Olivier Dony
d362eb4b85
1af543a399 removed the default time limit
for CSRF tokens, because of the usability issues and the limited
security benefit.
However the timestamp that was used to implement the limit also served as
a salt, making the CSRF token variable for each request. This is a
desirable property that can help mitigate some attacks, such as BREACH.
This patch re-introduces the variability by including a distant expiry
(1 year) when no specific time limit is passed. The purpose isn't to
expire the token, but simply to serve as a salt.
closes odoo/odoo#57395
X-original-commit: 136e4f66cd5cafe7df450514937c7218c7216c93
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials