server/core/js/oc-requesttoken.js

$(document).on('ajaxSend',function(elm, xhr, settings) {
	if(settings.crossDomain === false) {
		xhr.setRequestHeader('requesttoken', oc_requesttoken);
		xhr.setRequestHeader('OCS-APIREQUEST', 'true');
	}
});
Do not add sensitive request headers for cross domain requests Prevents leaking the CSRF token to another third-party domain by mistake. 2015-09-14 12:01:34 +00:00			`$(document).on('ajaxSend',function(elm, xhr, settings) {`
			`if(settings.crossDomain === false) {`
			`xhr.setRequestHeader('requesttoken', oc_requesttoken);`
			`xhr.setRequestHeader('OCS-APIREQUEST', 'true');`
			`}`
Add OCS API header per default Relieve @PVince from having to write it all the time ;-) 2014-11-21 18:54:19 +00:00			`});`