tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-01 05:39:10 +02:00
Code Issues Projects Releases Wiki Activity

SECURITY: Ensure javascript content type is sent in form responses. If content type is html, and the javascript contains script tags within the content, this content will be executed.

Browse Source
This commit is contained in:
Andrew O'Neil 2012-05-03 11:54:54 +12:00 committed by Ingo Schommer
parent c1d2cd1293
commit 9bf3ae9a19
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
core/control/FormResponse.php
View File

@ -72,15 +72,16 @@ class FormResponse {
* @return string
*/
static function respond() {
$response = new SS_HTTPResponse();
// we don't want non-ajax calls to receive javascript
if(isset($_REQUEST['forcehtml'])) {
return self::$non_ajax_content;
$response->setBody(self::$non_ajax_content);
} else if(isset($_REQUEST['forceajax']) || Director::is_ajax()) {
// TODO figure out a way to stay backwards-compatible with Ajax.Evaluator and still use the automatic evaluating of Prototype
//header("Content-type: text/javascript");
return self::get_javascript();
$response->addHeader('Content-Type', 'text/javascript');
$response->setBody(self::get_javascript());
} elseif(!empty(self::$non_ajax_content)) {
return self::$non_ajax_content;
$response->setBody(self::$non_ajax_content);
} elseif(!empty(self::$redirect_url)) {
Director::redirect(self::$redirect_url);
return null;
@ -90,7 +91,8 @@ class FormResponse {
} else {
return null;
}
return $response;
}
/**