Open
Description
Sorry to keep bothering you, but I have discovered another problem, specific to IE 11. Apparently, in IE11, typeof ActiveXObject always evaluates to undefined, even when new ActiveXObject() will correctly create an instance of it. As always, here is my simplified example:
<?php
include_once 'csrf-protector/libs/csrf/csrfprotector.php';
csrfProtector::init();
function test_csrfp()
{
echo
'<html>
<body>
<button onclick="submit();">Submit</button>
<script>
function submit()
{
var req = new ActiveXObject("Msxml2.XMLHTTP"); // Microsoft.XMLHTTP also broken
req.open("POST", "index.php", true);
req.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
req.send("foo=bar");
}
</script>
</body>
</html>';
}
function success()
{
echo
"<html>
<body>Success</body>
</html>";
}
if ($_POST)
success();
else
test_csrfp();
I can reproduce the problem with IE11, but I haven't tried in older versions. My gut tells me that it's specific to IE11, but can't say for sure.