flvr-odoo
3cfcb204ed
[FIX] web : isolate new tab to external ressources
...
This commit is a security reinforcement.
Before this commit:
ir.action.act_url was able to handle and redirect to protocols like
file:, javascript:, date: ... This is unnecessary in the context of
this action. It could potentially be abused by a poorly written custom
module
It also would not isolate the landing page in case of a new tabs.
It means that chrome would still consider the tab to be from the
previous domain in case no url was passed and js was executed.
This would allow the newly open tab to still make query's to the
referrer using the referrer's cookie. While not stricly necessary
if we already prevent url that start with "javascript:", it is a
nice to have.
After this commit:
New tabs are not able to access referrer informations or execute
javascript interacting with the referrer. Also, it is now impossible
to redirect to protocols other than http and https directly from
the ir.action.act_url
Test update:
All new tabs are required to have the "noreferrer" argument
Tested an example of an unsupported protocol.
closes odoo/odoo#117687
X-original-commit: a020072da17e32fca0bbe6ed02b1afaeec8e8a02
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com >
2023-04-05 08:38:30 +02:00
..
2023-04-04 19:11:55 +02:00
2023-03-24 12:50:13 +01:00
2023-04-03 20:48:02 +02:00
2023-03-18 03:32:40 +01:00
2023-03-31 09:48:51 +02:00
2023-03-27 19:13:37 +02:00
2023-04-03 17:07:24 +02:00
2023-03-31 11:58:47 +02:00
2023-03-20 16:51:30 +01:00
2023-03-24 12:50:13 +01:00
2023-04-03 13:55:17 +02:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-08 11:37:07 +01:00
2023-04-03 17:07:24 +02:00
2023-04-04 13:35:18 +02:00
2023-04-03 17:07:24 +02:00
2023-03-07 11:11:51 +01:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-03-30 16:22:51 +02:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-14 15:52:10 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-28 18:45:47 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-04 17:03:37 +02:00
2023-03-20 16:51:30 +01:00
2023-04-03 17:07:24 +02:00
2023-04-04 17:03:28 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-03-16 14:12:37 +01:00
2023-03-20 16:51:28 +01:00
2023-03-20 16:51:30 +01:00
2023-03-23 09:06:52 +01:00
2023-03-14 12:23:45 +01:00
2023-03-31 15:51:59 +02:00
2023-04-03 17:07:24 +02:00
2023-03-02 19:24:45 +01:00
2023-03-24 12:50:13 +01:00
2023-04-03 17:07:24 +02:00
2023-03-24 07:45:15 +01:00
2023-03-24 12:50:13 +01:00
2023-03-24 12:50:13 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-01 23:28:07 +01:00
2023-04-03 17:07:24 +02:00
2023-03-31 10:53:08 +02:00
2023-03-27 09:40:01 +02:00
2023-03-27 07:28:59 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:06 +01:00
2023-03-20 16:51:30 +01:00
2023-04-04 12:10:53 +02:00
2023-02-15 10:14:53 +01:00
2023-03-22 00:53:57 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-03-15 13:19:45 +01:00
2023-03-20 11:20:38 +01:00
2023-04-04 18:07:14 +02:00
2023-04-03 17:07:07 +02:00
