view share/roundup/templates/devel/html/query.js @ 5726:e199d0ae4a25

issue2551033: prevent reverse engineering hidden data by using etags as an oracle to identify when the right data has been guessed. Identified by Joseph Myers who also suggested remediation methods. Implemented John Rouillard.
author John Rouillard <rouilj@ieee.org>
date Thu, 23 May 2019 18:56:57 -0400
parents 04264349c483
children
line wrap: on
line source

var action;

function display(data)
{
  var list = $("div.list");
  list.empty();
  list.append(data);
}

// Run a query with a specific starting point and size
function query_start(start, size)
{
  var inputs = $(":input");
  var data = {}
  if (start > 0) data['@startwith'] = start
  if (size > -1) data['@pagesize'] = size
  for (var i = 0; i < inputs.length; i++)
    data[inputs[i].name] = inputs[i].value;
  jQuery.get(action, data, display);
  return false;
}

// Run a query, starting at the first element
function query()
{
  return query_start(0, -1)
}

// Deactivate the form's submit action, and instead
// invoke the action as part of (inline) query.
function replace_submit()
{
  var form = $("form");
  action = form.attr("action");
  form.attr("action",""); // reset
  form.submit(query);
}


$(document).ready(replace_submit);

Roundup Issue Tracker: http://roundup-tracker.org/