OSQA-697, don't pass the CSRF token to the AJAX request when posting a new comment

[osqa.git] / forum / skins / default / media / js / osqa.main.js

diff --git a/forum/skins/default/media/js/osqa.main.js b/forum/skins/default/media/js/osqa.main.js
index 49fedda89dd8f9a23ac449b9353cb3f0f1d0a893..993407b769e1feda0502122e3cee42f213a29910 100644 (file)
--- a/forum/skins/default/media/js/osqa.main.js
+++ b/forum/skins/default/media/js/osqa.main.js
@@ -1,3 +1,29 @@
+/**\r
+ * We do not want the CSRF protection enabled for the AJAX post requests, it causes only trouble.\r
+ * Get the csrftoken cookie and pass it to the X-CSRFToken HTTP request property.\r
+ */\r
+$('html').ajaxSend(function(event, xhr, settings) {\r
+    function getCookie(name) {\r
+        var cookieValue = null;\r
+        if (document.cookie && document.cookie != '') {\r
+            var cookies = document.cookie.split(';');\r
+            for (var i = 0; i < cookies.length; i++) {\r
+                var cookie = jQuery.trim(cookies[i]);\r
+                // Does this cookie string begin with the name we want?\r
+                if (cookie.substring(0, name.length + 1) == (name + '=')) {\r
+                    cookieValue = decodeURIComponent(cookie.substring(name.length + 1));\r
+                    break;\r
+                }\r
+            }\r
+        }\r
+        return cookieValue;\r
+    }\r
+    if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {\r
+        // Only send the token to relative URLs i.e. locally.\r
+        xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));\r
+    }\r
+});\r
+\r
 var response_commands = {\r
     refresh_page: function() {\r
         window.location.reload(true)\r
@@ -75,7 +101,7 @@ var response_commands = {
         alert('ok');\r
     },\r
 \r
-    insert_comment: function(post_id, comment_id, comment, username, profile_url, delete_url, edit_url, convert_url) {\r
+    insert_comment: function(post_id, comment_id, comment, username, profile_url, delete_url, edit_url, convert_url, can_convert) {\r
         var $container = $('#comments-container-' + post_id);\r
         var skeleton = $('#new-comment-skeleton-' + post_id).html().toString();\r
 \r
@@ -89,6 +115,11 @@ var response_commands = {
 \r
         $container.append(skeleton);\r
 \r
+        // Show the convert comment to answer tool only if the current comment can be converted\r
+        if (can_convert == true) {\r
+            $('#comment-' + comment_id + '-convert').show();\r
+        }\r
+\r
         $('#comment-' + comment_id).slideDown('slow');\r
     },\r
 \r
@@ -128,7 +159,6 @@ var response_commands = {
     },\r
 \r
     copy_url: function(url) {\r
-        $.copy(url);\r
     }\r
 }\r
 \r
@@ -150,11 +180,17 @@ function show_dialog (extern) {
         yes_callback: default_close_function,\r
         no_text: messages.cancel,\r
         show_no: false,\r
-        close_on_clickoutside: false\r
+        close_on_clickoutside: false,\r
+        copy: false\r
     }\r
 \r
     $.extend(options, extern);\r
 \r
+    var copy_id = '';\r
+    if (options.copy) {\r
+        copy_id = ' id="copy_clip_button"'\r
+    }\r
+\r
     if (options.event != undefined) {\r
         options.pos = {x: options.event.pageX, y: options.event.pageY};\r
     }\r
@@ -166,8 +202,7 @@ function show_dialog (extern) {
         html += '<button class="dialog-no">' + options.no_text + '</button>';\r
     }\r
 \r
-    html += '<button class="dialog-yes">' + options.yes_text + '</button>'\r
-            + '</div></div>';\r
+    html += '<button class="dialog-yes"' + copy_id + '>' + options.yes_text + '</button>' + '</div></div>';\r
 \r
     $dialog = $(html);\r
     $('body').append($dialog);\r
@@ -273,7 +308,12 @@ function load_prompt(evt, el, url) {
                     process_ajax_response(data, evt);\r
                 }, 'json');\r
             },\r
-            show_no: true\r
+            show_no: true,\r
+            copy: false\r
+        }\r
+\r
+        if (el.hasClass('copy')) {\r
+            $.extend(doptions, { yes_text : 'Copy', copy: true});\r
         }\r
 \r
         if (!el.is('.centered')) {\r
@@ -328,19 +368,22 @@ $(function() {
     $('a.ajax-command').live('click', function(evt) {\r
         if (running) return false;\r
 \r
-        $('.context-menu-dropdown').slideUp('fast');\r
-\r
         var el = $(this);\r
 \r
+        var ajax_url = el.attr('href')\r
+        ajax_url = ajax_url + "?nocache=" + new Date().getTime()\r
+\r
+        $('.context-menu-dropdown').slideUp('fast');\r
+\r
         if (el.is('.withprompt')) {\r
-            load_prompt(evt, el, el.attr('href'));\r
+            load_prompt(evt, el, ajax_url);\r
         } else if(el.is('.confirm')) {\r
             var doptions = {\r
                 html: messages.confirm,\r
                 extra_class: 'confirm',\r
                 yes_callback: function() {\r
                     start_command();\r
-                    $.getJSON(el.attr('href'), function(data) {\r
+                    $.getJSON(ajax_url, function(data) {\r
                         process_ajax_response(data, evt);\r
                         $dialog.fadeOut('fast', function() {\r
                             $dialog.remove();\r
@@ -358,7 +401,7 @@ $(function() {
             var $dialog = show_dialog(doptions);\r
         } else {\r
             start_command();\r
-            $.getJSON(el.attr('href'), function(data) {\r
+            $.getJSON(ajax_url, function(data) {\r
                 process_ajax_response(data, evt);\r
             });\r
         }\r
@@ -529,7 +572,7 @@ $(function() {
                 }\r
 \r
                 start_command();\r
-                $.post($form.attr('action'), post_data, function(data) {\r
+                $.post($form.attr('action'), $form.serialize(), function(data) {\r
                     process_ajax_response(data, evt, function(error) {\r
                         if (!error) {\r
                             cleanup_form();\r