[FIX] web, openerp: debug mode now works without referer

In some cases the Referer HTTP header may be missing or
stripped by a proxy, browser extension or anti-virus.
This breaks debug mode because it was solely relying
on the Referer header.

Introducing an explicit X-Debug-Mode header for RPC
calls allows for an alternative method that works
even when the Referer is missing.

This won't work in all cases, e.g. for direct $.ajax
calls, for example.

Closes #9824

addons/web/static/src/js/framework/session.js

@@ -335,6 +335,11 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
         var self = this;
         options = _.clone(options || {});
         var shadow = options.shadow || false;
+        options.headers = _.extend({}, options.headers)
+        if (odoo.debug) {
+            options.headers["X-Debug-Mode"] = true;
+        }
+
         delete options.shadow;
 
         return self.check_session_id().then(function() {
@@ -350,18 +355,14 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             if (self.origin_server) {
                 fct = ajax.jsonRpc;
                 if (self.override_session) {
-                    options.headers = _.extend({}, options.headers, {
-                        "X-Openerp-Session-Id": self.override_session ? self.session_id || '' : ''
-                    });
+                    options.headers["X-Openerp-Session-Id"] = self.session_id || '';
                 }
             } else if (self.use_cors) {
                 fct = ajax.jsonRpc;
                 url = self.url(url, null);
                 options.session_id = self.session_id || '';
                 if (self.override_session) {
-                    options.headers = _.extend({}, options.headers, {
-                        "X-Openerp-Session-Id": self.override_session ? self.session_id || '' : ''
-                    });
+                    options.headers["X-Openerp-Session-Id"] = self.session_id || '';
                 }
             } else {
                 fct = ajax.jsonpRpc;

openerp/http.py

@@ -321,6 +321,11 @@ class WebRequest(object):
         """ Indicates whether the current request is in "debug" mode
         """
         debug = 'debug' in self.httprequest.args
+
+        # check if request from rpc in debug mode
+        if not debug:
+            debug = self.httprequest.environ.get('HTTP_X_DEBUG_MODE')
+
         if not debug and self.httprequest.referrer:
             debug = bool(urlparse.parse_qs(urlparse.urlparse(self.httprequest.referrer).query, keep_blank_values=True).get('debug'))
         return debug