From b24f340d914c6fa40b96d6b5407805c7d646dfb2 Mon Sep 17 00:00:00 2001
From: viveksantayana <me@viveksantayana.co.uk>
Date: Mon, 29 Nov 2021 09:13:21 +0000
Subject: [PATCH] Added CSRF protection to all ajax requests

---
 ref-test/admin/templates/admin/components/base.html | 11 +++++++++++
 ref-test/quiz/templates/quiz/components/base.html   | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/ref-test/admin/templates/admin/components/base.html b/ref-test/admin/templates/admin/components/base.html
index 1e7ca4c..c871c41 100644
--- a/ref-test/admin/templates/admin/components/base.html
+++ b/ref-test/admin/templates/admin/components/base.html
@@ -53,6 +53,17 @@
             crossorigin="anonymous"
         ></script>
         <!-- Custom js -->
+        <script type="text/javascript">
+            var csrf_token = "{{ csrf_token() }}";
+        
+            $.ajaxSetup({
+                beforeSend: function(xhr, settings) {
+                    if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
+                        xhr.setRequestHeader("X-CSRFToken", csrf_token);
+                    }
+                }
+            });
+        </script>
         <script
             type="text/javascript"
             src="{{ url_for('.static', filename='js/script.js') }}"
diff --git a/ref-test/quiz/templates/quiz/components/base.html b/ref-test/quiz/templates/quiz/components/base.html
index 7c01603..fd8f26f 100644
--- a/ref-test/quiz/templates/quiz/components/base.html
+++ b/ref-test/quiz/templates/quiz/components/base.html
@@ -51,6 +51,17 @@
             crossorigin="anonymous"
         ></script>
         <!-- Custom js -->
+        <script type="text/javascript">
+            var csrf_token = "{{ csrf_token() }}";
+        
+            $.ajaxSetup({
+                beforeSend: function(xhr, settings) {
+                    if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
+                        xhr.setRequestHeader("X-CSRFToken", csrf_token);
+                    }
+                }
+            });
+        </script>
         <script
             type="text/javascript"
             src="{{ url_for('.static', filename='js/script.js') }}"