From 0710accbe2d342a74115ad8d564369f63ac478d8 Mon Sep 17 00:00:00 2001 From: Duncan Sommerville Date: Fri, 18 Sep 2015 18:29:50 -0400 Subject: [PATCH] SAAS-1062 - more work on podcasting frontend --- .../controllers/plugins/Acl_plugin.php | 6 ++++ .../views/scripts/podcast/podcast.phtml | 4 +-- .../scripts/podcast/podcast_url_dialog.phtml | 2 +- airtime_mvc/public/css/dashboard.css | 2 +- airtime_mvc/public/css/styles.css | 13 ++++++++- .../public/js/airtime/library/podcast.js | 29 +++++++++++++++++-- 6 files changed, 48 insertions(+), 8 deletions(-) diff --git a/airtime_mvc/application/controllers/plugins/Acl_plugin.php b/airtime_mvc/application/controllers/plugins/Acl_plugin.php index 06f84b834..923b2cf05 100644 --- a/airtime_mvc/application/controllers/plugins/Acl_plugin.php +++ b/airtime_mvc/application/controllers/plugins/Acl_plugin.php @@ -169,6 +169,12 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract // we need to check the CSRF token if ($_SERVER['REQUEST_METHOD'] != "GET" && $request->getModuleName() == "rest") { $token = $request->getParam("csrf_token"); + // PUT requests don't parameterize the data in the body, so we can't + // fetch it with getParam or getPost; instead we have to parse the body and + // check for the token in the JSON. (Hopefully we can find a better way to do this) -- Duncan + if (empty($token)) { + $token = json_decode($this->getRequest()->getRawBody(), true)["csrf_token"]; + } $tokenValid = $this->verifyCSRFToken($token); if (!$tokenValid) { diff --git a/airtime_mvc/application/views/scripts/podcast/podcast.phtml b/airtime_mvc/application/views/scripts/podcast/podcast.phtml index eb95e5987..70dddfc12 100644 --- a/airtime_mvc/application/views/scripts/podcast/podcast.phtml +++ b/airtime_mvc/application/views/scripts/podcast/podcast.phtml @@ -1,4 +1,4 @@ -
+

"" @@ -29,6 +29,6 @@

- +
\ No newline at end of file diff --git a/airtime_mvc/application/views/scripts/podcast/podcast_url_dialog.phtml b/airtime_mvc/application/views/scripts/podcast/podcast_url_dialog.phtml index 0edcf4b4c..4494c297e 100644 --- a/airtime_mvc/application/views/scripts/podcast/podcast_url_dialog.phtml +++ b/airtime_mvc/application/views/scripts/podcast/podcast_url_dialog.phtml @@ -1,5 +1,5 @@
-
+ csrf ?>