- eventsource.php: in case of potential CSRF attack we send an error message from the EventSource to the browser

- eventsource.js: handle undefined data on event
- update.js: in case of error we close the event source - advise the user to reload the page
- update.php: EventSource initialization is now done before we enter the maintenance mode in order to allow browser reload in case of possible CSRF attack

1 files changed, 4 insertions, 1 deletions

diff --git a/core/js/update.js b/core/js/update.js
index 8ab02bbf935..2c28e72f7cd 100644
--- a/core/js/update.js
+++ b/core/js/update.js
@@ -5,6 +5,9 @@ $(document).ready(function () {
 	});
 	updateEventSource.listen('error', function(message) {
 		$('<span>').addClass('error').append(message).append('<br />').appendTo($('.update'));
+		message = 'Please reload the page.';
+		$('<span>').addClass('error').append(message).append('<br />').appendTo($('.update'));
+		updateEventSource.close();
 	});
 	updateEventSource.listen('failure', function(message) {
 		$('<span>').addClass('error').append(message).append('<br />').appendTo($('.update'));
@@ -20,4 +23,4 @@ $(document).ready(function () {
 			window.location.href = OC.webroot;
 		}, 3000);
 	});
-});
\ No newline at end of file
+});