<?php

    /**
     *
     */
class LimeScript extends CWidget
{
    public function run()
    {
        App()->getClientScript()->registerScriptFile(App()->getAssetManager()->publish(Yii::getPathOfAlias('ext.LimeScript.assets') . '/script.js'));

        $data = array();
        $data['baseUrl']                    = Yii::app()->getBaseUrl(true);
        $data['showScriptName']             = Yii::app()->urlManager->showScriptName;
        $data['urlFormat']                  = Yii::app()->urlManager->urlFormat;
        $data['adminImageUrl']              = Yii::app()->getConfig('adminimageurl');
        $data['csrfTokenName']              = Yii::app()->request->csrfTokenName;
        $data['csrfToken']                  = Yii::app()->request->csrfToken;
        $data['csrfTokenData']              = array(Yii::app()->request->csrfTokenName => Yii::app()->request->csrfToken);
        $data['language']                   = Yii::app()->language;
        $data['replacementFields']['path']  = App()->createUrl("limereplacementfields/index");
        $json = json_encode($data, JSON_FORCE_OBJECT);
        $script = "LS.data = $json;\n
                    // @see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#jquery
                    function csrfSafeMethod(method) {
                        // these HTTP methods do not require CSRF protection
                        return (/^(GET|HEAD|OPTIONS)$/.test(method));
                    }
                    // Use $.ajaxPrefilter() instead of $.ajaxSetup({beforeSend: ...}) to add the CSRF token because beforeSend is
                    // executed after the content type is determined. So, if the request had no data when beforeSend is executed,
                    // the content type is 'text/plain', which is wrong.
                    // urlencode for security (encode simple and double quote and antislash)
                    $.ajaxPrefilter(function(settings) {
                        if(!csrfSafeMethod(settings.type)) {
                            // Data could be passed as string or object, so we add the token depending on the data type
                            if (typeof settings.data == 'string') {
                                // NB: This sometimes includes the CSRF token twice, when already added to data.
                                settings.data +=  '&" . urlencode((string) Yii::app()->request->csrfTokenName) . "=" . urlencode((string) Yii::app()->request->csrfToken) . "';
                            } else {
                                settings.data = settings.data || {};
                                settings.data." . urlencode((string) Yii::app()->request->csrfTokenName) . " = '" . urlencode((string) Yii::app()->request->csrfToken) . "';
                            }
                        }
                    });";
        App()->getClientScript()->registerScript('LimeScript', $script, CClientScript::POS_HEAD);
    }
}