2023-03-31 08:50:55 +02:00
2023-03-14 09:55:52 +01:00
2023-03-31 08:50:55 +02:00
2023-02-16 09:01:07 +01:00
2023-03-31 15:52:33 +02:00
2023-03-20 16:51:30 +01:00
2023-03-27 12:47:20 +02:00
2023-03-20 16:51:30 +01:00
2023-04-04 16:01:57 +02:00
2023-03-30 16:23:13 +02:00
2023-03-07 10:06:13 +01:00
2023-04-03 17:07:24 +02:00
2023-02-17 19:30:40 +01:00
2023-03-07 10:06:13 +01:00
2023-03-15 07:27:40 +01:00
2023-04-04 14:45:57 +02:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-31 11:58:47 +02:00
2023-03-23 19:13:49 +01:00
2023-03-07 10:06:13 +01:00
2023-03-15 22:06:44 +01:00
2023-03-10 11:23:51 +01:00
2023-03-28 16:44:16 +02:00
2023-03-07 10:06:13 +01:00
2023-03-01 18:43:01 +01:00
2023-04-03 12:56:56 +02:00
2023-04-03 12:56:56 +02:00
2023-03-30 15:09:36 +02:00
2023-03-17 23:24:11 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-31 15:52:18 +02:00
2023-03-31 21:10:09 +02:00
2023-03-07 10:06:13 +01:00
2023-03-14 13:30:05 +01:00
2023-03-24 22:39:43 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-30 16:23:10 +02:00
2023-03-24 12:50:13 +01:00
2023-03-07 10:06:13 +01:00
2023-02-17 19:30:40 +01:00
2023-04-04 13:35:06 +02:00
2023-03-02 19:24:45 +01:00
2023-02-17 19:30:40 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-02-17 19:30:40 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-27 10:40:22 +02:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-10 13:32:41 +01:00
2023-02-27 11:47:11 +01:00
2023-02-27 11:47:11 +01:00
2023-03-07 10:06:13 +01:00
2023-03-29 13:06:52 +02:00
2023-03-15 16:08:08 +01:00
2023-03-25 02:47:01 +01:00
2023-04-04 16:01:48 +02:00
2023-03-07 10:06:13 +01:00
2023-03-28 16:44:20 +02:00
2023-03-07 10:06:13 +01:00
2023-03-24 12:50:13 +01:00
2023-02-17 19:30:40 +01:00
2023-03-31 15:52:18 +02:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-28 16:44:16 +02:00
2023-03-18 02:14:39 +01:00
2023-03-21 08:31:06 +01:00
2023-04-03 12:56:56 +02:00
2023-03-07 10:06:13 +01:00
2023-03-28 16:44:15 +02:00
2023-03-24 07:44:44 +01:00
2023-03-28 18:45:47 +02:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-28 16:44:15 +02:00
2023-03-28 16:44:16 +02:00
2023-03-07 10:06:13 +01:00
2023-03-13 15:27:58 +01:00
2023-02-17 19:30:40 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-07 10:06:13 +01:00
2023-03-20 16:51:30 +01:00
2023-03-27 19:13:50 +02:00
2023-03-27 20:06:54 +02:00
2023-03-20 16:51:30 +01:00
2023-04-04 20:08:44 +02:00
2023-04-04 20:08:36 +02:00
2023-03-20 07:58:46 +01:00
2023-03-24 12:50:13 +01:00
2023-04-03 17:07:24 +02:00
2023-03-14 15:52:10 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-14 15:52:10 +01:00
2023-03-24 12:50:13 +01:00
2023-03-24 12:50:13 +01:00
2023-03-20 16:51:30 +01:00
2023-03-14 15:52:10 +01:00
2023-03-14 15:52:10 +01:00
2023-04-04 21:11:45 +02:00
2023-03-31 17:02:44 +02:00
2023-03-14 15:52:10 +01:00
2023-03-01 17:01:17 +01:00
2023-03-17 19:22:13 +01:00
2023-03-03 17:05:07 +01:00
2023-03-09 10:51:43 +01:00
2023-03-09 10:51:43 +01:00
2023-03-20 16:51:30 +01:00
2023-03-17 22:27:21 +01:00
