{"action":"created","issue":{"url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/17","repository_url":"https://api.github.com/repos/xenocrat/chyrp-lite","labels_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/17/comments","events_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/17/events","html_url":"https://github.com/xenocrat/chyrp-lite/issues/17","id":138860874,"number":17,"title":"Referer - AJAX error prevents installing extensions","user":{"login":"kehugter","id":6382342,"avatar_url":"https://avatars.githubusercontent.com/u/6382342?v=3","gravatar_id":"","url":"https://api.github.com/users/kehugter","html_url":"https://github.com/kehugter","followers_url":"https://api.github.com/users/kehugter/followers","following_url":"https://api.github.com/users/kehugter/following{/other_user}","gists_url":"https://api.github.com/users/kehugter/gists{/gist_id}","starred_url":"https://api.github.com/users/kehugter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kehugter/subscriptions","organizations_url":"https://api.github.com/users/kehugter/orgs","repos_url":"https://api.github.com/users/kehugter/repos","events_url":"https://api.github.com/users/kehugter/events{/privacy}","received_events_url":"https://api.github.com/users/kehugter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-07T01:31:52Z","updated_at":"2016-03-07T21:27:32Z","closed_at":null,"body":"Trying to install any extensions results in an alert saying\r\n\r\n> There was an error enabling the extension.\r\n\r\nThe POST seems to be wrong (missing values):\r\n\r\n`action=enable_module&extension=highlighter&confirm=&hash=`\r\n\r\nand returns the following HTML and response\r\n\r\n> Access Denied: Invalid security key.\r\n\r\n> Access Denied: Invalid security key.\r\n<!-- HEY_JAVASCRIPT_THIS_IS_AN_ERROR_JUST_SO_YOU_KNOW -->\r\n\r\nSeems to be caused by blanked referers. If I disable AJAX or enable referers, extensions are installed normally. Fresh chyrp-lite install, latest release."},"comment":{"url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/comments/193459328","html_url":"https://github.com/xenocrat/chyrp-lite/issues/17#issuecomment-193459328","issue_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/17","id":193459328,"user":{"login":"xenocrat","id":4855211,"avatar_url":"https://avatars.githubusercontent.com/u/4855211?v=3","gravatar_id":"","url":"https://api.github.com/users/xenocrat","html_url":"https://github.com/xenocrat","followers_url":"https://api.github.com/users/xenocrat/followers","following_url":"https://api.github.com/users/xenocrat/following{/other_user}","gists_url":"https://api.github.com/users/xenocrat/gists{/gist_id}","starred_url":"https://api.github.com/users/xenocrat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xenocrat/subscriptions","organizations_url":"https://api.github.com/users/xenocrat/orgs","repos_url":"https://api.github.com/users/xenocrat/repos","events_url":"https://api.github.com/users/xenocrat/events{/privacy}","received_events_url":"https://api.github.com/users/xenocrat/received_events","type":"User","site_admin":false},"created_at":"2016-03-07T21:27:32Z","updated_at":"2016-03-07T21:27:32Z","body":"This is intended behaviour. A security key is required for some privileged ajax actions: toggle modules and feathers in the admin console, edit posts and comments inline on the blog. To guard against [cross-site request forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), the security key is only added to the JavaScript file if the browser sends valid cookies and a referrer that matches the Chyrp URL when the file is requested.\r\n\r\nIf you are running with referrers disabled in your browser, you can switch off ajax features in Settings > Content and this will make the aforementioned functions fallback to form submissions and static pages."}}