Browse Source

HUE-2400 [core] The CSRF protection breaks some apps

Moved the XMLHttpRequest.send hack outside document.ready
Enrico Berti 11 years ago
parent
commit
7c9e0de303
1 changed files with 14 additions and 13 deletions
  1. 14 13
      desktop/core/src/desktop/templates/common_header.mako

+ 14 - 13
desktop/core/src/desktop/templates/common_header.mako

@@ -169,25 +169,26 @@ from django.utils.translation import ugettext as _
   <script src="/static/js/popover-extra-placements.js"></script>
 
   <script type="text/javascript" charset="utf-8">
+
+    //Add CSRF Token to all XHR Requests
+    var csrftoken = $.cookie('csrftoken');
+    function csrfSafeMethod(method) {
+      // these HTTP methods do not require CSRF protection
+      return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+    }
+
+    var xrhsend = XMLHttpRequest.prototype.send;
+    XMLHttpRequest.prototype.send = function (data) {
+      this.setRequestHeader('X-CSRFToken', csrftoken);
+      return xrhsend.apply(this, arguments);
+    }
+
     $(document).ready(function () {
       // forces IE's ajax calls not to cache
       if ($.browser.msie) {
         $.ajaxSetup({ cache: false });
       }
 
-      //Add CSRF Token to all XHR Requests
-      var csrftoken = $.cookie('csrftoken');
-      function csrfSafeMethod(method) {
-        // these HTTP methods do not require CSRF protection
-        return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
-      }
-
-      var xrhsend = XMLHttpRequest.prototype.send;
-      XMLHttpRequest.prototype.send = function(data) {
-        this.setRequestHeader('X-CSRFToken', csrftoken);
-        return xrhsend.apply(this, arguments);
-      }
-      /////
 
       // prevents framebusting and clickjacking
       if (self == top){