From cea29e0c0176657f094ab80b460be503affe8a1b Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 23 Sep 2015 15:55:24 +0200
Subject: [ADD] client-side CSRF support

* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post

  /cc @dmo-odoo I've no idea how that was supposed to work, from looking
  things up all modern browsers seem to support FormData, and old IEs
  which don't don't support fallbacks either and would require
  submitting an actual form as fallback so...
---
 addons/web_editor/static/src/xml/editor.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'addons/web_editor/static/src/xml/editor.xml')

diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml
index 2146f916937..44abb32caf1 100644
--- a/addons/web_editor/static/src/xml/editor.xml
+++ b/addons/web_editor/static/src/xml/editor.xml
@@ -88,8 +88,7 @@
                   enctype="multipart/form-data"
                   target="fileframe"
                   class="form-inline">
-                  <!-- why is this template rendered client side? -->
-                <!-- input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/-->
+                <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
                 <div class="well">
                     <div class="form-group pull-left">
                         <input type="file" name="upload" t-att-accept="widget.accept" multiple="multiple" style="position: absolute; opacity: 0; width: 1px; height: 1px;"/>
-- 
cgit v1.2.3