From 36dbb3906b322b385575ff5d71768a092d4688cf Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Mon, 14 Mar 2011 21:31:02 +0000 Subject: Send the CSRF token with Ajax requests (#7843). Contributed by Etienne Massip. git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@5134 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- public/javascripts/application.js | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) (limited to 'public/javascripts') diff --git a/public/javascripts/application.js b/public/javascripts/application.js index a88856ea6..3996404bb 100644 --- a/public/javascripts/application.js +++ b/public/javascripts/application.js @@ -299,9 +299,27 @@ var WarnLeavingUnsaved = Class.create({ } }); -/* shows and hides ajax indicator */ +/* + * 1 - registers a callback which copies the csrf token into the + * X-CSRF-Token header with each ajax request. Necessary to + * work with rails applications which have fixed + * CVE-2011-0447 + * 2 - shows and hides ajax indicator + */ Ajax.Responders.register({ - onCreate: function(){ + onCreate: function(request){ + var csrf_meta_tag = $$('meta[name=csrf-token]')[0]; + + if (csrf_meta_tag) { + var header = 'X-CSRF-Token', + token = csrf_meta_tag.readAttribute('content'); + + if (!request.options.requestHeaders) { + request.options.requestHeaders = {}; + } + request.options.requestHeaders[header] = token; + } + if ($('ajax-indicator') && Ajax.activeRequestCount > 0) { Element.show('ajax-indicator'); } -- cgit v1.2.3