TPS
/
ORIENT
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

AJAX requests can only use the POST method

This commit is contained in:
Samuel Georges 2015-06-20 20:18:58 +10:00
parent 37e5b2328f
commit cd1d62d8d7
2 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/backend/classes/Controller.php
View File

@ -349,6 +349,10 @@ class Controller extends Extendable
*/
protected function execAjaxHandlers()
{
if (Request::method() != 'POST') {
return null;
}
if ($handler = trim(Request::header('X_OCTOBER_REQUEST_HANDLER'))) {
try {
/*
@ -363,16 +367,6 @@ class Controller extends Extendable
*/
if ($partialList = trim(Request::header('X_OCTOBER_REQUEST_PARTIALS'))) {
$partialList = explode('&', $partialList);
// @todo Do we need to validate backend partials?
// foreach ($partialList as $partial) {
// if (!preg_match('/^(?:\w+\:{2}|@)?[a-z0-9\_\-\.\/]+$/i', $partial)) {
// throw new SystemException(Lang::get(
// 'cms::lang.partial.invalid_name',
// ['name' => $partial]
// ));
// }
// }
}
else {
$partialList = [];

4
modules/cms/classes/Controller.php
View File

@ -572,6 +572,10 @@ class Controller
*/
protected function execAjaxHandlers()
{
if (Request::method() != 'POST') {
return null;
}
if ($handler = trim(Request::header('X_OCTOBER_REQUEST_HANDLER'))) {
try {
/*