Reject referers that do not include an absolute path

[rails.git] / app / assets / javascripts / oauth.js

diff --git a/app/assets/javascripts/oauth.js b/app/assets/javascripts/oauth.js
index 73e1761f2aaa59af11f045c10aedd9b5e83b1973..d688590b05c0ce0ed8e6bbb25f307b3e2a32177f 100644 (file)
--- a/app/assets/javascripts/oauth.js
+++ b/app/assets/javascripts/oauth.js
@@ -1,32 +1,27 @@
-//= require sha
-//= require ohauth
+//= require ohauth/ohauth
 
 $(document).ready(function () {
-  $.ajaxPrefilter(function(options, jqxhr) {
-    if (options.oauth) {
-      var ohauth = window.ohauth;
-      var url = options.url.replace(/\?$/, "");
-      var params = {
-        oauth_consumer_key: OSM.oauth_consumer_key,
-        oauth_token: OSM.oauth_token,
-        oauth_signature_method: "HMAC-SHA1",
-        oauth_timestamp: ohauth.timestamp(),
-        oauth_nonce: ohauth.nonce()
-      };
+  var application_data = $("head").data();
 
-      for (var name in jqxhr.data) {
-        params[name] = jqxhr.data[name];
-      }
+  function makeAbsolute(url) {
+    var a = document.createElement("a");
+    a.href = url;
+    return a.href;
+  }
 
-      params.oauth_signature = ohauth.signature(
-        OSM.oauth_consumer_secret,
-        OSM.oauth_token_secret,
-        ohauth.baseString(options.type, url, params)
-      );
+  if (application_data.token) {
+    var headerGenerator = window.ohauth.headerGenerator({
+      consumer_key: application_data.consumerKey,
+      consumer_secret: application_data.consumerSecret,
+      token: application_data.token,
+      token_secret: application_data.tokenSecret
+    });
 
-      options.headers = {
-        Authorization: "OAuth " + ohauth.authHeader(params)
-      };
-    }
-  });
+    $.ajaxPrefilter(function (options, jqxhr) {
+      if (options.oauth) {
+        options.headers = options.headers || {};
+        options.headers.Authorization = headerGenerator(options.type, makeAbsolute(options.url), jqxhr.data);
+      }
+    });
+  }
 });