diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[WebProfilerBundle] Fix CORS ajax security issues

Browse Source
This commit is contained in:
Romain Neutron 2016-04-02 12:30:41 +02:00
parent 66da91d030
commit f8dd87d7cc
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base_js.html.twig
View File

@ -80,6 +80,20 @@
requestStack = [],
extractHeaders = function(xhr, stackElement) {
// Here we avoid to call xhr.getResponseHeader in order to
// prevent polluting the console with CORS security errors
var allHeaders = xhr.getAllResponseHeaders();
var ret;
if (ret = allHeaders.match(/^x-debug-token:\s+(.*)$/im)) {
stackElement.profile = ret[1];
}
if (ret = allHeaders.match(/^x-debug-token-link:\s+(.*)$/im)) {
stackElement.profilerUrl = ret[1];
}
},
renderAjaxRequests = function() {
var requestCounter = document.querySelectorAll('.sf-toolbar-ajax-requests');
if (!requestCounter.length) {
@ -239,8 +253,8 @@
stackElement.duration = new Date() - stackElement.start;
stackElement.loading = false;
stackElement.error = self.status < 200 || self.status >= 400;
stackElement.profile = self.getResponseHeader("X-Debug-Token");
stackElement.profilerUrl = self.getResponseHeader("X-Debug-Token-Link");
extractHeaders(self, stackElement);
Sfjs.renderAjaxRequests();
}