mirror of
https://github.com/pi-hole/FTL.git
synced 2026-10-07 08:38:03 +01:00
DL6ER
ae3b850188
Cross-origin web apps could not use DELETE endpoints. Their 204 No Content answer, like every error response, goes through `my_send_http_error_headers()`, which did not call `send_cors_header()`, so the browser discarded it for lack of `Access-Control-Allow-Origin`. The 200 responses sent via `mg_send_http_ok()` always carried it. Preflights need no change in FTL: CivetWeb answers every request carrying both `Origin` and `Access-Control-Request-Method` itself before it reaches `api_handler()`. The tests cover both the preflight and the CORS header on a non-200 response. Closes #2261 Signed-off-by: DL6ER <dl6er@dl6er.de>