Plupload url should not assume path to be "plupload-handle-uploads" for csrf token [#2832225]

In PlUploadFile::preRenderPlUploadFile(), the plupload url token is generated using the path "plupload-handle-uploads". This assumes the route has no been altered to another path.

D8 core already calculates the token when "_csrf" is set on the route.
See https://www.drupal.org/docs/8/api/routing-system/access-checking-on-rout...

Comment	File	Size	Author
#2	plupload-let-drupal-create-token-2832225-2.patch	652 bytes	recrit

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

1 December 2016 at 20:30

recrit created an issue. See original summary.

Comment #2

recrit CreditAttribution: recrit commented 1 December 2016 at 20:31

Status:

Active

» Needs review

File	Size
plupload-let-drupal-create-token-2832225-2.patch	652 bytes

The patch attached removes the custom query parameter for the token to allow Drupal to auto generate it.

Comment #3

recrit CreditAttribution: recrit commented 1 December 2016 at 21:52

Comment #4

budalokko CreditAttribution: budalokko commented 6 March 2017 at 01:18

Status:

Needs review

» Postponed

Actually the patch didn't work for me in a Drupal 8.2 clean install.

Instead of the CSRF token, a placehold is added that will be replaced at render time. But we don't render that URL on an HTML page just add it to Javascript settings array so it will never be replaced.

Its the same problem as stated in #2793109: [PP-1] _csrf_token in route breaks custom #ajax url so I think its better we generate the CSRF token on our own until core finds a solution for this situation.