Third-party AJAX requests not detected #1327
Labels
bug
Something isn't working, reproducible
core
Core functionalities, including the admin section
severity: major
Major functionality
Comments
herrvigg
added
bug
herrvigg
added a commit
that referenced
this issue
Apr 19, 2023
Improve Ajax detection to other sources than WP by checking the HTTP vars HTTP_X_REQUESTED_WITH / HTTP_REQUESTED_WITH = XMLHttpRequest. Use this extended detection of Ajax for: - blocking `qtranxf_can_redirect` (URL/language redirect) - not sending back HTTP cookies - special admin handling of HTTP referrer (only used for admin terms).
|
Fix released in 3.14.2. Use this extended detection of Ajax for:
|
herrvigg
added a commit
that referenced
this issue
Apr 19, 2023
herrvigg
added a commit
that referenced
this issue
Apr 19, 2023
Improve Ajax detection to other sources than WP by checking the HTTP vars HTTP_X_REQUESTED_WITH / HTTP_REQUESTED_WITH = XMLHttpRequest. Use this extended detection of Ajax for: - blocking `qtranxf_can_redirect` (URL/language redirect) - not sending back HTTP cookies - special admin handling of HTTP referrer (only used for admin terms).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Checking
wp_doing_ajax()is only a partial check that is valid for WordPress Ajax requests, but not for all the other plugins.This HTTP variable should be checked:
HTTP_X_REQUESTED_WITH: XMLHttpRequest. See also RFC6648: Deprecating the "X-" Prefix.Much likely this had no big impact for the redirects because
qtranxf_can_redirectcancels requests containing a non-empty$_POSTthat is generally set with Ajax requests, but this may impact other parts.The text was updated successfully, but these errors were encountered: