From cea29e0c0176657f094ab80b460be503affe8a1b Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 23 Sep 2015 15:55:24 +0200
Subject: [PATCH] [ADD] client-side CSRF support

* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post

  /cc @dmo-odoo I've no idea how that was supposed to work, from looking
  things up all modern browsers seem to support FormData, and old IEs
  which don't don't support fallbacks either and would require
  submitting an actual form as fallback so...
---
 addons/base_import/static/src/xml/import.xml |  1 +
 addons/web/static/src/js/framework/ajax.js   | 17 ++++++++++-------
 addons/web/static/src/xml/base.xml           |  3 ++-
 addons/web/views/webclient_templates.xml     |  7 +++++++
 addons/web_editor/static/src/xml/editor.xml  |  3 +--
 addons/website/static/src/js/website.js      | 17 ++++++++++++-----
 addons/website/views/website_templates.xml   |  7 +++++++
 7 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/addons/base_import/static/src/xml/import.xml b/addons/base_import/static/src/xml/import.xml
index ae5c78c497d..7723f7b5266 100644
--- a/addons/base_import/static/src/xml/import.xml
+++ b/addons/base_import/static/src/xml/import.xml
@@ -2,6 +2,7 @@
     <t t-name="ImportView">
         <t t-set="_id" t-value="_.uniqueId('export')"/>
         <form action="" method="post" enctype="multipart/form-data" class="oe_import">
+            <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
             <input type="hidden" name="session_id"
                t-att-value="widget.session.session_id"/>
             <input type="hidden" name="import_id"/>
diff --git a/addons/web/static/src/js/framework/ajax.js b/addons/web/static/src/js/framework/ajax.js
index f8392287b26..d6619449a0f 100644
--- a/addons/web/static/src/js/framework/ajax.js
+++ b/addons/web/static/src/js/framework/ajax.js
@@ -1,6 +1,7 @@
 odoo.define('web.ajax', function (require) {
 "use strict";
 
+var core = require('web.core');
 var time = require('web.time');
 var utils = require('web.utils');
 
@@ -238,6 +239,11 @@ function get_file(options) {
             method: 'POST'
         }).appendTo(document.body);
     }
+    if (core.csrf_token) {
+        $('<input type="hidden" name="csrf_token">')
+                .val(core.csrf_token)
+                .appendTo($form_data);
+    }
 
     var hparams = _.extend({}, options.data || {}, {token: token});
     _.each(hparams, function (value, key) {
@@ -292,19 +298,16 @@ function post (controller_url, data) {
     };
 
     var Def = $.Deferred();
-    var compatibility = !(typeof(FormData));
-    var postData = compatibility ? new FormDataCompatibility() : new FormData();
+    var postData = new FormData();
     
     $.each(data, function(i,val) {
         postData.append(i, val);
     });
-
-    var xhr = new XMLHttpRequest();
-    if(compatibility) {
-        postData.setContentTypeHeader(xhr);
-        postData = postData.buildBody();
+    if (core.csrf_token) {
+        postData.append('csrf_token', core.csrf_token);
     }
 
+    var xhr = new XMLHttpRequest();
     if(xhr.upload) xhr.upload.addEventListener('progress', progressHandler(Def), false);
       
     var ajaxDef = $.ajax(controller_url, {
diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index cae5392cf3b..0ce2ab0f08f 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -988,7 +988,8 @@
 <t t-name="HiddenInputFile">
     <div t-attf-class="oe_hidden_input_file #{fileupload_class or ''}" t-att-style="fileupload_style">
         <form class="o_form_binary_form" t-att-target="fileupload_id"
-            method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
+              method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
+            <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
             <input type="hidden" name="session_id" value="" t-if="widget.session.override_session"/>
             <input type="hidden" name="callback" t-att-value="fileupload_id"/>
             <t t-raw="0"/>
diff --git a/addons/web/views/webclient_templates.xml b/addons/web/views/webclient_templates.xml
index 6147e3d3a04..03723cf9a24 100644
--- a/addons/web/views/webclient_templates.xml
+++ b/addons/web/views/webclient_templates.xml
@@ -301,6 +301,13 @@
             <t t-call="web.layout">
                 <t t-set="head">
                     <t t-call-assets="web.assets_common"/>
+                    <script type="text/javascript">
+                        odoo.define('web.csrf', function (require) {
+                            var token = "<t t-esc="request.csrf_token(None)"/>";
+                            require('web.core').csrf_token = token;
+                            require('qweb').default_dict.csrf_token = token;
+                        });
+                    </script>
                     <t t-call-assets="web.assets_backend"/>
                     &lt;!--[if lte IE 9]&gt; <link rel="stylesheet" href="/web/static/src/css/ie.css"/> &lt;![endif]--&gt;
                     <script type="text/javascript">
diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml
index 2146f916937..44abb32caf1 100644
--- a/addons/web_editor/static/src/xml/editor.xml
+++ b/addons/web_editor/static/src/xml/editor.xml
@@ -88,8 +88,7 @@
                   enctype="multipart/form-data"
                   target="fileframe"
                   class="form-inline">
-                  <!-- why is this template rendered client side? -->
-                <!-- input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/-->
+                <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
                 <div class="well">
                     <div class="form-group pull-left">
                         <input type="file" name="upload" t-att-accept="widget.accept" multiple="multiple" style="position: absolute; opacity: 0; width: 1px; height: 1px;"/>
diff --git a/addons/website/static/src/js/website.js b/addons/website/static/src/js/website.js
index ded64d27704..821223967c1 100644
--- a/addons/website/static/src/js/website.js
+++ b/addons/website/static/src/js/website.js
@@ -142,16 +142,23 @@ var error = function(data, url) {
     $error.modal('show');
 };
 
+function _add_input(form, name, value) {
+    var param = document.createElement('input');
+    param.setAttribute('type', 'hidden');
+    param.setAttribute('name', name);
+    param.setAttribute('value', value);
+    form.appendChild(param);
+}
 var form = function (url, method, params) {
     var form = document.createElement('form');
     form.setAttribute('action', url);
     form.setAttribute('method', method);
+
+    if (core.csrf_token) {
+        _add_input(form, 'csrf_token', core.csrf_token);
+    }
     _.each(params, function (v, k) {
-        var param = document.createElement('input');
-        param.setAttribute('type', 'hidden');
-        param.setAttribute('name', k);
-        param.setAttribute('value', v);
-        form.appendChild(param);
+        _add_input(form, k, v);
     });
     document.body.appendChild(form);
     form.submit();
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index 5a7735d1626..b56d76e8e53 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -130,6 +130,13 @@
             <t t-call-assets="website.assets_frontend" t-js="false"/>
             <t t-call-assets="web.assets_common" t-css="false"/>
             <t t-call-assets="website.assets_frontend" t-css="false"/>
+            <script type="text/javascript">
+                odoo.define('web.csrf', function (require) {
+                    var token = "<t t-esc="request.csrf_token(None)"/>";
+                    require('web.core').csrf_token = token;
+                    require('qweb').default_dict.csrf_token = token;
+                });
+            </script>
 
             <t t-raw="head or ''" name='layout_head'/>
         </head>