Rather than trust the user-controlled mimetype or extension of imported
files which may be incorrect (because the user is lying, because the
system is misconfigured, because software is not installed, because
software is registering non-standard mimetypes, etc...), start by trying
to guess the mimetype *then* fallback on trying the type/ext.
Of note: CSV is becoming less and less great as it's nigh impossible to
guess for it.
If the user provides a known mimetype which doesn't actually match the
file as far as we're concerned, warn and fallback on extension rather
than blow up.
This comes up when a user installs Excel on Windows: it associates CSV
files with itself and sets their mime type to application/vnd.ms-excel,
which is not correct and leads to us trying to load a CSV with xlrd (an
excel-parsing library).
Fixes#9779
* add CSRF token as core.csrf_token
* add CSRF tokens to client-generated and/or JS-submitted forms
* remove broken "compatibility" mode of web.ajax.post
/cc @dmo-odoo I've no idea how that was supposed to work, from looking
things up all modern browsers seem to support FormData, and old IEs
which don't don't support fallbacks either and would require
submitting an actual form as fallback so...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
The stdlib version of the json library is more recent than the 3.5.3
version we are pinning in `requirements.txt`
There is no reason to use it.
Closes#6940
How great is it to get Odoo (almost) 9.0 (almost) translated?
Clean .tx/config file
Regenerate .pot files
Fetch current translations from Transifex (10% completion)
Christophe Simonis