0

As I discovered, it seems that "Secure Forms" setting won't allow anyone to submit more than once in Ajax.

I researched about this and I found out that it was because you can't send a form with same XID twice. You need to reload the page to get a fresh XID to submit.

However, this is a problem for Ajaxified forms, simply because of their essential nature and purpose.

Is there an elegant way to use Ajaxified forms inspite of the "Secure Forms" setting being turned on?

2

Yes, you need to get a new XID each time via Ajax and update your form hidden value, so next time the form is submitted it uses the new XID.

Depends what your Ajax is returning of course and where it's submitting to, but in the past on return from the Ajax submission, I've fired another function to just do an Ajax request, then do the replacements.

For example as part of the Ajax Submission function:

request = $.ajax({
    url: $form.attr("action"),
    type: "post",
    data: serializedData
});

request.done(function (response, textStatus, jqXHR) {
    if (updateForm) {
        AjaxGet(window.location.href, updateHTML);
    }
});

Then new functions:

//###   Retreave content/pages via Ajax   ###
function AjaxGet(urlString, resultHandler) {
    if (urlString == undefined)
        return;
    if (request)
        request.abort();

    request = $.ajax({
        url: urlString
    });

    request.done(function (response, textStatus, jqXHR) {
        resultHandler(response);
    });
}

Then the capture:

var updateHTML = function (htmlString) {
    var XID = $(htmlString).find('form#yourID input[name="XID"]').val();
}
| improve this answer | |
  • Wouldn't it be possible for a user to submit entries faster than the XID can be updated? – ExpressionEngineNewbie Aug 13 '13 at 13:17
  • Depends how you manage the submission, I use: $formElement.prop("disabled", true).addClass("disabled"); to prevent re-submission, then once complete $formElement.prop("disabled", false).removeClass("disabled"); – Peter Lewis Aug 13 '13 at 16:25
  • Ok, so if setting secure forms to off is absolutely non-negotiable, then I guess we have to go with this solution. – developarvin Aug 16 '13 at 8:52
1

When I throw an ajax error I use ee()->security->restore_xid() so I can use the same token again. Per http://ellislab.com/expressionengine/user-guide/development/guidelines/security.html#cross-site-request-forgery

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.