Sanitize CORS value before insert

airtime_mvc/application/models/Preference.php

@@ -1556,7 +1556,16 @@ class Application_Model_Preference
      * @param string $value
      * @return void
      */
-    public static function SetAllowedCorsUrls($value) {
+    public static function SetAllowedCorsUrls($value)
+    {
+        // Trim and strip trailing slash for each entry
+        $value = implode(PHP_EOL, array_map(
+            function ($v) {
+                return rtrim(trim($v), '/');
+            },
+            explode(PHP_EOL, $value)
+        ));
+
         self::setValue('allowed_cors_urls', $value);
     }