For those that have problems with using this extension and validate the csrf token i modified the elfinder.full.js file so that the script can accept custom POST params when doing the upload.
Like uploadify does, this change allows you to use the scriptData option to pass your custom params:
<script type="text/javascript" charset="utf-8">
$().ready(function() {
var funcNum = window.location.search.replace(/^.*CKEditorFuncNum=(\d+).*$/, "$1");
var langCode = window.location.search.replace(/^.*langCode=([a-z]{2}).*$/, "$1");
$('#finder').elfinder({
url : '<?php echo Yii::app()->createUrl('elfinder/default/connector')?>',
lang : langCode,
editorCallback : function(url) {
window.opener.CKEDITOR.tools.callFunction(funcNum, url);
window.close();
},
scriptData:{<?php echo Yii::app()->request->csrfTokenName;?>:'<?php echo Yii::app()->request->getCsrfToken();?>'}
});
});
</script>
As you see, in scriptData i am passing the token so that it will be appended to the upload form and Yii can check it successfully.
The changes i did:
//In the default options area, line 704
[...]
autoReload : 0,
/**
* Option added by Twisted1919
* The scriptData will accept an object (key:value pairs)
* It is used to pass post data to the upload method so that for example you can check
* a CSRF Token.
* Also, see line 1964
**/
scriptData : null
//In the upload method, line 1964
[...]
/**
* Change made by Twisted1919
* Because most of the time we need to send extra data with the uploaded file
* like a csrf token, i needed a way to do this, so that the scriptData option was born.
**/
if(typeof(self.fm.options.scriptData)==='object'){
for(key in self.fm.options.scriptData){
f+='<input type="hidden" name="'+key+'" id="'+key+'" value="'+self.fm.options.scriptData[key]+'" />';
}
}
// end change by Twisted1919
[...]
Attached is the archive containing just the elfinder.full.js file (you can compress it if you like).
Just overwrite the old one, and load it .