IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Don't send CSRF token in query string

Browse Source 
The token is already present in the headers thanks to the csrf-token
initializer.
This commit is contained in:
Daniel Waterworth 2019-08-20 15:16:08 +01:00
parent 75f37ac16a
commit d59746cdc1
2 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/assets/javascripts/discourse/components/composer-editor.js.es6
View File

@ -657,13 +657,10 @@ export default Ember.Component.extend({
this._pasted = false; this._pasted = false;
const $element = $(this.element); const $element = $(this.element);
const csrf = this.session.get("csrfToken");
$element.fileupload({ $element.fileupload({
url: Discourse.getURL( url: Discourse.getURL(
`/uploads.json?client_id=${ `/uploads.json?client_id=${this.messageBus.clientId}`
this.messageBus.clientId
}&authenticity_token=${encodeURIComponent(csrf)}`
), ),
dataType: "json", dataType: "json",
pasteZone: $element pasteZone: $element

2
app/assets/javascripts/discourse/mixins/upload.js.es6
View File

@ -23,8 +23,6 @@ export default Ember.Mixin.create({
getUrl(this.getWithDefault("uploadUrl", "/uploads")) + getUrl(this.getWithDefault("uploadUrl", "/uploads")) +
".json?client_id=" + ".json?client_id=" +
(this.messageBus && this.messageBus.clientId) + (this.messageBus && this.messageBus.clientId) +
"&authenticity_token=" +
encodeURIComponent(Discourse.Session.currentProp("csrfToken")) +
this.uploadUrlParams this.uploadUrlParams
); );
}, },