Skip to content

Commit 2b08e59

Browse files
committed
Revert to default query execution behaviour
The only security risk here is persuading a user to execute a mutation, which is probably not a big risk. To mitigate this risk and still keep the same UX (that is so valuable), would require more work than is proportionate for this PR.
1 parent cb87f40 commit 2b08e59

File tree

1 file changed

+0
-20
lines changed

1 file changed

+0
-20
lines changed

graphene_django/static/graphene_django/graphiql.js

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -35,30 +35,10 @@
3535
}
3636
}
3737

38-
// If there are any fragment parameters, confirm the user wants to use them.
39-
var isReload = window.performance ? performance.navigation.type === 1 : false;
40-
var isQueryTrusted = Object.keys(parameters).length === 0 || isReload;
41-
4238
var fetchURL = locationQuery(otherParams);
4339

4440
// Defines a GraphQL fetcher using the fetch API.
4541
function graphQLFetcher(graphQLParams) {
46-
var isIntrospectionQuery = (
47-
graphQLParams.query !== parameters.query
48-
&& graphQLParams.query.indexOf('IntrospectionQuery') !== -1
49-
);
50-
51-
if (!isQueryTrusted
52-
&& !isIntrospectionQuery
53-
&& !window.confirm("This query was loaded from a link, are you sure you want to execute it?")) {
54-
return Promise.resolve('Aborting query.');
55-
}
56-
57-
// We don't want to set this for the introspection query
58-
if (!isIntrospectionQuery) {
59-
isQueryTrusted = true;
60-
}
61-
6242
var headers = {
6343
'Accept': 'application/json',
6444
'Content-Type': 'application/json'

0 commit comments

Comments
 (0)