Revert "Revert CSRF changes in LimeScript"

This reverts commit d3c4506.
LimeSurvey · Aug 5, 2021 · 3f99736 · 3f99736
1 parent 3b82b14
commit 3f99736
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/application/extensions/LimeScript/LimeScript.php b/application/extensions/LimeScript/LimeScript.php
@@ -20,15 +20,21 @@ public function run()
             $data['language']                   = Yii::app()->language;
             $data['replacementFields']['path']  = App()->createUrl("limereplacementfields/index");
             $json = json_encode($data, JSON_FORCE_OBJECT);
-            // TODO: CSRF should not be passed on GET requests. Test with subquestion quick-add to confirm fix (uses POST).
             $script = "LS.data = $json;\n"
                     . "LS.lang = {
                         confirm: {
                             confirm_cancel: '".gT('Cancel')."',
                             confirm_ok: '".gT('OK')."'
                         }
                     };\n"
-                    . "$.ajaxSetup({data: {".Yii::app()->request->csrfTokenName.": LS.data.csrfToken}});";
+
+                    . "$.ajaxSetup({
+                        beforeSend: function(jqXHR, settings) {
+                            if(settings.method != 'GET') {
+                                {data: {".Yii::app()->request->csrfTokenName.": LS.data.csrfToken}}
+                            }
+                        }
+                    });";
             App()->getClientScript()->registerScript('LimeScript', $script, CClientScript::POS_HEAD);
         }
     }