This commit is a security reinforcement.
Before this commit:
ir.action.act_url was able to handle and redirect to protocols like
file:, javascript:, date: ... This is unnecessary in the context of
this action. It could potentially be abused by a poorly written custom
module
It also would not isolate the landing page in case of a new tabs.
It means that chrome would still consider the tab to be from the
previous domain in case no url was passed and js was executed.
This would allow the newly open tab to still make query's to the
referrer using the referrer's cookie. While not stricly necessary
if we already prevent url that start with "javascript:", it is a
nice to have.
After this commit:
New tabs are not able to access referrer informations or execute
javascript interacting with the referrer. Also, it is now impossible
to redirect to protocols other than http and https directly from
the ir.action.act_url
Test update:
All new tabs are required to have the "noreferrer" argument
Tested an example of an unsupported protocol.
closesodoo/odoo#117687
X-original-commit: a020072da17e32fca0bbe6ed02b1afaeec8e8a02
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
flvr-odoo
3cfcb204ed