mirror of
https://github.com/dgtlmoon/changedetection.io.git
synced 2026-10-13 15:30:27 +00:00
22 lines
1.2 KiB
JavaScript
22 lines
1.2 KiB
JavaScript
// Attach the CSRF token to every state-changing jQuery request.
|
|
//
|
|
// Applied at script-execution time, NOT inside $(document).ready(). That matters: pages carry
|
|
// inline <script> blocks that register their own ready handlers while the document is still
|
|
// parsing, whereas this file is loaded with `defer` and therefore runs afterwards. jQuery
|
|
// invokes ready callbacks in registration order, so a ready handler registered by an inline
|
|
// block always runs BEFORE one registered here - and any POST it fires would go out with no
|
|
// token and come back "400 The CSRF token is missing".
|
|
//
|
|
// That is exactly what happened to the AI summary on /diff once its start call became a POST
|
|
// (#4467): diff.html's inline $(function(){...}) calls llmSummary.fetch() immediately.
|
|
//
|
|
// $.ajaxSetup needs no DOM, so doing it now closes the window entirely - deferred scripts all
|
|
// run before DOMContentLoaded, so the setup is in place before any ready handler can fire.
|
|
$.ajaxSetup({
|
|
beforeSend: function (xhr, settings) {
|
|
if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
|
|
xhr.setRequestHeader("X-CSRFToken", csrftoken)
|
|
}
|
|
}
|
|
});
|