* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
Office Outlook doesn't take into account the [style] attribute, and it
doesn't manage width/height in percent value.
This commit set width/heigth attribute in pixels and also always set the
width/height in style attribute (keeping them in the original unit and
setting them to auto if not present).
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
The `unittest2` package is simply a backport of `unittest` from the
Standard Library of Python 2.7 to previous versions.
There is no reason to use it any longer.
Closes#6941
Before: if a user blur a editable area without editing, the editor is removed and all bind are remove.
The 'content_changed' bind are removed and the 'o_dirty' class is never apply.
Add "web_editor_inside_iframe" id in web_editor iframe template to apply css style only when the field is in html field.
Remove "content" css media query in iframe editor to remove scrollbar.
If the iframe is destroyed, detached, hide (eg: click on a record, return into the list view and click on an other record), the render_value method try to resize the iframe but jQery raise an exception because contentWindow doesn't exist.
The css of a mail is inlined as best as possible for the mail sending.
Previously, if there was a selector like .ch[onclick="ga(this,event)"]
the simple splitting would split in the middle and get one erroneous
selector (which then would trigger an error).
With his commit, rules containing " or ' are ignored.
opw-643548
note: forward port of 6316bce
Now that most refactoring has been merged
It is better to have red a great work of another culture in translation than never to have read it at all.
― Henry Gratton Doyle
lxml.HTMLParser detect the content encoding by itself if not specified.
in the issue leading to this fix, content in a mail with u'\xa4'
( ) was transformed intto u'\xc2\xa4' (Â ) since HTMLParser
selected the wrong encoding (latin-1 instead of utf-8 for example).
this commit specify the known encoding and revert 3d00c210f which was
another attempt at this issue.
Clean for save was only called on o_dirty nodes but o_dirty is added only on o_editable nodes.
Could use a simple jQuery selector '.o_dirty, .o_dirty *' but need to improve speed for user experience.
Nicolas Lempereur