Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix logins from WHMCS by disabling CSRF token on login page for trusted

Browse source 
origins
This commit is contained in:
Albert Santoni 2014-11-20 19:33:11 -05:00
parent ca7d0688e7
commit a62e98beb4
2 changed files with 31 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

18
airtime_mvc/application/common/CORSHelper.php
View file

@ -11,17 +11,19 @@ class CORSHelper
$response = $response->setHeader('Access-Control-Allow-Origin', '*');
$origin = $request->getHeader('Origin');
if ((!(preg_match("/https?:\/\/localhost/", $origin) === 1)) && ($origin != "") &&
(!in_array($origin,
array("http://www.airtime.pro",
"https://www.airtime.pro",
"https://account.sourcefabric.com",
"http://" . $_SERVER['SERVER_NAME'],
"https://" . $_SERVER['SERVER_NAME']
))
))
(!in_array($origin, self::getAllowedOrigins())))
{
//Don't allow CORS from other domains to prevent XSS.
throw new Zend_Controller_Action_Exception('Forbidden', 403);
}
}
public static function getAllowedOrigins()
{
return array("http://www.airtime.pro",
"https://www.airtime.pro",
"https://account.sourcefabric.com",
"http://" . $_SERVER['SERVER_NAME'],
"https://" . $_SERVER['SERVER_NAME']);
}
}