- refresh CSRF TTL after successful open/info/protected commands
- extend token lifetime on open requests during normal navigation
- limit CSRF protection to stable write commands
- fix callback script syntax in OAuth popup handling
- issue CSRF token on open init response
- send token via custom request header
- validate token for protected write commands
- refresh token TTL on info reload and valid protected requests
- return csrfReload marker on 403 to trigger background token refresh
- suppress duplicate CSRF refresh requests on the client
The connector can return the URL of the substitute image whose size will fit in that pixel as the value of the key 'url' of the result data when the 'substitute' parameter gives with `dim` command from the client.
Add the following two options on the client side config `commandsOptions.resize` to fixes#2251.
```javascript
// File size (bytes) threshold when using the `dim` command for obtain the image size necessary to start editing
getDimThreshold : 204800,
// File size (bytes) to request to get substitute image (400px) with the `dim` command
dimSubImgSize : 307200
```
- php:connector - range request supports on GET request only
- js - add an option `commandsOptions.open.method`
```javascript
open : {
// HTTP method that request to the connector when item URL is not valid URL.
// If you set to "get" will be displayed request parameter in the browser's location field
// so if you want to conceal its parameters should be given "post".
// Nevertheless, please specify "get" if you want to enable the partial request by HTTP Range header.
method : 'post'
},
```
Given that almost all methods, `elFinderConnector` provides are already protected (or public), thus is meant to be sub-classed and 'input_filter()` is useful in derived classes, too, make it protected instead of private.
nao-pon