changeset 3510:1a65beb5e52f

allow only 'token', 'auth-token' and 'authorization' as url params that are included in HTTP headers
author Alain Mazy <alain@mazy.be>
date Tue, 03 Sep 2019 10:33:26 +0200
parents 5405d51e040d
children 6b61ba835964
files OrthancExplorer/explorer.js
diffstat 1 files changed, 5 insertions(+), 5 deletions(-) [+]
line wrap: on
line diff
--- a/OrthancExplorer/explorer.js	Tue Sep 03 09:49:10 2019 +0200
+++ b/OrthancExplorer/explorer.js	Tue Sep 03 10:33:26 2019 +0200
@@ -91,28 +91,28 @@
   }
 });
 
-var GetUrlParametersAsDict = function getUrlParametersAsDict(sParam) {
+function GetAuthorizationTokensFromUrl() {
   var urlVariables = window.location.search.substring(1).split('&');
   var dict = {};
 
   for (var i = 0; i < urlVariables.length; i++) {
       var split = urlVariables[i].split('=');
 
-      if (split.length == 2) {
+      if (split.length == 2 && (split[0] == "token" || split[0] == "auth-token" || split[0] == "authorization")) {
         dict[split[0]] = split[1];
       }
   }
   return dict;
 };
 
-var initSearchParams = GetUrlParametersAsDict();
+var authorizationTokens = GetAuthorizationTokensFromUrl();
 
-/* Copy all url search parameters into HTTP headers in every request to the Rest API.  
+/* Copy the authoziation toekn from the url search parameters into HTTP headers in every request to the Rest API.  
 Thanks to this behaviour, you may specify a ?token=xxx in your url and this will be passed 
 as the "token" header in every request to the API allowing you to use the authorization plugin */
 $.ajaxSetup(
   {
-    headers : initSearchParams
+    headers : authorizationTokens
   }
 );