From cd90685af13d3fa14b3bd15aa5e6d4ddeee84eb3 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@owncloud.com>
Date: Mon, 14 Sep 2015 14:01:34 +0200
Subject: Do not add sensitive request headers for cross domain requests

Prevents leaking the CSRF token to another third-party domain by mistake.
---
 core/js/oc-requesttoken.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'core/js')

diff --git a/core/js/oc-requesttoken.js b/core/js/oc-requesttoken.js
index 2f7548ecb77..d5dcecdb5ab 100644
--- a/core/js/oc-requesttoken.js
+++ b/core/js/oc-requesttoken.js
@@ -1,4 +1,6 @@
-$(document).on('ajaxSend',function(elm, xhr) {
-	xhr.setRequestHeader('requesttoken', oc_requesttoken);
-	xhr.setRequestHeader('OCS-APIREQUEST', 'true');
+$(document).on('ajaxSend',function(elm, xhr, settings) {
+	if(settings.crossDomain === false) {
+		xhr.setRequestHeader('requesttoken', oc_requesttoken);
+		xhr.setRequestHeader('OCS-APIREQUEST', 'true');
+	}
 });
-- 
cgit v1.2.3