diff --git a/src/metabase/handler.clj b/src/metabase/handler.clj index 8b9e9e3bca9a054010b5d5eea9cec0ab00121199..6d81b9f0fb643270d1011ea4b4fd539b02b5f569 100644 --- a/src/metabase/handler.clj +++ b/src/metabase/handler.clj @@ -36,7 +36,8 @@ mw.session/wrap-session-id ; looks for a Metabase Session ID and assoc as :metabase-session-id mw.auth/wrap-api-key ; looks for a Metabase API Key on the request and assocs as :metabase-api-key mw.misc/maybe-set-site-url ; set the value of `site-url` if it hasn't been set yet - mw.json/check-application-type-headers ; Reject non-GET requests without Content-Type: application/json headers, we don't support them + ;; Disabled for now because some things like CSV download buttons don't work with this on. + #_mw.json/check-application-type-headers ; Reject non-GET requests without Content-Type: application/json headers, we don't support them mw.misc/bind-user-locale ; Binds *locale* for i18n wrap-cookies ; Parses cookies in the request map and assocs as :cookies mw.misc/add-content-type ; Adds a Content-Type header for any response that doesn't already have one diff --git a/src/metabase/middleware/json.clj b/src/metabase/middleware/json.clj index a8aa6341c074f9b5d37d87462b6917e3fbe37dd6..34b067d88eb5ad76db9e8af85900a5440e732289 100644 --- a/src/metabase/middleware/json.clj +++ b/src/metabase/middleware/json.clj @@ -4,7 +4,6 @@ [core :as json] [generate :refer [add-encoder encode-str]]] [metabase.util :as u] - [metabase.util.i18n :refer [tru]] [ring.middleware.json :as ring.json] [ring.util [io :as rui] @@ -63,7 +62,7 @@ (respond ring.json/default-malformed-response)) (handler request respond raise)))) -(defn check-application-type-headers +#_(defn check-application-type-headers "We don't support API requests with any type of content encoding other than JSON so let's be nice and make that explicit. Added benefit is that it reduces CSRF surface because POSTing a form with JSON content encoding isn't so easy to do." diff --git a/test/metabase/middleware/json_test.clj b/test/metabase/middleware/json_test.clj index f09a257a9bab49c47f2e89b8d98a947cebbef5ff..efa39ae547a2cad65a1585b6e82b0bbaa305da08 100644 --- a/test/metabase/middleware/json_test.clj +++ b/test/metabase/middleware/json_test.clj @@ -1,10 +1,6 @@ (ns metabase.middleware.json-test (:require [cheshire.core :as json] - [clj-http.client :as http] - [expectations :refer [expect]] - [metabase.http-client :as mb-http] - [metabase.test.data.users :as test-users]) - (:import clojure.lang.ExceptionInfo)) + [expectations :refer [expect]])) ;;; JSON encoding tests ;; Required here so so custom Cheshire encoders are loaded @@ -18,7 +14,7 @@ ;; Make sure we send you an informative error message if you try to send an API request without Content-Type: ;; application/json headers -(expect +#_(expect {:body "Metabase only supports JSON requests. Make sure you set a Content-Type: application/json header." :status 400} (try