Third-party AJAX requests not detected

qtranslate / qtranslate-xt

qTranslate-XT (eXTended) - reviving qTranslate-X multilingual plugin for WordPress. A new community-driven plugin soon. Built-in modules for WooCommerce, ACF, slugs and others.

GNU General Public License v2.0

546 stars 103 forks source link

Third-party AJAX requests not detected #1327

Closed herrvigg closed 1 year ago

herrvigg commented 1 year ago

Checking wp_doing_ajax() is only a partial check that is valid for WordPress Ajax requests, but not for all the other plugins.

This HTTP variable should be checked: HTTP_X_REQUESTED_WITH: XMLHttpRequest. See also RFC6648: Deprecating the "X-" Prefix.

Much likely this had no big impact for the redirects because qtranxf_can_redirect cancels requests containing a non-empty $_POST that is generally set with Ajax requests, but this may impact other parts.

herrvigg commented 1 year ago

Fix released in 3.14.2.

Use this extended detection of Ajax for:

blocking qtranxf_can_redirect (URL/language redirect)
not sending back HTTP cookies
special admin handling of HTTP referrer (only used for admin terms).