kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Don’t include an undefined X-CSRF-Token header

Browse source 
If there is not a `csrf-token` meta tag in the document, the blob record
XHR was including an `X-CSRF-Token` header set to the string
"undefined." Instead of setting it to undefined, it should not be
included in the absence of a meta tag.
This commit is contained in:
Cameron Bothner 2018-12-27 12:44:04 -05:00
parent 4ae8d6182f
commit 372dda2a29
3 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
activestorage/CHANGELOG.md
View file

@ -1,3 +1,8 @@
* It doesn’t include an `X-CSRF-Token` header if a meta tag is not found on
the page. It previously included one with a value of `undefined`.
*Cameron Bothner*
* Fix `ArgumentError` when uploading to amazon s3
*Hiroki Sanpei*

5
activestorage/app/assets/javascripts/activestorage.js
View file

@ -560,7 +560,10 @@
this.xhr.setRequestHeader("Content-Type", "application/json");
this.xhr.setRequestHeader("Accept", "application/json");
this.xhr.setRequestHeader("X-Requested-With", "XMLHttpRequest");
this.xhr.setRequestHeader("X-CSRF-Token", getMetaValue("csrf-token"));
var csrfToken = getMetaValue("csrf-token");
if (csrfToken != undefined) {
this.xhr.setRequestHeader("X-CSRF-Token", csrfToken);
}
this.xhr.addEventListener("load", function(event) {
return _this.requestDidLoad(event);
});

7
activestorage/app/javascript/activestorage/blob_record.js
View file

@ -17,7 +17,12 @@ export class BlobRecord {
this.xhr.setRequestHeader("Content-Type", "application/json")
this.xhr.setRequestHeader("Accept", "application/json")
this.xhr.setRequestHeader("X-Requested-With", "XMLHttpRequest")
this.xhr.setRequestHeader("X-CSRF-Token", getMetaValue("csrf-token"))
const csrfToken = getMetaValue("csrf-token")
if (csrfToken != undefined) {
this.xhr.setRequestHeader("X-CSRF-Token", csrfToken)
}
this.xhr.addEventListener("load", event => this.requestDidLoad(event))
this.xhr.addEventListener("error", event => this.requestDidError(event))
}