32 lines
1.3 KiB
JavaScript
32 lines
1.3 KiB
JavaScript
|
(function ($, document) {
|
||
|
|
'use strict';
|
||
|
|
|
||
|
|
function getCsrfToken() {
|
||
|
|
var meta = document.querySelector('meta[property="glpi:csrf_token"]');
|
||
|
|
return meta ? meta.getAttribute('content') : '';
|
||
|
|
}
|
||
|
|
|
||
|
|
// GLPI 11 validates the CSRF token of every AJAX POST through the
|
||
|
|
// X-Glpi-Csrf-Token header (see CheckCsrfListener). Register the token
|
||
|
|
// on all plugin AJAX requests so endpoints such as server_test.ajax.php
|
||
|
|
// are accepted instead of being rejected with a 403.
|
||
|
|
$(document).on('ajaxSend', function (event, xhr, settings) {
|
||
|
|
var token = getCsrfToken();
|
||
|
|
if (token !== '' && typeof settings !== 'undefined' && settings.type && settings.type.toUpperCase() === 'POST') {
|
||
|
|
xhr.setRequestHeader('X-Glpi-Csrf-Token', token);
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
// Also cover direct $.ajax/{$.get[Script]/-free POST}
|
||
|
|
var origAjax = $.ajax;
|
||
|
|
$.ajax = function (url, options) {
|
||
|
|
var settings = $.isPlainObject(url) ? url : $.extend({ url: url }, options || {});
|
||
|
|
var token = getCsrfToken();
|
||
|
|
if (settings.type && settings.type.toUpperCase() === 'POST' && token !== '') {
|
||
|
|
settings.headers = settings.headers || {};
|
||
|
|
settings.headers['X-Glpi-Csrf-Token'] = token;
|
||
|
|
}
|
||
|
|
return origAjax.call(this, settings);
|
||
|
|
};
|
||
|
|
})(jQuery, document);
|