Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: [breaking] send configured config URL as origin if not custom

Browse Source 
This is a breaking change if your install uses multiple URLs to access. You will need to update the Access-Control-Allow-Origin header in ACP > Advanced > Headers to supply all URLs you use to access your site
This commit is contained in:
Julian Lam
2020-10-20 12:24:29 -04:00
parent 7a019494e8
commit 205a10308e
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/middleware/headers.js
View File

@@ -2,6 +2,7 @@
const os = require('os'); const os = require('os');
const winston = require('winston'); const winston = require('winston');
const nconf = require('nconf');
const _ = require('lodash'); const _ = require('lodash');
const meta = require('../meta'); const meta = require('../meta');
@@ -34,6 +35,7 @@ module.exports = function (middleware) {
if (origins.includes(req.get('origin'))) { if (origins.includes(req.get('origin'))) {
headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin')); headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin'));
headers.Vary = headers.Vary ? `${headers.Vary}, Origin` : 'Origin';
} }
} }
@@ -52,10 +54,15 @@ module.exports = function (middleware) {
originsRegex.forEach(function (regex) { originsRegex.forEach(function (regex) {
if (regex && regex.test(req.get('origin'))) { if (regex && regex.test(req.get('origin'))) {
headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin')); headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin'));
headers.Vary = headers.Vary ? `${headers.Vary}, Origin` : 'Origin';
} }
}); });
} }
if (!headers.hasOwnProperty('Access-Control-Allow-Origin')) {
headers['Access-Control-Allow-Origin'] = nconf.get('url');
}
if (meta.config['access-control-allow-credentials']) { if (meta.config['access-control-allow-credentials']) {
headers['Access-Control-Allow-Credentials'] = meta.config['access-control-allow-credentials']; headers['Access-Control-Allow-Credentials'] = meta.config['access-control-allow-credentials'];
} }