sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #19014 from owncloud/dont-add-requestheaders-for-cross-domain-requests 

Add security hardenings to $.ajax()
remotes/origin/db-empty-migrate
Thomas Müller 2015-09-16 00:16:31 +07:00
parent d1f7087b6c 2f4a1c9c2c
commit 2fc19635f6
2 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
core/js/js.js
Unescape Escape View File

@ -1215,6 +1215,20 @@ function object(o) {
* Initializes core
*/
function initCore() {
/**
* Disable automatic evaluation of responses for $.ajax() functions (and its
* higher-level alternatives like $.get() and $.post()).
*
* If a response to a $.ajax() request returns a content type of "application/javascript"
* JQuery would previously execute the response body. This is a pretty unexpected
* behaviour and can result in a bypass of our Content-Security-Policy as well as
* multiple unexpected XSS vectors.
*/
$.ajaxSetup({
contents: {
script: false
}
});
/**
* Set users locale to moment.js as soon as possible

8
core/js/oc-requesttoken.js
Unescape Escape View File

@ -1,4 +1,6 @@
$(document).on('ajaxSend',function(elm, xhr) {
xhr.setRequestHeader('requesttoken', oc_requesttoken);
xhr.setRequestHeader('OCS-APIREQUEST', 'true');
$(document).on('ajaxSend',function(elm, xhr, settings) {
if(settings.crossDomain === false) {
xhr.setRequestHeader('requesttoken', oc_requesttoken);
xhr.setRequestHeader('OCS-APIREQUEST', 'true');
}
});