From: Yuri Konotopov <ykonotopov@gnome.org>
Date: Mon, 29 Mar 2021 18:42:42 +0000 (+0400)
Subject: extensionDownloader: Use POST request for checking updates
X-Git-Tag: archive/raspbian/50.5-1+rpi1~1^2~616^2^2~83
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=02b06385eaa46d995739e9f4d237d9ecf1c60c98;p=gnome-shell.git

extensionDownloader: Use POST request for checking updates

Usage of GET requests for checking updates was made deprecated
at website some time ago [1], but REST endpoint was
CSRF-protected until recently [2].
The body of update request may be big enough and thus does not
suitable for GET requests.

[1] https://gitlab.gnome.org/Infrastructure/extensions-web/-/commit/0b38da1b2b440db1b4eb767cff74acf8f8de18e0
[2] https://gitlab.gnome.org/Infrastructure/extensions-web/-/commit/e3ab0c07dce4d58b33b30700ec1ea7aa2e3b4230

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1781>
---

diff --git a/js/ui/extensionDownloader.js b/js/ui/extensionDownloader.js
index a7b40f973..6a3b2b488 100644
--- a/js/ui/extensionDownloader.js
+++ b/js/ui/extensionDownloader.js
@@ -151,12 +151,19 @@ function checkForUpdates() {
         'disable-extension-version-validation');
     let params = {
         shell_version: Config.PACKAGE_VERSION,
-        installed: JSON.stringify(metadatas),
         disable_version_validation: versionCheck.toString(),
     };
 
-    let url = REPOSITORY_URL_UPDATE;
-    let message = Soup.form_request_new_from_hash('GET', url, params);
+    const uri = Soup.URI.new(REPOSITORY_URL_UPDATE);
+    uri.set_query_from_form(params);
+
+    const message = Soup.Message.new_from_uri('POST', uri);
+    message.set_request(
+        'application/json',
+        Soup.MemoryUse.COPY,
+        JSON.stringify(metadatas)
+    );
+
     _httpSession.queue_message(message, () => {
         if (message.status_code != Soup.KnownStatusCode.OK)
             return;