tags:

views:

101

answers:

1

Hi all, using firebug on a site and I noticed this json post request:

POST /xxxx/yyy
Host test.it
User-Agent Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,application/json
Accept-Language en-us,en;q=0.5
Accept-Encoding gzip,deflate
Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive 300
Connection keep-alive
Content-Type text/plain; charset=UTF-8
Referer http://test.it/preview/2.1284/2.1988/2.16289
Content-Length 186
Cookie userId=61080064567894730d450a494fee0af5
Pragma no-cache
Cache-Control no-cache

{id:4,method:"contentBridge.setComponentValue",params:["7.92961", "name", "Welcome", "", {"javaClass": "java.util.HashMap", "map": {"en": false, "es": false, "de": false, "fr": false}}]}

The question is knowing that they are using jquery, jsonrpc and polopoly cms, is it possible to post the same json data but from a page hosted on my webserver??

Thanks a lot in advance

A: 

Yes.

The headers here aren't really important, except for the HTTP verb POST at the top.

The relevant bit is the JSON string: it looks like a JSONRPC call - that's the outer object with id, method and params. Those parameters are an array, and the last parameter appears to be a JSON serialised Java class.

You can use this yourself easily using jQuery:

$.ajax({
  url: 'yourserver.com/service',
  dataType: 'json',
  data: {
        id:4,
        method:"contentBridge.setComponentValue",
        params:[
            "7.92961", 
            "name", 
            "Welcome", 
            "", 
            {
                "javaClass": "java.util.HashMap", 
                "map": {
                    "en": false, 
                    "es": false, 
                    "de": false, 
                    "fr": false
                }
            }
        ]
    },
  success: function() { /*  */ }
});

If this script is running from the browser (for instance as a Ubiquity script) you should be ok, but if it's running on a page on a different site expect lots of issues. I think all the browsers block cross-domain AJAX calls by default.

Keith