flvr-odoo
3cfcb204ed
This commit is a security reinforcement. Before this commit: ir.action.act_url was able to handle and redirect to protocols like file:, javascript:, date: ... This is unnecessary in the context of this action. It could potentially be abused by a poorly written custom module It also would not isolate the landing page in case of a new tabs. It means that chrome would still consider the tab to be from the previous domain in case no url was passed and js was executed. This would allow the newly open tab to still make query's to the referrer using the referrer's cookie. While not stricly necessary if we already prevent url that start with "javascript:", it is a nice to have. After this commit: New tabs are not able to access referrer informations or execute javascript interacting with the referrer. Also, it is now impossible to redirect to protocols other than http and https directly from the ir.action.act_url Test update: All new tabs are required to have the "noreferrer" argument Tested an example of an unsupported protocol. closes odoo/odoo#117687 X-original-commit: a020072da17e32fca0bbe6ed02b1afaeec8e8a02 Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials