From 2a8baa2f34100bbe0a8d6b67c52ad8fd89b6705b Mon Sep 17 00:00:00 2001
From: yuri <yurak@list.ru>
Date: Thu, 22 Sep 2016 14:52:11 +0300
Subject: [PATCH] export: use POST request

---
 application/Espo/Core/Controllers/Record.php | 12 ++++++++----
 client/src/views/record/list.js              | 15 +++++----------
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/application/Espo/Core/Controllers/Record.php b/application/Espo/Core/Controllers/Record.php
index 8a2ac301e0..d3b2f3e4b0 100644
--- a/application/Espo/Core/Controllers/Record.php
+++ b/application/Espo/Core/Controllers/Record.php
@@ -226,6 +226,10 @@ class Record extends Base
 
     public function actionExport($params, $data, $request)
     {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
         if ($this->getConfig()->get('exportDisabled') && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
@@ -234,10 +238,10 @@ class Record extends Base
             throw new Forbidden();
         }
 
-        $ids = $request->get('ids');
-        $where = $request->get('where');
-        $byWhere = $request->get('byWhere');
-        $selectData = $request->get('selectData');
+        $ids = isset($data['ids']) ? $data['ids'] : null;
+        $where = isset($data['where']) ? json_decode(json_encode($data['where']), true) : null;
+        $byWhere = isset($data['byWhere']) ? $data['byWhere'] : false;
+        $selectData = isset($data['selectData']) ? json_decode(json_encode($data['selectData']), true) : null;
 
         $params = array();
         if ($byWhere) {
diff --git a/client/src/views/record/list.js b/client/src/views/record/list.js
index 1adefdbe47..36c5c98502 100644
--- a/client/src/views/record/list.js
+++ b/client/src/views/record/list.js
@@ -309,16 +309,11 @@ Espo.define('views/record/list', 'view', function (Dep) {
             	data.ids = this.checkedList;
             }
 
-            $.ajax({
-                url: this.scope + '/action/export',
-                type: 'GET',
-                data: data,
-                success: function (data) {
-                    if ('id' in data) {
-                        window.location = this.getBasePath() + '?entryPoint=download&id=' + data.id;
-                    }
-                }.bind(this),
-            });
+            this.ajaxPostRequest(this.scope + '/action/export', data).then(function (data) {
+                if ('id' in data) {
+                    window.location = this.getBasePath() + '?entryPoint=download&id=' + data.id;
+                }
+            }.bind(this));
         },
 
         massAction: function (name) {