sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Handle pre-flighted OPTIONS requests in send_origin_headers(). Props nacin. fixes #21024

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@21988 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2012-09-24 21:39:04 +00:00
parent 5ef3197ae0
commit a0edbbedb7
1 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
wp-includes/http.php
View File

@ -284,6 +284,10 @@ function is_allowed_http_origin( $origin = null ) {
* Send Access-Control-Allow-Origin and related headers if the current request
* is from an allowed origin.
*
* If the request is an OPTIONS request, the script exits with either access
* control headers sent, or a 403 response if the origin is not allowed. For
* other request methods, you will receive a return value.
*
* @since 3.4.0
*
* @return bool|string Returns the origin URL if headers are sent. Returns false
@ -291,11 +295,19 @@ function is_allowed_http_origin( $origin = null ) {
*/
function send_origin_headers() {
$origin = get_http_origin();
if ( ! is_allowed_http_origin( $origin ) )
return false;
@header( 'Access-Control-Allow-Origin: ' . $origin );
@header( 'Access-Control-Allow-Credentials: true' );
if ( is_allowed_http_origin( $origin ) ) {
@header( 'Access-Control-Allow-Origin: ' . $origin );
@header( 'Access-Control-Allow-Credentials: true' );
if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
exit;
return $origin;
}
return $origin;
}
if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
status_header( 403 );
exit;
}
return false;
}