Fixes #4010 not sending naked query strings into add ajax tokens and also fixed a...

diff --git a/js/lib/ajax.js b/js/lib/ajax.js
index 6f6ae052f71371f481ce9859d7c434446dab627c..b3f39cc42ce8084b93cc940d359af14de5f2cbd7 100644 (file)
--- a/js/lib/ajax.js
+++ b/js/lib/ajax.js
@@ -187,7 +187,11 @@ elgg.action = function(action, options) {
 
        options = elgg.ajax.handleOptions(action, options);
 
-       options.data = elgg.security.addToken(options.data);
+       // This is a misuse of elgg.security.addToken() because it is not always a
+       // full query string with a ?. As such we need a special check for the tokens.
+       if (!elgg.isString(options.data) || options.data.indexOf('__elgg_ts') == -1) {
+               options.data = elgg.security.addToken(options.data);
+       }
        options.dataType = 'json';
 
        //Always display system messages after actions

diff --git a/js/lib/elgglib.js b/js/lib/elgglib.js
index ca7914e7cd9f34103ccb6393a64d803f70e29a3d..81209ebd057f25d0d19489391d4cf021c1676003 100644 (file)
--- a/js/lib/elgglib.js
+++ b/js/lib/elgglib.js
@@ -410,16 +410,6 @@ elgg.parse_url = function(url, component, expand) {
                // fragment
                + '(?:#(.*))?)',
        keys = {
-               'mailto':               {
-                       4: "scheme",
-                       5: "user",
-                       6: "host",
-                       9: "path",
-                       12: "query",
-                       13: "fragment"
-               },
-
-               'standard':             {
                        1: "scheme",
                        4: "user",
                        5: "pass",
@@ -428,58 +418,28 @@ elgg.parse_url = function(url, component, expand) {
                        9: "path",
                        12: "query",
                        13: "fragment"
-               }
        },
-       results = {},
-       match_keys,
-       is_mailto = false;
+       results = {};
 
-       var re = new RegExp(re_str);
-       var matches = re.exec(url);
-
-       // if the scheme field is undefined it means we're using a protocol
-       // without :// and an @. Feel free to fix this in the re if you can >:O
-       if (matches[1] == undefined) {
-               match_keys = keys['mailto'];
-               is_mailto = true;
-       } else {
-               match_keys = keys['standard'];
+       if (url.indexOf('mailto:') === 0) {
+               results['scheme'] = 'mailto';
+               results['path'] = url.replace('mailto:', '');
+               return results;
        }
 
-       for (var i in match_keys) {
-               if (matches[i]) {
-                       results[match_keys[i]] = matches[i];
-               }
+       if (url.indexOf('javascript:') === 0) {
+               results['scheme'] = 'javascript';
+               results['path'] = url.replace('javascript:', '');
+               return results;
        }
 
-       // merge everything to path if not standard
-       if (is_mailto) {
-               var path = '',
-               new_results = {};
-
-               if (typeof(results['user']) != 'undefined' && typeof(results['host']) != 'undefined') {
-                       path = results['user'] + '@' + results['host'];
-                       delete results['user'];
-                       delete results['host'];
-               } else if (typeof(results['user'])) {
-                       path = results['user'];
-                       delete results['user'];
-               } else if (typeof(results['host'])) {
-                       path = results['host'];
-                       delete results['host'];
-               }
-
-               if (typeof(results['path']) != 'undefined') {
-                       results['path'] = path + results['path'];
-               } else {
-                       results['path'] = path;
-               }
+       var re = new RegExp(re_str);
+       var matches = re.exec(url);
 
-               for (var prop in results) {
-                       new_results[prop] = results[prop];
+       for (var i in keys) {
+               if (matches[i]) {
+                       results[keys[i]] = matches[i];
                }
-
-               results = new_results;
        }
 
        if (expand && typeof(results['query']) != 'undefined') {

diff --git a/js/lib/security.js b/js/lib/security.js
index 726c6b767dfd7f6f294f66365f296346766347ad..61aa1cfcd357a82106a36bfffdb345b9b31eff59 100644 (file)
--- a/js/lib/security.js
+++ b/js/lib/security.js
@@ -60,7 +60,7 @@ elgg.security.refreshToken = function() {
 
 
 /**
- * Add elgg action tokens to an object, URL, or query string.
+ * Add elgg action tokens to an object, URL, or query string (with a ?).
  *
  * @param {Object|string} data
  * @return {Object} The new data object including action tokens
@@ -75,17 +75,17 @@ elgg.security.addToken = function(data) {
                        args = {},
                        base = '';
                
