no csrf token when saving about mercury

[jejacks0n]

Yes, you're right.. So Rails includes a javascript file that puts this into every ajax request, so it wasn't needed for rails.. You're solution is pretty spot on though, and if you're interested I'll work with you on getting it into the coffeescript proper so it'll build properly for you with this included.

I agree that this should be built into Mercury so that javascript file isn't required -- to support other frameworks better.

[lvanderree]

Hi Jeremy,

that would be great! I am taking a look at CoffeeScript as well so I can provide you with real patches in the future

[jejacks0n]

I updated this to be a little easier.. instead of overriding save, you should be able to do it with just configuration now. I added two configuration options. One for where to find the token, and one for the header with which to give it back to the server.

You should be able to do this now:
change Mercury.config.csrfSelector to match what your framework outputs.
change Mercury.config.csrfHeader to match what your framework expects.

If that doesn't cover all your needs, there's a new method in PageEditor. #saveHeaders is expected to return an object, of any headers you'd like to include in the save Ajax request. By default it uses what you've configured, but you're free to change that however you'd like based on need.

Mercury.PageEditor.prototype.saveHeaders = function() {
  return {'X-CSRF': '[the_token]'};
};

[lvanderree]

Absolutely briljant!

I think I found one error though: you forget to make use of Mercury.config.csrfHeader for the upload method.

I changed

  if (token = jQuery(Mercury.config.csrfSelector).attr('content')) {
    Mercury.csrfToken = token;
  }

to

  if (token = jQuery(Mercury.config.csrfSelector).attr('content')) {
    Mercury.csrfToken = token;
    Mercury.csrfTag = Mercury.config.csrfHeader;
  }

and

  xhr.setRequestHeader('X-CSRF-Token', Mercury.csrfToken);

to

  xhr.setRequestHeader(Mercury.csrfTag, Mercury.csrfToken);

[jejacks0n]

right right.. good catch.