Technical mailing list archives

technical@mail.odoo.com

Browse archives

Avatar

Re: Odoo website dangerous redirection

by
Openworx, Mario Gielissen
- 12/10/2018 16:10:36
Hi Ed,

The redirect works also with other websites running Odoo.

Mario


Van: "Edward L. Gow" <elgow@uw.edu>
Aan: "Technical" <technical@mail.odoo.com>
Verzonden: Vrijdag 12 oktober 2018 22:01:04
Onderwerp: Re: Odoo website dangerous redirection

Right you are, Mario.  I obviously screwed it up somehow. This would seem to invite some spammers to target Odoo customers and route their phishing emails through www.odoo.com


Very good catch here. It should probably be filed as an issue. 


  Ed


From: Mario Gielissen <mario@gielissen.org>
Sent: Friday, October 12, 2018 12:30:39 PM
To: Technical
Subject: Re: Odoo website dangerous redirection
 
This redirect works (and also with other Odoo websites).

https://www.odoo.com/website/lang/fr_FR?r=http://www.youtube.com

Mario


Van: "Edward L. Gow" <elgow@uw.edu>
Aan: "Technical" <technical@mail.odoo.com>
Verzonden: Vrijdag 12 oktober 2018 21:20:52
Onderwerp: Re: Odoo website dangerous redirection

Hi Othmane,


I tried various URLs of the form https://www.odoo.com/xxx?r=http://www.youtube.com

www.odoo.com
A wine bar implemented Odoo Online two years ago. From Inventory to Point of Sales, discover how they are managing and selling their wines.
 against the various pages of the Odoo site and I could not get it to do the redirect. If this could be reproduced against the Odoo site then it would probably get attention. 

  Ed

From: GHANDI Othmane <othmane.ghandi@gmail.com>
Sent: Friday, October 12, 2018 10:03:21 AM
To: Technical
Subject: Odoo website dangerous redirection
 
Hi all

When you put an URL like this : server_name/website/lang/fr_FR?r=http://www.youtube.com => it will redirect you to youtube or whatever link you put after ?r=

How we can overcome this ?

Thanks a lot


Othmane Ghandi
----------------------------------------------------------------------------------------------------------------------------------------------
''Where others see limitations, we see possibilities''
"les bonnes choses viennent à ceux qui savent attendre. Les grandes choses viennent à ceux qui se lèvent et qui font tout pour y arriver"
-----------------------------------------------------------------------------------------------------------------------------------------------
          http://www.viadeo.com/profile/0021ck3b96kz2yq4                                          
: othmane.ghandi
: +212 6 00 45 96 84

_______________________________________________
Mailing-List: https://www.odoo.com/groups/technical-62
Post to: mailto:technical@mail.odoo.com
Unsubscribe: https://www.odoo.com/groups?unsubscribe

_______________________________________________
Mailing-List: https://www.odoo.com/groups/technical-62
Post to: mailto:technical@mail.odoo.com
Unsubscribe: https://www.odoo.com/groups?unsubscribe


_______________________________________________
Mailing-List: https://www.odoo.com/groups/technical-62
Post to: mailto:technical@mail.odoo.com
Unsubscribe: https://www.odoo.com/groups?unsubscribe

_______________________________________________
Mailing-List: https://www.odoo.com/groups/technical-62
Post to: mailto:technical@mail.odoo.com
Unsubscribe: https://www.odoo.com/groups?unsubscribe


Reference