Commitf8dd87d

committed

[WebProfilerBundle] Fix CORS ajax security issues

1 parent66da91d commitf8dd87dCopy full SHA for f8dd87d

File tree

+16

-2

lines changed

src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler
- base_js.html.twig

+16

-2

lines changed

Lines changed: 16 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -80,6 +80,20 @@`
`80`	`80`
`81`	`81`	`requestStack= [],`
`82`	`82`
	`83`	`+extractHeaders=function(xhr,stackElement) {`
	`84`	`+// Here we avoid to call xhr.getResponseHeader in order to`
	`85`	`+// prevent polluting the console with CORS security errors`
	`86`	`+var allHeaders=xhr.getAllResponseHeaders();`
	`87`	`+var ret;`
	`88`	`+`
	`89`	`+if (ret=allHeaders.match(/^x-debug-token:\s+(.*)$/im)) {`
	`90`	`+stackElement.profile= ret[1];`
	`91`	`+ }`
	`92`	`+if (ret=allHeaders.match(/^x-debug-token-link:\s+(.*)$/im)) {`
	`93`	`+stackElement.profilerUrl= ret[1];`
	`94`	`+ }`
	`95`	`+ },`
	`96`	`+`
`83`	`97`	`renderAjaxRequests=function() {`
`84`	`98`	`var requestCounter=document.querySelectorAll('.sf-toolbar-ajax-requests');`
`85`	`99`	`if (!requestCounter.length) {`
`@@ -239,8 +253,8 @@`
`239`	`253`	`stackElement.duration=newDate()-stackElement.start;`
`240`	`254`	`stackElement.loading=false;`
`241`	`255`	`stackElement.error=self.status<200\|\|self.status>=400;`
`242`		`-stackElement.profile=self.getResponseHeader("X-Debug-Token");`
`243`		`-stackElement.profilerUrl=self.getResponseHeader("X-Debug-Token-Link");`
	`256`	`+`
	`257`	`+extractHeaders(self, stackElement);`
`244`	`258`
`245`	`259`	`Sfjs.renderAjaxRequests();`
`246`	`260`	`}`

Comments

(0)