export: use POST request

application/Espo/Core/Controllers/Record.php

@@ -226,6 +226,10 @@ class Record extends Base
 
     public function actionExport($params, $data, $request)
     {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
         if ($this->getConfig()->get('exportDisabled') && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
@@ -234,10 +238,10 @@ class Record extends Base
             throw new Forbidden();
         }
 
-        $ids = $request->get('ids');
-        $where = $request->get('where');
-        $byWhere = $request->get('byWhere');
-        $selectData = $request->get('selectData');
+        $ids = isset($data['ids']) ? $data['ids'] : null;
+        $where = isset($data['where']) ? json_decode(json_encode($data['where']), true) : null;
+        $byWhere = isset($data['byWhere']) ? $data['byWhere'] : false;
+        $selectData = isset($data['selectData']) ? json_decode(json_encode($data['selectData']), true) : null;
 
         $params = array();
         if ($byWhere) {

client/src/views/record/list.js

@@ -309,16 +309,11 @@ Espo.define('views/record/list', 'view', function (Dep) {
             	data.ids = this.checkedList;
             }
 
-            $.ajax({
-                url: this.scope + '/action/export',
-                type: 'GET',
-                data: data,
-                success: function (data) {
-                    if ('id' in data) {
-                        window.location = this.getBasePath() + '?entryPoint=download&id=' + data.id;
-                    }
-                }.bind(this),
-            });
+            this.ajaxPostRequest(this.scope + '/action/export', data).then(function (data) {
+                if ('id' in data) {
+                    window.location = this.getBasePath() + '?entryPoint=download&id=' + data.id;
+                }
+            }.bind(this));
         },
 
         massAction: function (name) {