Make JSONP support optional and disabled by default (#12992).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@11272 e93f8b46-1217-0410-a6f0-8f06a7374b81
2013-01-26 18:37:09 +00:00
parent 134b66cb29
commit 9f127793be
6 changed files with 32 additions and 5 deletions
@@ -25,7 +25,10 @@ module Redmine

        def initialize(request, response)
          super
-          self.jsonp = (request.params[:callback] || request.params[:jsonp]).to_s.gsub(/[^a-zA-Z0-9_]/, '')
+          callback = request.params[:callback] || request.params[:jsonp]
+          if callback && Setting.jsonp_enabled?
+            self.jsonp = callback.to_s.gsub(/[^a-zA-Z0-9_]/, '')
+          end
        end

        def output