diff options
| author | cash <cash.costello@gmail.com> | 2011-11-10 21:24:47 -0500 |
|---|---|---|
| committer | cash <cash.costello@gmail.com> | 2011-11-16 19:53:03 -0500 |
| commit | 6b6cb8e8f70b254d100ba494ea913d99be95fa7d (patch) | |
| tree | 50150d855cd28478b584d45535e2edf7b063c837 /js/lib/ajax.js | |
| parent | 45f007ed495b8f79f0b867fec72226d3c11c5eab (diff) | |
| download | elgg-6b6cb8e8f70b254d100ba494ea913d99be95fa7d.tar.gz elgg-6b6cb8e8f70b254d100ba494ea913d99be95fa7d.tar.bz2 | |
Fixes #4010 not sending naked query strings into add ajax tokens and also fixed a few related bugs in JavaScript
Diffstat (limited to 'js/lib/ajax.js')
| -rw-r--r-- | js/lib/ajax.js | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/js/lib/ajax.js b/js/lib/ajax.js index 6f6ae052f..b3f39cc42 100644 --- a/js/lib/ajax.js +++ b/js/lib/ajax.js @@ -187,7 +187,11 @@ elgg.action = function(action, options) { options = elgg.ajax.handleOptions(action, options); - options.data = elgg.security.addToken(options.data); + // This is a misuse of elgg.security.addToken() because it is not always a + // full query string with a ?. As such we need a special check for the tokens. + if (!elgg.isString(options.data) || options.data.indexOf('__elgg_ts') == -1) { + options.data = elgg.security.addToken(options.data); + } options.dataType = 'json'; //Always display system messages after actions |