I'm not sure if this is a bug, a security feature, or something to do with Twig 2; but since Craft 3 (RC3) I'm no longer able to access hidden twig files via ajax.
This works fine:
$.ajax({
method:'GET',
url:'/blog/test',
success:function(data){
$('body').append(data);
console.log("SUCCESS", data);
},
error:function(data){
console.log("ERROR", data);
}
});
However, when I point the url to a hidden file with this:
url:'/blog/_test',
I get a 404 (Not Found) error. For my example, I have both '_test.twig' and 'test.twig' files in the 'blog' directory.
Am I missing a breaking change?
Update:
I didn't really know what it was for, but 'enableCsrfProtection' => true
has always been set in my config/general.php file. (In both Craft 2 and 3). I've tried setting this to false
too, and I'm getting the same results.
Following Robins comment, I've attempted to follow these instructions: Enabling CSRF Protection.
I've set the global variables window.csrfTokenName
and window.csrfTokenValue
. And now I'm stuck.
I'm pretty new to ajax, and I'm not sure how to extrapolate the example in a way where I can add the CSRF Token correctly in my 'GET' method.
This is the response I'm getting:
ERROR
{readyState: 4, getResponseHeader: ƒ, getAllResponseHeaders: ƒ, setRequestHeader: ƒ, overrideMimeType: ƒ, …}
abort : (statusText)
always : ()
catch : (fn)
done : ()
fail : ()
getAllResponseHeaders : ()
getResponseHeader : (key)
overrideMimeType : (type)
pipe : ()
progress : ()
promise : (obj)
readyState : 4
responseText : "<pre>Not Found: Page not found.</pre>"
setRequestHeader : (name,value)
state : ()
status : 404
statusCode : (map)
statusText : "Not Found"
then : (onFulfilled,onRejected,onProgress)
__proto__ : Object