Addition of block token to ensure json block rendering is only available to those...

diff --git a/plugins/context_condition.inc b/plugins/context_condition.inc
index f4a5e5a..95951d9 100644 (file)
--- a/plugins/context_condition.inc
+++ b/plugins/context_condition.inc
@@ -89,7 +89,7 @@ class context_condition {
   /**
    * Context editor form for conditions.
    */
-  function editor_form($context) {
+  function editor_form($context = NULL) {
     $form = array();
     if (!empty($this->values)) {
       $options = $this->condition_values();

diff --git a/plugins/context_reaction_block.inc b/plugins/context_reaction_block.inc
index 7aaedae..6293210 100644 (file)
--- a/plugins/context_reaction_block.inc
+++ b/plugins/context_reaction_block.inc
@@ -554,8 +554,14 @@ class context_reaction_block extends context_reaction {
   function render_ajax($param) {
     // Besure the page isn't a 404 or 403.
     $headers = drupal_set_header();
-    foreach (explode("\n", $headers) as $header) {
-      if ($header == "HTTP/1.1 404 Not Found" || $header == "HTTP/1.1 403 Forbidden") {
+
+    // Support for Pressflow drupal_set_header.
+    if (!is_array($headers)) {
+      $headers = explode("\n", $headers);
+    }
+
+    foreach ($headers as $header) {
+      if (strpos($header, "404 Not Found") !== FALSE || strpos($header, "403 Forbidden") !== FALSE) {
         return;
       }
     }
@@ -566,6 +572,11 @@ class context_reaction_block extends context_reaction {
     if (strpos($param, ',') !== FALSE) {
       list($bid, $context) = explode(',', $param);
       list($module, $delta) = explode('-', $bid, 2);
+      // Check token to make sure user has access to block.
+      if (empty($_GET['context_token']) || $_GET['context_token'] != drupal_get_token($bid)) {
+        echo drupal_to_js(array('status' => 0));
+        exit;
+      }
 
       // Ensure $bid is valid.
       $info = $this->get_blocks();

diff --git a/plugins/context_reaction_block.js b/plugins/context_reaction_block.js
index 67e2031..8a937e2 100644 (file)
--- a/plugins/context_reaction_block.js
+++ b/plugins/context_reaction_block.js
@@ -242,6 +242,11 @@ DrupalContextBlockEditor.prototype.addBlock = function(event, ui, editor, contex
     // Construct query params for our AJAX block request.
     var params = Drupal.settings.contextBlockEditor.params;
     params.context_block = bid + ',' + context;
+    if (!Drupal.settings.contextBlockEditor.block_tokens || !Drupal.settings.contextBlockEditor.block_tokens[bid]) {
+      alert(Drupal.t('An error occurred trying to retrieve block content. Please contact a site administer.'));
+      return;
+    }
+    params.context_token = Drupal.settings.contextBlockEditor.block_tokens[bid];
 
     // Replace item with loading block.
     var blockLoading = $('<div class="context-block-item context-block-loading"><span class="icon"></span></div>');

diff --git a/plugins/context_reaction_menu.inc b/plugins/context_reaction_menu.inc
index a817e92..7a2336c 100644 (file)
--- a/plugins/context_reaction_menu.inc
+++ b/plugins/context_reaction_menu.inc
@@ -48,7 +48,7 @@ class context_reaction_menu extends context_reaction {
    * If primary + secondary links are pointed at the same menu, provide
    * contextual trailing by default.
    */
-  function execute(&$vars) {
+  function execute(&$vars = NULL) {
     if (variable_get('menu_primary_links_source', 'primary-links') == variable_get('menu_secondary_links_source', 'secondary-links')) {
       $vars['primary_links'] = theme_get_setting('toggle_primary_links') ? $this->menu_navigation_links(variable_get('menu_primary_links_source', 'primary-links')) : $vars['primary_links'];
       $vars['secondary_links'] = theme_get_setting('toggle_secondary_links') ? $this->menu_navigation_links(variable_get('menu_secondary_links_source', 'secondary-links'), 1) : $vars['secondary_links'];

diff --git a/theme/context_reaction_block.theme.inc b/theme/context_reaction_block.theme.inc
index 85992ec..b5c2813 100644 (file)
--- a/theme/context_reaction_block.theme.inc
+++ b/theme/context_reaction_block.theme.inc
@@ -91,8 +91,13 @@ function template_preprocess_context_block_browser(&$vars) {
  * Preprocessor for theme('context_block_browser_item').
  */
 function template_preprocess_context_block_browser_item(&$vars) {
+  static $added = array();
   $vars['bid'] = $vars['block']->bid;
   $vars['info'] = check_plain($vars['block']->info);
+  if (empty($added[$vars['bid']])) {
+    drupal_add_js(array('contextBlockEditor' => array('block_tokens' => array($vars['bid'] => drupal_get_token($vars['bid'])))), 'setting');
+    $added[$vars['bid']] = TRUE;
+  }
 }
 
 /**