Do not add sensitive request headers for cross domain requests

Prevents leaking the CSRF token to another third-party domain by mistake.
owncloud · Sep 15, 2015 · cd90685 · cd90685
1 parent 24d2cbf
commit cd90685
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/core/js/oc-requesttoken.js b/core/js/oc-requesttoken.js
@@ -1,4 +1,6 @@
-$(document).on('ajaxSend',function(elm, xhr) {
-	xhr.setRequestHeader('requesttoken', oc_requesttoken);
-	xhr.setRequestHeader('OCS-APIREQUEST', 'true');
+$(document).on('ajaxSend',function(elm, xhr, settings) {
+	if(settings.crossDomain === false) {
+		xhr.setRequestHeader('requesttoken', oc_requesttoken);
+		xhr.setRequestHeader('OCS-APIREQUEST', 'true');
+	}
 });