Pi-Hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2026-05-08 09:39:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Return correct CORS header for Host

Browse Source 
If only Host was correct (FireFox and IE only set Host
for same-origin requests) then it would still use the
empty Origin header for the CORS response, leading to
`Access-Control-Allow-Origin: `
This commit is contained in:
Mcat12
2016-05-11 16:31:07 -04:00
parent 0e44f7b992
commit 7067473d89
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/add.php
+5 -4
View File
@@ -3,12 +3,13 @@ if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}" &&
$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] && $_SERVER['HTTP_HOST'] != "pi.hole")
if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
else
die("Failed CORS");
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
session_start();
// Check CSRF token
php/sub.php
+5 -4
View File
@@ -3,12 +3,13 @@ if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}" &&
$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] && $_SERVER['HTTP_HOST'] != "pi.hole")
if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
else
die("Failed CORS");
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
session_start();
// Check CSRF token