Fix issues when CSRF protection is enabled.

fix #5
rob006-software · Feb 29, 2016 · 40c2745 · 40c2745
1 parent 55a23ad
commit 40c2745
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/ElFinderWidget.php b/ElFinderWidget.php
@@ -39,6 +39,12 @@ public function run() {
 		$this->settings['url'] = $this->controller->createUrl($this->connectorRoute, $this->connectorParams);
 		$this->settings['lang'] = Yii::app()->language;
 
+		if (Yii::app()->getRequest()->enableCsrfValidation) {
+			$this->settings['customData'] = array(
+				Yii::app()->request->csrfTokenName => Yii::app()->request->csrfToken,
+			);
+		}
+
 		$id = $this->getId();
 		$settings = CJavaScript::encode($this->settings);
 		$cs = Yii::app()->getClientScript();

diff --git a/ServerFileInputElFinderPopupAction.php b/ServerFileInputElFinderPopupAction.php
@@ -36,7 +36,7 @@ public function run() {
 		require_once dirname(__FILE__) . '/ElFinderHelper.php';
 		ElFinderHelper::registerAssets();
 
-		if(empty($_GET['fieldId']) || !preg_match('/[a-z0-9\-_]/i', $_GET['fieldId'])) {
+		if (empty($_GET['fieldId']) || !preg_match('/[a-z0-9\-_]/i', $_GET['fieldId'])) {
 			throw new CHttpException(400, Yii::t('yii', 'Your request is invalid.'));
 		}
 
@@ -48,6 +48,12 @@ public function run() {
 		$this->settings['lang'] = Yii::app()->language;
 		$this->settings['soundPath'] = ElFinderHelper::getAssetsDir() . '/sounds/';
 
+		if (Yii::app()->getRequest()->enableCsrfValidation) {
+			$this->settings['customData'] = array(
+				Yii::app()->request->csrfTokenName => Yii::app()->request->csrfToken,
+			);
+		}
+
 		$this->controller->layout = false;
 		$this->controller->render('ext.elFinder.views.ServerFileInputElFinderPopupAction', array(
 			'title' => $this->title, 'settings' => $this->settings, 'fieldId' => $_GET['fieldId']));

diff --git a/TinyMceElFinderPopupAction.php b/TinyMceElFinderPopupAction.php
@@ -44,6 +44,12 @@ public function run() {
 		$this->settings['lang'] = Yii::app()->language;
 		$this->settings['soundPath'] = ElFinderHelper::getAssetsDir() . '/sounds/';
 
+		if (Yii::app()->getRequest()->enableCsrfValidation) {
+			$this->settings['customData'] = array(
+				Yii::app()->request->csrfTokenName => Yii::app()->request->csrfToken,
+			);
+		}
+
 		$this->controller->layout = false;
 		$this->controller->render('ext.elFinder.views.TinyMceElFinderPopupAction', array(
 			'title' => $this->title, 'settings' => $this->settings));