Reject referers that do not include an absolute path

[rails.git] / app / assets / javascripts / oauth.js

diff --git a/app/assets/javascripts/oauth.js b/app/assets/javascripts/oauth.js
index 40f685cc7f0f4b64f0ceadf76fbd063a5022e0f2..d688590b05c0ce0ed8e6bbb25f307b3e2a32177f 100644 (file)
--- a/app/assets/javascripts/oauth.js
+++ b/app/assets/javascripts/oauth.js
@@ -1,25 +1,27 @@
-//= require sha
-//= require ohauth
+//= require ohauth/ohauth
 
-$.ajaxPrefilter(function(options, jqxhr) {
-  if (options.oauth && OSM.oauth_token) {
-    var ohauth = window.ohauth;
-    var url = options.url.replace(/\?$/, "");
-    var params = {
-      oauth_consumer_key: OSM.oauth_consumer_key,
-      oauth_token: OSM.oauth_token,
-      oauth_signature_method: "HMAC-SHA1",
-      oauth_timestamp: ohauth.timestamp(),
-      oauth_nonce: ohauth.nonce()
-    };
+$(document).ready(function () {
+  var application_data = $("head").data();
 
-    params.oauth_signature = ohauth.signature(
-      OSM.oauth_consumer_secret,
-      OSM.oauth_token_secret,
-      ohauth.baseString(options.type, url, $.extend({}, params, jqxhr.data))
-    );
+  function makeAbsolute(url) {
+    var a = document.createElement("a");
+    a.href = url;
+    return a.href;
+  }
+
+  if (application_data.token) {
+    var headerGenerator = window.ohauth.headerGenerator({
+      consumer_key: application_data.consumerKey,
+      consumer_secret: application_data.consumerSecret,
+      token: application_data.token,
+      token_secret: application_data.tokenSecret
+    });
 
-    options.headers = options.headers || {};
-    options.headers.Authorization = "OAuth " + ohauth.authHeader(params);
+    $.ajaxPrefilter(function (options, jqxhr) {
+      if (options.oauth) {
+        options.headers = options.headers || {};
+        options.headers.Authorization = headerGenerator(options.type, makeAbsolute(options.url), jqxhr.data);
+      }
+    });
   }
 });