Technical mailing list archives

technical@mail.odoo.com

Avatar

Re: Odoo website dangerous redirection

by
Ed Gow
- 10/12/2018 15:17:56

Hi Othmane,


I tried various URLs of the form https://www.odoo.com/xxx?r=http://www.youtube.com

www.odoo.com
A wine bar implemented Odoo Online two years ago. From Inventory to Point of Sales, discover how they are managing and selling their wines.
 against the various pages of the Odoo site and I could not get it to do the redirect. If this could be reproduced against the Odoo site then it would probably get attention. 

  Ed

From: GHANDI Othmane <othmane.ghandi@gmail.com>
Sent: Friday, October 12, 2018 10:03:21 AM
To: Technical
Subject: Odoo website dangerous redirection
 
Hi all

When you put an URL like this : server_name/website/lang/fr_FR?r=http://www.youtube.com => it will redirect you to youtube or whatever link you put after ?r=

How we can overcome this ?

Thanks a lot


Othmane Ghandi
----------------------------------------------------------------------------------------------------------------------------------------------
''Where others see limitations, we see possibilities''
"les bonnes choses viennent à ceux qui savent attendre. Les grandes choses viennent à ceux qui se lèvent et qui font tout pour y arriver"
-----------------------------------------------------------------------------------------------------------------------------------------------
          http://www.viadeo.com/profile/0021ck3b96kz2yq4                                          
: othmane.ghandi
: +212 6 00 45 96 84

_______________________________________________
Mailing-List: https://www.odoo.com/groups/technical-62
Post to: mailto:technical@mail.odoo.com
Unsubscribe: https://www.odoo.com/groups?unsubscribe

Reference