CORS refactoring

airtime_mvc/application/common/CORSHelper.php

@@ -0,0 +1,26 @@
+<?php
+
+
+class CORSHelper
+{
+    public static function enableATProCrossOriginRequests(&$request, &$response)
+    {
+        //Allow AJAX requests from www.airtime.pro. We use this to automatically login users
+        //after they sign up from the microsite.
+        //Chrome sends the Origin header for all requests, so we whitelist the webserver's hostname as well.
+        $response = $response->setHeader('Access-Control-Allow-Origin', '*');
+        $origin = $request->getHeader('Origin');
+        if (($origin != "") &&
+        (!in_array($origin,
+                array("http://www.airtime.pro",
+                        "https://www.airtime.pro",
+                        "http://" . $_SERVER['SERVER_NAME'],
+                        "https://" . $_SERVER['SERVER_NAME']
+                ))
+        ))
+        {
+            //Don't allow CORS from other domains to prevent XSS.
+            throw new Zend_Controller_Action_Exception('Forbidden', 403);
+        }
+    }
+}

airtime_mvc/application/controllers/LoginController.php

@@ -1,6 +1,7 @@
 <?php
 
 require_once('WhmcsLoginController.php');
+require_once('CORSHelper.php');
 
 class LoginController extends Zend_Controller_Action
 {
@@ -14,25 +15,11 @@ class LoginController extends Zend_Controller_Action
         $CC_CONFIG = Config::getConfig();
         
         $request = $this->getRequest();
+        $response = $this->getResponse();
         
-        //Allow AJAX requests from www.airtime.pro. We use this to automatically login users
+        //Enable AJAX requests from www.airtime.pro for the sign-in process.
-        //after they sign up from the microsite.
+        CORSHelper::enableATProCrossOriginRequests($request, $response);
-        //Chrome sends the Origin header for all requests, so we whitelist the webserver's hostname as well.
+                
-        $response = $this->getResponse()->setHeader('Access-Control-Allow-Origin', '*');
-        $origin = $request->getHeader('Origin');
-        if (($origin != "") && 
-            (!in_array($origin, 
-                    array("http://www.airtime.pro", 
-                          "https://www.airtime.pro",
-                          "http://" . $_SERVER['SERVER_NAME'],
-                          "https://" . $_SERVER['SERVER_NAME']
-                ))
-            ))
-        {
-            //Don't allow CORS from other domains to prevent XSS.
-            throw new Zend_Controller_Action_Exception('Forbidden', 403);
-        }
-        
         Application_Model_Locale::configureLocalization($request->getcookie('airtime_locale', 'en_CA'));
         if (Zend_Auth::getInstance()->hasIdentity())
         {

airtime_mvc/application/controllers/ShowbuilderController.php

@@ -1,5 +1,7 @@
 <?php
 
+require_once('CORSHelper.php');
+
 class ShowbuilderController extends Zend_Controller_Action
 {
 
@@ -22,7 +24,12 @@ class ShowbuilderController extends Zend_Controller_Action
         $CC_CONFIG = Config::getConfig();
 
         $request = $this->getRequest();
-
+        $response = $this->getResponse();
+        
+        //Enable AJAX requests from www.airtime.pro because the autologin during the seamless sign-up follows
+        //a redirect here.
+        CORSHelper::enableATProCrossOriginRequests($request, $response);
+        
         $baseUrl = Application_Common_OsPath::getBaseDir();
 
         $user = Application_Model_User::GetCurrentUser();

airtime_mvc/public/index.php

@@ -47,6 +47,9 @@ if (file_exists('/usr/share/php/libzend-framework-php')) {
 //Upgrade directory
 set_include_path(APPLICATION_PATH . '/upgrade/' . PATH_SEPARATOR . get_include_path());
 
+//Common directory
+set_include_path(APPLICATION_PATH . '/common/' . PATH_SEPARATOR . get_include_path());
+
 
 /** Zend_Application */
 require_once 'Zend/Application.php';