This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse the repository at this point in the history
[Publication] Set Content-Type for ajax responses (#7532)
This sets the Content-Type header for the ajax responses in the publication module. Because it's not explicitly set, PHP is defaulting to text/html. This means that, in the event that a user directly accesses the endpoint, the browser will interpret the page as HTML, not JSON, and interpret any data in the object as HTML tags, opening the possibility of an XSS attack if the an someone is tricked into accessing the ajax endpoint directly. The frontend isn't directly vulnerable, because the data is only interpreted by React. Setting the Content-Type explicitly to the correct "application/json" means that browsers should interpret the data correctly even if accessed directly, rather than interpreting HTML tags.
- Loading branch information
Showing 1 changed file with 2 additions and 0 deletions.