Skip to content

O
OHR Support
Commit b38b871c authored by Jean-Philippe Lang's avatar Jean-Philippe Lang Committed by Eric Davis
Browse files
Options

Send the CSRF token with Ajax requests (#7843). 

Contributed by Etienne Massip.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@5134 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent 9049d58d
Hide whitespace changes
Inline Side-by-side
Showing with 21 additions and 2 deletions
app/views/layouts/base.rhtml
View file @ b38b871c
......@@ -5,6 +5,7 @@
<title><%=h html_title %></title>
<meta name="description" content="<%= Redmine::Info.app_name %>" />
<meta name="keywords" content="issue,bug,tracker" />
<%= csrf_meta_tag %>
<%= favicon %>
<%= stylesheet_link_tag 'application', :media => 'all' %>
<%= stylesheet_link_tag 'rtl', :media => 'all' if l(:direction) == 'rtl' %>
......
public/javascripts/application.js
View file @ b38b871c
......@@ -299,9 +299,27 @@ var WarnLeavingUnsaved = Class.create({
}
});
/* shows and hides ajax indicator */
/*
* 1 - registers a callback which copies the csrf token into the
* X-CSRF-Token header with each ajax request. Necessary to
* work with rails applications which have fixed
* CVE-2011-0447
* 2 - shows and hides ajax indicator
*/
Ajax.Responders.register({
onCreate: function(){
onCreate: function(request){
var csrf_meta_tag = $$('meta[name=csrf-token]')[0];
if (csrf_meta_tag) {
var header = 'X-CSRF-Token',
token = csrf_meta_tag.readAttribute('content');
if (!request.options.requestHeaders) {
request.options.requestHeaders = {};
}
request.options.requestHeaders[header] = token;
}
if ($('ajax-indicator') && Ajax.activeRequestCount > 0) {
Element.show('ajax-indicator');
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment