Wednesday, October 25, 2023
1 change · master
Security fixes and vulnerability patches
Website forms now include a signature so Odoo can confirm that submitted forms were generated by the website itself. This helps prevent people from sending unexpected or unauthorized form fields to the website form handler, improving data integrity and security for website submissions.
Original PR description
This commits add a signature to the website_form. The purpose of this modification is to allow the controllers to be able to verify that the form was originally generated from the view. This prevent the end user to submit arbitrary values to the website_form controller. In this commit, email_cc and email_bcc are treated as the same fied as it holds the same function This does not offer protection against submission replay. Previous versions of the form are not invalidated by editing the view. If one need to completely reset that protection and invalidate the previously generated website_form, the only solution is currently to change the database secret.