From 7636b510a2cfc48bd0281374596f3c7caf1f7edf Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Tue, 11 Aug 2015 15:03:41 +0200 Subject: [ADD] *: CSRF protection in forms and routes * make CSRF protection the default on all non-SAFE methods note: there currently is no way to call a CSRF-protected endpoint without a form-encoded entity-body as that's the only place we get the CSRF token from. * simple CSRF token generation: just use the HMAC'd session id, no generating a new random token per session then HMAC it * use constant-time equal function to avoid timing attacks * assert that a database secret is configured before hashing/validating the CSRF token * opt-out database manager from CSRF: The super-admin password serves the purpose of a CSRF token in the database manager screens. There is no request database to obtain the secret and generate a CSRF token. --- addons/web_editor/static/src/xml/editor.xml | 2 ++ 1 file changed, 2 insertions(+) (limited to 'addons/web_editor/static/src/xml/editor.xml') diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml index f8de06e6937..2146f916937 100644 --- a/addons/web_editor/static/src/xml/editor.xml +++ b/addons/web_editor/static/src/xml/editor.xml @@ -88,6 +88,8 @@ enctype="multipart/form-data" target="fileframe" class="form-inline"> + +
-- cgit v1.2.3