add csrf token in headers

Author: jcheron

Ajax/JsUtils.php

@@ -173,7 +173,7 @@ public function config($config=NULL) {
 	 */
 	public function __construct($params=array(),$injected=NULL) {
 		$ajaxDefault=['ajaxTransition'=>null,'attr'=>'','historize'=>false,'jsCallback'=>null,'hasLoader'=>true,'jqueryDone'=>'html',
-				'async'=>true,'params'=>null,'headers'=>null,'jsCondition'=>null,'ajaxLoader'=>null];
+				'async'=>true,'params'=>null,'headers'=>null,'jsCondition'=>null,'ajaxLoader'=>null,'csrf'=>false];
 		$defaults=['debug'=>true,'defer'=>false,'ajax'=>$ajaxDefault,
 				'historize'=>true,'autoActiveLinks'=>true
 		];
@@ -201,6 +201,9 @@ public function __construct($params=array(),$injected=NULL) {
 			if($params["ajax"]["historize"]){
 				$params["historize"]=true;
 			}
+			if($params["ajax"]["csrf"]){
+				$this->exec($this->addCsrf(),true);
+			}
 		}
 		if($params["historize"]){
 			$this->execAtLast($this->onPopstate());

Ajax/common/traits/JsUtilsAjaxTrait.php

@@ -52,6 +52,10 @@ protected function _ajax($method, $url, $responseElement = '', $parameters = [ ]
 		if (isset ( $headers )) {
 			$ajaxParameters ["headers"] = $headers;
 		}
+		if ($csrf) {
+			$csrf=(is_string($csrf))?$csrf:'csrf-token';
+			$parameters ["beforeSend"] = "jqXHR.setRequestHeader('{$csrf}', $('meta[name=\"{$csrf}\"]').attr('content'));";
+		}
 		if (isset ( $partial )) {
 			$ajaxParameters ["xhr"] = "xhrProvider";
 			$retour .= "var xhr = $.ajaxSettings.xhr();function xhrProvider() {return xhr;};xhr.onreadystatechange = function (e) { if (3==e.target.readyState){let response=e.target.responseText;" . $partial . ";}; };";
@@ -820,4 +824,16 @@ public function postFormOn($event, $element, $url, $form, $responseElement = "",
 	public function postFormOnClick($element, $url, $form, $responseElement = "", $parameters = array ()) {
 		return $this->postFormOn ( "click", $element, $url, $form, $responseElement, $parameters );
 	}
+	
+	public function addCsrf($name='csrf-token'){
+		return "
+		$.ajaxSetup({
+			beforeSend: function(xhr, settings) {
+				let csrfSafeMethod=function(method) { return (/^(GET|HEAD|OPTIONS)$/.test(method));};
+				if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
+					xhr.setRequestHeader('{$name}', $('meta[name=\"{$name}\"]').attr('content'));
+				}
+			}
+		});";
+	}
 }