mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Do not add sensitive request headers for cross domain requests 

Prevents leaking the CSRF token to another third-party domain by mistake.
This commit is contained in:
Lukas Reschke 2015-09-14 14:01:34 +02:00
parent 24d2cbf3de
commit cd90685af1
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
core/js/oc-requesttoken.js
View File

@ -1,4 +1,6 @@
$(document).on('ajaxSend',function(elm, xhr) {
xhr.setRequestHeader('requesttoken', oc_requesttoken);
xhr.setRequestHeader('OCS-APIREQUEST', 'true');
$(document).on('ajaxSend',function(elm, xhr, settings) {
if(settings.crossDomain === false) {
xhr.setRequestHeader('requesttoken', oc_requesttoken);
xhr.setRequestHeader('OCS-APIREQUEST', 'true');
}
});