-               if (parts['host'] == data) {
-                       if (data.indexOf('=') > -1) {
+               if (parts['host'] == undefined) {
+                       if (data.indexOf('?') === 0) {
                                // query string
-                               args = elgg.parse_str(data);
-                       } else {
-                               // relative URL
-                               base = data + '?';
+                               base = '?';
+                               args = elgg.parse_str(parts['query']);
                        }
                } else {
-                       // a URL
-                       if (typeof parts['query'] != 'undefined') {
+                       // full or relative URL
+
+                       if (parts['query'] != undefined) {
+                               // with query string
                                args = elgg.parse_str(parts['query']);
                        }
                        var split = data.split('?');

diff --git a/js/tests/ElggLibTest.js b/js/tests/ElggLibTest.js
index c53c6331dffe5c6ba62e85145c59c9545e99e5ba..a29ebf7439a26a6e25c633f671ce090c7b882ee2 100644 (file)
--- a/js/tests/ElggLibTest.js
+++ b/js/tests/ElggLibTest.js
@@ -105,3 +105,25 @@ ElggLibTest.prototype.testNormalizeUrl = function() {
                assertEquals(args[1], elgg.normalize_url(args[0]));
        });
 };
+
+ElggLibTest.prototype.testParseUrl = function() {
+
+       [
+               ["http://www.elgg.org/test/", {'scheme': 'http', 'host': 'www.elgg.org', 'path': '/test/'}],
+               ["https://www.elgg.org/test/", {'scheme': 'https', 'host': 'www.elgg.org', 'path': '/test/'}],
+               ["ftp://www.elgg.org/test/", {'scheme': 'ftp', 'host': 'www.elgg.org', 'path': '/test/'}],
+               ["http://elgg.org/test?val1=one&val2=two", {'scheme': 'http', 'host': 'elgg.org', 'path': '/test', 'query': 'val1=one&val2=two'}],
+               ["http://elgg.org:8080/", {'scheme': 'http', 'host': 'elgg.org', 'port': 8080, 'path': '/'}],
+               ["http://elgg.org/test#there", {'scheme': 'http', 'host': 'elgg.org', 'path': '/test', 'fragment': 'there'}],
+               
+               ["test?val=one", {'host': 'test', 'query': 'val=one'}],
+               ["?val=one", {'query': 'val=one'}],
+
+               ["mailto:joe@elgg.org", {'scheme': 'mailto', 'path': 'joe@elgg.org'}],
+               ["javascript:load()", {'scheme': 'javascript', 'path': 'load()'}]
+
+       ].forEach(function(args) {
+               assertEquals(args[1], elgg.parse_url(args[0]));
+       });
+};
+

diff --git a/js/tests/ElggSecurityTest.js b/js/tests/ElggSecurityTest.js
index c7309d55ffce6ce66b7eea8ae63606add55b0e5c..107c0adbd0edaddc1b9aac7816c949587a9aa39c 100644 (file)
--- a/js/tests/ElggSecurityTest.js
+++ b/js/tests/ElggSecurityTest.js
@@ -26,16 +26,42 @@ ElggSecurityTest.prototype.testAddTokenAcceptsObject = function() {
        assertEquals(expected, elgg.security.addToken(input));
 };
 
-ElggSecurityTest.prototype.testAddTokenAcceptsString = function() {
+ElggSecurityTest.prototype.testAddTokenAcceptsRelativeUrl = function() {
        var input,
                str = "__elgg_ts=" + this.ts + "&__elgg_token=" + this.token;
-       
-       input = "";
-       assertEquals('?' + str, elgg.security.addToken(input));
-       
+
+       input = "test";
+       assertEquals(input + '?' + str, elgg.security.addToken(input));
+};
+
+ElggSecurityTest.prototype.testAddTokenAcceptsFullUrl = function() {
+       var input,
+               str = "__elgg_ts=" + this.ts + "&__elgg_token=" + this.token;
+
+       input = "http://elgg.org/";
+       assertEquals(input + '?' + str, elgg.security.addToken(input));
+};
+
+ElggSecurityTest.prototype.testAddTokenAcceptsQueryString = function() {
+       var input,
+               str = "__elgg_ts=" + this.ts + "&__elgg_token=" + this.token;
+
        input = "?data=sofar";
        assertEquals(input + '&' + str, elgg.security.addToken(input));
-       
+
+       input = "test?data=sofar";
+       assertEquals(input + '&' + str, elgg.security.addToken(input));
+
+       input = "http://elgg.org/?data=sofar";
+       assertEquals(input + '&' + str, elgg.security.addToken(input));
+};
+
+ElggSecurityTest.prototype.testAddTokenAlreadyAdded = function() {
+       var input,
+               str = "__elgg_ts=" + this.ts + "&__elgg_token=" + this.token;
+
+       input = "http://elgg.org/?" + str + "&data=sofar";
+       assertEquals(input, elgg.security.addToken(input));
 };
 
 ElggSecurityTest.prototype.testSetTokenSetsElggSecurityToken = function() {
@@ -47,5 +73,3 @@ ElggSecurityTest.prototype.testSetTokenSetsElggSecurityToken = function() {
        elgg.security.setToken(json);
        assertEquals(json, elgg.security.token);
 };
-
-