                 <t t-set="multi_upload" t-value="true"/>
                 <input type="hidden" name="model" t-att-value="widget.res_model"/>
                 <input type="hidden" name="id" t-att-value="widget.res_id"/>
-                <input type="hidden" name="session_id" t-att-value="widget.getSession().session_id"/>
             </t>
         </span>
     </button>
-- 
cgit v1.2.3