2023-03-30 16:22:51 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-16 20:37:59 +01:00
2023-03-20 16:51:30 +01:00
2023-03-07 16:56:40 +01:00
2023-03-20 16:51:30 +01:00
2023-03-09 10:51:29 +01:00
2023-03-29 09:33:55 +02:00
2023-03-05 15:12:54 +01:00
2023-04-04 17:03:32 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-09 15:54:58 +01:00
2023-03-20 16:51:30 +01:00
2023-03-30 15:09:14 +02:00
2023-03-24 03:28:42 +01:00
2023-04-04 16:02:06 +02:00
2023-03-24 03:28:42 +01:00
2023-04-04 14:45:54 +02:00
2023-03-24 11:08:19 +01:00
2023-04-04 13:35:06 +02:00
2023-03-30 15:09:14 +02:00
2023-03-14 15:52:10 +01:00
2023-04-04 11:01:59 +02:00
2023-03-20 16:51:30 +01:00
2023-03-24 23:41:54 +01:00
2023-03-20 16:51:30 +01:00
2023-04-04 18:07:14 +02:00
2023-04-04 13:35:03 +02:00
2023-03-16 14:12:37 +01:00
2023-03-31 15:52:14 +02:00
2023-04-04 13:35:03 +02:00
2023-03-05 15:12:54 +01:00
2023-03-25 18:58:00 +01:00
2023-04-03 17:07:07 +02:00
2023-04-04 11:01:59 +02:00
2023-03-03 18:10:57 +01:00
2023-04-03 17:07:24 +02:00
2023-03-23 12:14:51 +01:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-03-24 12:50:13 +01:00
2023-03-31 15:52:23 +02:00
2023-04-03 17:07:32 +02:00
2023-03-30 10:53:48 +02:00
2023-03-17 15:02:46 +01:00
2023-02-24 10:06:06 +01:00
2023-03-30 18:59:11 +02:00
2023-04-03 17:07:24 +02:00
2023-03-29 23:37:03 +02:00
2023-03-20 16:51:30 +01:00
2023-03-09 12:01:01 +01:00
2023-04-03 17:07:24 +02:00
2023-04-04 11:01:59 +02:00
2023-02-22 20:26:07 +01:00
2023-03-22 14:52:42 +01:00
2023-04-04 11:01:59 +02:00
2023-03-20 16:51:30 +01:00
2023-03-24 01:24:48 +01:00
2023-03-17 11:47:09 +01:00
2023-03-30 07:54:04 +02:00
2023-04-04 14:46:09 +02:00
2023-04-01 18:01:49 +02:00
2023-03-30 17:57:44 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-03-30 15:09:33 +02:00
2023-04-04 20:08:33 +02:00
2023-03-31 22:13:48 +02:00
2023-04-03 22:55:48 +02:00
2023-03-08 17:33:37 +01:00
2023-03-30 17:57:58 +02:00
2023-03-31 11:58:52 +02:00
2023-04-03 17:07:24 +02:00
2023-03-24 12:50:13 +01:00
2023-03-28 17:49:01 +02:00
2023-04-03 17:07:24 +02:00
2023-04-04 20:08:37 +02:00
2023-04-04 20:08:37 +02:00
2023-04-04 20:08:37 +02:00
2023-04-04 20:08:37 +02:00
2023-03-16 07:29:49 +01:00
2023-04-04 16:02:12 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-02-24 11:11:40 +01:00
2023-03-08 17:33:37 +01:00
2023-03-29 09:33:35 +02:00
2023-04-05 08:38:30 +02:00
2023-04-04 17:03:35 +02:00
2023-04-03 13:55:16 +02:00
2023-04-03 17:07:24 +02:00
2023-04-04 19:11:53 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-03-20 16:51:30 +01:00
2023-02-24 18:16:11 +01:00
2023-04-04 12:11:00 +02:00
2023-04-03 17:07:24 +02:00
2023-03-15 13:19:45 +01:00
2023-04-03 17:07:24 +02:00
2023-03-24 19:21:32 +01:00
2023-03-24 11:08:32 +01:00
2023-03-14 12:23:46 +01:00
2023-03-27 20:06:54 +02:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00
2023-04-04 13:35:12 +02:00
2023-04-03 17:07:24 +02:00
2023-04-04 16:01:57 +02:00
2023-03-22 17:03:28 +01:00
2023-04-03 17:07:24 +02:00
2023-04-03 17:07:24 +02:00