Daily updates from Odoo
Wednesday, February 13, 2019
1 change
Security fixes and vulnerability patches
This update removes places where the user session identifier was exposed to browser-side code, reducing the risk of session theft if a page is compromised. It also modernizes related web communication by replacing older JSONP calls with standard CORS support, improving security and maintainability without changing normal user workflows.
Original PR description
Before this rev. the `session_id` was provided by the server to the webclient (in session_info, mostly) and was stored and accessible. This made XSS injection more dangerous than they should be as it was very easy to steal the `session_id`. As the browser automatically set the `session_id` on every request to the server, the webclient shouldn't need any explicit reference. Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so it cannot be accessed through client side script. Task 1905359