From 25262fb5fee2d3b5dbe11bb7d343b41ebf835bb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C5=91cze=20Bence?= <bence@pocze.ch>
Date: Sat, 13 Jun 2020 22:39:17 +0200
Subject: [PATCH] MAPG-133 pass CSRF token to JS create separate mapguesser.js

---
 public/static/js/mapguesser.js  | 34 +++++++++++++++++++++++++++++++++
 views/templates/main_footer.php | 15 ++-------------
 2 files changed, 36 insertions(+), 13 deletions(-)
 create mode 100644 public/static/js/mapguesser.js

diff --git a/public/static/js/mapguesser.js b/public/static/js/mapguesser.js
new file mode 100644
index 0000000..06cbc89
--- /dev/null
+++ b/public/static/js/mapguesser.js
@@ -0,0 +1,34 @@
+var MapGuesser = {
+    httpRequest: function (method, url, callback, data) {
+        var xhr = new XMLHttpRequest();
+
+        xhr.responseType = 'json';
+        xhr.onload = callback;
+
+        xhr.open(method, url, true);
+
+        if (method === 'POST') {
+            if (typeof data === 'undefined') {
+                data = new FormData();
+            }
+
+            data.append('anti_csrf_token', ANTI_CSRF_TOKEN);
+
+            xhr.send(data);
+        } else {
+            xhr.send();
+        }
+    }
+};
+
+(function () {
+    var anchors = document.getElementsByTagName('a');
+    for (var i = 0; i < anchors.length; i++) {
+        var a = anchors[i];
+        if (a.href !== 'javascript:;' && a.target !== '_blank') {
+            a.onclick = function () {
+                document.getElementById('loading').style.visibility = 'visible';
+            }
+        }
+    }
+})();
diff --git a/views/templates/main_footer.php b/views/templates/main_footer.php
index f1008bc..bb36eb7 100644
--- a/views/templates/main_footer.php
+++ b/views/templates/main_footer.php
@@ -1,7 +1,9 @@
     <script>
         const STATIC_ROOT = '<?= $_ENV['STATIC_ROOT'] ?>';
         const REVISION = '<?= REVISION ?>';
+        const ANTI_CSRF_TOKEN = '<?= $_SESSION['anti_csrf_token'] ?>';
     </script>
+    <script src="<?= $_ENV['STATIC_ROOT'] ?>/js/mapguesser.js?rev=<?= REVISION ?>"></script>
     <?php if (isset($jsFiles)) : ?>
         <?php foreach ($jsFiles as $jsFile) : ?>
             <?php
@@ -12,18 +14,5 @@
             <script src="<?= $jsFile ?>"></script>
         <?php endforeach; ?>
     <?php endif; ?>
-    <script>
-        (function () {
-            var anchors = document.getElementsByTagName('a');
-            for (var i = 0; i < anchors.length; i++) {
-                var a = anchors[i];
-                if (a.href !== 'javascript:;' && a.target !== '_blank') {
-                    a.onclick = function () {
-                        document.getElementById('loading').style.visibility = 'visible';
-                    }
-                }
-            }
-        })();
-    </script>
 </body>
 </html>
\ No newline at end of file