diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-08-13 17:49:31 +0200 |
|---|---|---|
| committer | Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-08-13 17:49:31 +0200 |
| commit | e6fd34bdda5d067a9e74714aaae10c89ed998a46 (patch) | |
| tree | 1a82e54e636f856983e8cd94ec00247eb9987b27 /p/scripts | |
| parent | 97efdcac1e38c568b6be313120694e7201d4c69c (diff) | |
CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
Diffstat (limited to 'p/scripts')
| -rw-r--r-- | p/scripts/main.js | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/p/scripts/main.js b/p/scripts/main.js index 62f0fbb1a..89edc54e5 100644 --- a/p/scripts/main.js +++ b/p/scripts/main.js @@ -134,7 +134,10 @@ function mark_read(active, only_not_read) { $.ajax({ type: 'POST', url: url, - data : { ajax: true } + data : { + ajax: true, + _csrf: context.csrf, + }, }).done(function (data) { var $r = active.find("a.read").attr("href", data.url), inc = 0; @@ -178,7 +181,10 @@ function mark_favorite(active) { $.ajax({ type: 'POST', url: url, - data : { ajax: true } + data : { + ajax: true, + _csrf: context.csrf, + }, }).done(function (data) { var $b = active.find("a.bookmark").attr("href", data.url), inc = 0; @@ -775,6 +781,9 @@ function updateFeed(feeds, feeds_count) { $.ajax({ type: 'POST', url: feed.url, + data : { + _csrf: context.csrf, + }, }).always(function (data) { feed_processed++; $("#actualizeProgress .progress").html(feed_processed + " / " + feeds_count); |