Christophe Simonis
7636b510a2
* make CSRF protection the default on all non-SAFE methods note: there currently is no way to call a CSRF-protected endpoint without a form-encoded entity-body as that's the only place we get the CSRF token from. * simple CSRF token generation: just use the HMAC'd session id, no generating a new random token per session then HMAC it * use constant-time equal function to avoid timing attacks * assert that a database secret is configured before hashing/validating the CSRF token * opt-out database manager from CSRF: The super-admin password serves the purpose of a CSRF token in the database manager screens. There is no request database to obtain the secret and generate a CSRF token.
24 lines
1.1 KiB
XML
24 lines
1.1 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<openerp>
|
|
<data noupdate="1">
|
|
|
|
<template id="transfer_acquirer_button">
|
|
<form t-if="acquirer" t-att-action="tx_url" method="post" target="_self">
|
|
<input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
|
|
<t t-if="return_url">
|
|
<input type='hidden' name='return_url' t-att-value='return_url'/>
|
|
</t>
|
|
<input type='hidden' name='reference' t-att-value='reference'/>
|
|
<input type='hidden' name='amount' t-att-value='amount'/>
|
|
<input type='hidden' name='currency' t-att-value='currency.name'/>
|
|
<!-- submit -->
|
|
<button type="submit" width="100px" t-att-class="submit_class">
|
|
<img t-if="not submit_txt" src="/payment_transfer/static/src/img/transfer_icon.png"/>
|
|
<span t-if="submit_txt"><t t-esc="submit_txt"/> <span class="fa fa-long-arrow-right"/></span>
|
|
</button>
|
|
</form>
|
|
</template>
|
|
|
|
</data>
|
|
</openerp>
|