p31829507
/
django
mirror of https://github.com/django/django.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fixed #15869 - example AJAX code in CSRF docs fails sometimes for IE7 or absolute same origin URLs 

Thanks to nick for the report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16183 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Luke Plant 2011-05-09 15:40:01 +00:00
parent 161b94ef7b
commit ae1866ddef
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/ref/contrib/csrf.txt
View File

@ -86,7 +86,7 @@ that allow headers to be set on every request. In jQuery, you can use the
.. code-block:: javascript .. code-block:: javascript
$('html').ajaxSend(function(event, xhr, settings) { $(document).ajaxSend(function(event, xhr, settings) {
function getCookie(name) { function getCookie(name) {
var cookieValue = null; var cookieValue = null;
if (document.cookie && document.cookie != '') { if (document.cookie && document.cookie != '') {
@ -102,8 +102,19 @@ that allow headers to be set on every request. In jQuery, you can use the
} }
return cookieValue; return cookieValue;
} }
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) { function sameOrigin(url) {
// Only send the token to relative URLs i.e. locally. // url could be relative or scheme relative or absolute
var host = document.location.host; // host + port
var protocol = document.location.protocol;
var sr_origin = '//' + host;
var origin = protocol + sr_origin;
// Allow absolute or scheme relative URLs to same origin
return (url == origin || url.slice(0, origin.length + 1) == origin + '/') ||
(url == sr_origin || url.slice(0, sr_origin.length + 1) == sr_origin + '/') ||
// or any other URL that isn't scheme relative or absolute i.e relative.
!(/^(\/\/|http:|https:).*/.test(url));
}
if (sameOrigin(settings.url)) {
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken')); xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
} }
}); });