{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core-bundle/issues/1080","repository_url":"https://api.github.com/repos/contao/core-bundle","labels_url":"https://api.github.com/repos/contao/core-bundle/issues/1080/labels{/name}","comments_url":"https://api.github.com/repos/contao/core-bundle/issues/1080/comments","events_url":"https://api.github.com/repos/contao/core-bundle/issues/1080/events","html_url":"https://github.com/contao/core-bundle/issues/1080","id":258045690,"number":1080,"title":"Request token handling buggy","user":{"login":"Toflar","id":481937,"avatar_url":"https://avatars2.githubusercontent.com/u/481937?v=4","gravatar_id":"","url":"https://api.github.com/users/Toflar","html_url":"https://github.com/Toflar","followers_url":"https://api.github.com/users/Toflar/followers","following_url":"https://api.github.com/users/Toflar/following{/other_user}","gists_url":"https://api.github.com/users/Toflar/gists{/gist_id}","starred_url":"https://api.github.com/users/Toflar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Toflar/subscriptions","organizations_url":"https://api.github.com/users/Toflar/orgs","repos_url":"https://api.github.com/users/Toflar/repos","events_url":"https://api.github.com/users/Toflar/events{/privacy}","received_events_url":"https://api.github.com/users/Toflar/received_events","type":"User","site_admin":false},"labels":[{"id":104721162,"url":"https://api.github.com/repos/contao/core-bundle/labels/defect","name":"defect","color":"bd2c00","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/contao/core-bundle/milestones/33","html_url":"https://github.com/contao/core-bundle/milestone/33","labels_url":"https://api.github.com/repos/contao/core-bundle/milestones/33/labels","id":2745451,"number":33,"title":"4.4.5","description":"","creator":{"login":"leofeyer","id":1192057,"avatar_url":"https://avatars0.githubusercontent.com/u/1192057?v=4","gravatar_id":"","url":"https://api.github.com/users/leofeyer","html_url":"https://github.com/leofeyer","followers_url":"https://api.github.com/users/leofeyer/followers","following_url":"https://api.github.com/users/leofeyer/following{/other_user}","gists_url":"https://api.github.com/users/leofeyer/gists{/gist_id}","starred_url":"https://api.github.com/users/leofeyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leofeyer/subscriptions","organizations_url":"https://api.github.com/users/leofeyer/orgs","repos_url":"https://api.github.com/users/leofeyer/repos","events_url":"https://api.github.com/users/leofeyer/events{/privacy}","received_events_url":"https://api.github.com/users/leofeyer/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":12,"state":"open","created_at":"2017-09-05T14:43:38Z","updated_at":"2017-09-15T14:05:58Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2017-09-15T13:48:11Z","updated_at":"2017-09-15T14:14:46Z","closed_at":null,"author_association":"MEMBER","body":"There are two issues:\r\n\r\n1. You cannot send `POST` requests with `application/json` as you must provide `REQUEST_TOKEN` as post value. I think we should fix that by falling back to a header.\r\n\r\n2. You get a pure nonsense `X-Ajax-Location` response in the front end if you do not provide a valid token.\r\n\r\nWdyt about something like this:\r\n\r\n```diff\r\ndiff --git a/src/Framework/ContaoFramework.php b/src/Framework/ContaoFramework.php\r\nindex b63d9a6..b1e92c9 100644\r\n--- a/src/Framework/ContaoFramework.php\r\n+++ b/src/Framework/ContaoFramework.php\r\n@@ -446,11 +446,13 @@ class ContaoFramework implements ContaoFrameworkInterface, ContainerAwareInterfa\r\n             define('REQUEST_TOKEN', 'cli' === PHP_SAPI ? null : $requestToken->get());\r\n         }\r\n \r\n-        if ($this->canSkipTokenCheck() || $requestToken->validate($this->request->request->get('REQUEST_TOKEN'))) {\r\n+        if ($this->canSkipTokenCheck() || $requestToken->validate(\r\n+            $this->request->request->get('REQUEST_TOKEN', $this->request->headers->get('Contao-Request-Token')))\r\n+        ) {\r\n             return;\r\n         }\r\n \r\n-        if ($this->request->isXmlHttpRequest()) {\r\n+        if ($this->request->isXmlHttpRequest() && 'BE' === $this->getMode()) {\r\n             throw new AjaxRedirectResponseException($this->router->generate('contao_backend'));\r\n         }\r\n ```"},"comment":{"url":"https://api.github.com/repos/contao/core-bundle/issues/comments/329794954","html_url":"https://github.com/contao/core-bundle/issues/1080#issuecomment-329794954","issue_url":"https://api.github.com/repos/contao/core-bundle/issues/1080","id":329794954,"user":{"login":"Toflar","id":481937,"avatar_url":"https://avatars2.githubusercontent.com/u/481937?v=4","gravatar_id":"","url":"https://api.github.com/users/Toflar","html_url":"https://github.com/Toflar","followers_url":"https://api.github.com/users/Toflar/followers","following_url":"https://api.github.com/users/Toflar/following{/other_user}","gists_url":"https://api.github.com/users/Toflar/gists{/gist_id}","starred_url":"https://api.github.com/users/Toflar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Toflar/subscriptions","organizations_url":"https://api.github.com/users/Toflar/orgs","repos_url":"https://api.github.com/users/Toflar/repos","events_url":"https://api.github.com/users/Toflar/events{/privacy}","received_events_url":"https://api.github.com/users/Toflar/received_events","type":"User","site_admin":false},"created_at":"2017-09-15T14:14:46Z","updated_at":"2017-09-15T14:14:46Z","author_association":"MEMBER","body":"> It is not impossible. You can use a separate route with the _request_token attribute set to false.\r\n\r\nNo you can't in many cases because permissions are still not in their own services so I could reuse them. In many cases, the only save way is to run through the whole stack again."}}
{"actor":{"display_login":"Toflar"}}