https://www.c-o-k.ru/js/legacy-csrf.js?

1(function (window, document, $) {
2    'use strict';
3
4    function getMetaContent(name) {
5        var metaTags = document.getElementsByTagName('meta');
6        var i;
7
8        for (i = 0; i < metaTags.length; i += 1) {
9            if (metaTags[i].getAttribute('name') === name) {
10                return metaTags[i].getAttribute('content');
11            }
12        }
13
14        return null;
15    }
16
17    function isSameOrigin(url) {
18        var anchor;
19
20        if (!url) {
21            return true;
22        }
23
24        anchor = document.createElement('a');
25        anchor.href = url;
26
27        return (!anchor.protocol || anchor.protocol === window.location.protocol)
28            && (!anchor.host || anchor.host === window.location.host);
29    }
30
31    function ensureCsrfInput(form) {
32        var action;
33        var csrfParam;
34        var token;
35        var inputs;
36        var input;
37        var i;
38
39        if (!form || String(form.method || 'GET').toUpperCase() !== 'POST') {
40            return;
41        }
42
43        action = form.getAttribute('action') || window.location.href;
44
45        if (!isSameOrigin(action)) {
46            return;
47        }
48
49        csrfParam = getMetaContent('csrf-param');
50        token = getMetaContent('csrf-token');
51
52        if (!csrfParam || !token) {
53            return;
54        }
55
56        inputs = form.getElementsByTagName('input');
57
58        for (i = 0; i < inputs.length; i += 1) {
59            if (inputs[i].getAttribute('name') === csrfParam) {
60                inputs[i].value = token;
61
62                return;
63            }
64        }
65
66        input = document.createElement('input');
67        input.setAttribute('type', 'hidden');
68        input.setAttribute('name', csrfParam);
69        input.value = token;
70        form.appendChild(input);
71    }
72
73    function findForm(element) {
74        while (element) {
75            if (element.nodeType === 1 && 'FORM' === element.tagName) {
76                return element;
77            }
78
79            element = element.parentNode;
80        }
81
82        return null;
83    }
84
85    function protectExistingForms() {
86        var forms = document.forms;
87        var i;
88
89        for (i = 0; i < forms.length; i += 1) {
90            ensureCsrfInput(forms[i]);
91        }
92    }
93
94    function protectAddedForms(mutations) {
95        var i;
96        var j;
97        var node;
98        var forms;
99
100        for (i = 0; i < mutations.length; i += 1) {
101            for (j = 0; j < mutations[i].addedNodes.length; j += 1) {
102                node = mutations[i].addedNodes[j];
103
104                if (!node || node.nodeType !== 1) {
105                    continue;
106                }
107
108                if ('FORM' === node.tagName) {
109                    ensureCsrfInput(node);
110                }
111
112                forms = node.getElementsByTagName('form');
113
114                for (var k = 0; k < forms.length; k += 1) {
115                    ensureCsrfInput(forms[k]);
116                }
117            }
118        }
119    }
120
121    if (document.addEventListener) {
122        document.addEventListener('submit', function (event) {
123            ensureCsrfInput(findForm(event.target));
124        }, true);
125
126        document.addEventListener('click', function (event) {
127            var element = event.target;
128            var type;
129
130            while (element) {
131                if (element.nodeType === 1 && ('BUTTON' === element.tagName || 'INPUT' === element.tagName)) {
132                    type = String(element.getAttribute('type') || '').toLowerCase();
133
134                    if (('BUTTON' === element.tagName && ('' === type || 'submit' === type))
135                        || ('INPUT' === element.tagName && ('submit' === type || 'image' === type))) {
136                        ensureCsrfInput(findForm(element));
137
138                        return;
139                    }
140                }
141
142                element = element.parentNode;
143            }
144        }, true);
145
146        if (document.readyState === 'loading') {
147            document.addEventListener('DOMContentLoaded', function () {
148                protectExistingForms();
149                window.setTimeout(protectExistingForms, 0);
150            }, false);
151        } else {
152            protectExistingForms();
153        }
154
155        window.addEventListener('load', protectExistingForms, false);
156
157        if (window.MutationObserver && document.documentElement) {
158            new window.MutationObserver(protectAddedForms).observe(document.documentElement, {
159                childList: true,
160                subtree: true
161            });
162        }
163    } else if (window.attachEvent) {
164        window.attachEvent('onload', protectExistingForms);
165        document.attachEvent('onsubmit', function () {
166            ensureCsrfInput(window.event.srcElement);
167        });
168    }
169
170    if ($ && $.ajaxPrefilter) {
171        $.ajaxPrefilter(function (options, originalOptions, xhr) {
172            var method = String(options.type || options.method || 'GET').toUpperCase();
173            var token;
174
175            if (options.crossDomain || /^(GET|HEAD|OPTIONS)$/.test(method)) {
176                return;
177            }
178
179            token = getMetaContent('csrf-token');
180
181            if (token) {
182                xhr.setRequestHeader('X-CSRF-Token', token);
183            }
184        });
185    }
186})(window, document, window.jQuery);