Merge remote-tracking branch 'upstream/pull/4297'

[rails.git] / app / assets / javascripts / index / search.js

diff --git a/app/assets/javascripts/index/search.js b/app/assets/javascripts/index/search.js
index 10750b5b7222e10bfcd0103e96dad4625abc423a..1c1da3677e167167eef8c9db1ba3db9b9d2b6ef4 100644 (file)
--- a/app/assets/javascripts/index/search.js
+++ b/app/assets/javascripts/index/search.js
@@ -62,13 +62,23 @@ OSM.Search = function (map) {
     e.preventDefault();
     e.stopPropagation();
 
-    var div = $(this).parents(".search_more");
+    var div = $(this).parents(".search_more"),
+        csrf_param = $("meta[name=csrf-param]").attr("content"),
+        csrf_token = $("meta[name=csrf-token]").attr("content"),
+        params = {};
 
     $(this).hide();
     div.find(".loader").show();
 
-    $.get($(this).attr("href"), function (data) {
-      div.replaceWith(data);
+    params[csrf_param] = csrf_token;
+
+    $.ajax({
+      url: $(this).attr("href"),
+      method: "POST",
+      data: params,
+      success: function (data) {
+        div.replaceWith(data);
+      }
     });
   }
 
@@ -129,17 +139,21 @@ OSM.Search = function (map) {
 
   page.load = function () {
     $(".search_results_entry").each(function (index) {
-      var entry = $(this);
+      var entry = $(this),
+          csrf_param = $("meta[name=csrf-param]").attr("content"),
+          csrf_token = $("meta[name=csrf-token]").attr("content"),
+          params = {
+            zoom: map.getZoom(),
+            minlon: map.getBounds().getWest(),
+            minlat: map.getBounds().getSouth(),
+            maxlon: map.getBounds().getEast(),
+            maxlat: map.getBounds().getNorth()
+          };
+      params[csrf_param] = csrf_token;
       $.ajax({
         url: entry.data("href"),
-        method: "GET",
-        data: {
-          zoom: map.getZoom(),
-          minlon: map.getBounds().getWest(),
-          minlat: map.getBounds().getSouth(),
-          maxlon: map.getBounds().getEast(),
-          maxlat: map.getBounds().getNorth()
-        },
+        method: "POST",
+        data: params,
         success: function (html) {
           entry.html(html);
           // go to first result of first geocoder