{"action":"created","issue":{"url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/146","repository_url":"https://api.github.com/repos/teknik-eksjo/chronos","labels_url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/146/labels{/name}","comments_url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/146/comments","events_url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/146/events","html_url":"https://github.com/teknik-eksjo/chronos/pull/146","id":155661885,"number":146,"title":"Added CSRF-protection on ajax calls","user":{"login":"hugolundin","id":9110669,"avatar_url":"https://avatars.githubusercontent.com/u/9110669?v=3","gravatar_id":"","url":"https://api.github.com/users/hugolundin","html_url":"https://github.com/hugolundin","followers_url":"https://api.github.com/users/hugolundin/followers","following_url":"https://api.github.com/users/hugolundin/following{/other_user}","gists_url":"https://api.github.com/users/hugolundin/gists{/gist_id}","starred_url":"https://api.github.com/users/hugolundin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hugolundin/subscriptions","organizations_url":"https://api.github.com/users/hugolundin/orgs","repos_url":"https://api.github.com/users/hugolundin/repos","events_url":"https://api.github.com/users/hugolundin/events{/privacy}","received_events_url":"https://api.github.com/users/hugolundin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/teknik-eksjo/chronos/labels/discussing","name":"discussing","color":"5319e7"},{"url":"https://api.github.com/repos/teknik-eksjo/chronos/labels/ready","name":"ready","color":"ededed"},{"url":"https://api.github.com/repos/teknik-eksjo/chronos/labels/security","name":"security","color":"ffef00"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-05-19T06:16:23Z","updated_at":"2016-05-19T19:47:12Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/teknik-eksjo/chronos/pulls/146","html_url":"https://github.com/teknik-eksjo/chronos/pull/146","diff_url":"https://github.com/teknik-eksjo/chronos/pull/146.diff","patch_url":"https://github.com/teknik-eksjo/chronos/pull/146.patch"},"body":"Part of the solution of #141 "},"comment":{"url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/comments/220432229","html_url":"https://github.com/teknik-eksjo/chronos/pull/146#issuecomment-220432229","issue_url":"https://api.github.com/repos/teknik-eksjo/chronos/issues/146","id":220432229,"user":{"login":"Greenheart","id":6125097,"avatar_url":"https://avatars.githubusercontent.com/u/6125097?v=3","gravatar_id":"","url":"https://api.github.com/users/Greenheart","html_url":"https://github.com/Greenheart","followers_url":"https://api.github.com/users/Greenheart/followers","following_url":"https://api.github.com/users/Greenheart/following{/other_user}","gists_url":"https://api.github.com/users/Greenheart/gists{/gist_id}","starred_url":"https://api.github.com/users/Greenheart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Greenheart/subscriptions","organizations_url":"https://api.github.com/users/Greenheart/orgs","repos_url":"https://api.github.com/users/Greenheart/repos","events_url":"https://api.github.com/users/Greenheart/events{/privacy}","received_events_url":"https://api.github.com/users/Greenheart/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T19:47:12Z","updated_at":"2016-05-19T19:47:12Z","body":"> https://github.com/lepture/flask-wtf/blob/master/flask_wtf/csrf.py#L215-L218\r\n\r\nDidn't know it was possible to link to specific lines, nice feature! :)\r\n\r\n---\r\n\r\n@Limpan To answer your comments: This code is good enough to protect from CSRF. Chronos doesn't provide enough good surfaces to be viable for effective XSS. \r\n\r\nI do agree that this is ready to be merged - I just want to make clear that this PR will introduce a potential vulnerability that allows malicios js to abuse `$.ajax()` altough it's very unlikely."}}