To set utm values (medium, source and campaign) on created record, the
system use default function which check cookies and other funny things.
But for website form creating a record, the medium value would be
overrided always to Website whilst that should be a fallback (and the
set medium should have priority).
closes#10848
opw-668853
In ddac26c `crm.crm_medium_website` was replaced by
`utm.utm_medium_website`.
There was one place where it was not reverberated so the medium_id was
always unset in that instance (a crm.lead created from a website form).
opw-668853
note: equivalent of saas-6's 3ea3348
* blacklist all fields by default
* don't use blacklist in get_authorized_fields which is called to see if
a field can be added to a form, instead only use it afterwards to see
if the field can be written to by the formbuilder. That way
formbuilder can whitelist fields which are actually added to forms
on-demand resulting in a more secure interaction
In noupdate, the opt-in setting is ignored by migrations and breaks the
corresponding feature. If the feature is undesirable, don't install the
module.
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Christophe Simonis