corsPolicyHeader()

Complexity

Conditions	33
Paths	1441

Size

Total Lines	96
Code Lines	44

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function corsPolicyHeader($set_header = true)
{
	global $boardurl, $modSettings, $context;

	if (empty($modSettings['allow_cors']))
		return;

	// We want weak security.
	if (!empty($modSettings['cors_domains']) && $modSettings['cors_domains'] === '*')
		$context['cors_domain'] = '*';

	// If subdomain-independent cookies are on, allow sub domains. This will have issues if the forum is at forum.domain.tld and the origin we are at is another.sub.domain.tld.
	if (empty($context['cors_domain']) && !empty($modSettings['globalCookies']) && !empty($_SERVER['HTTP_ORIGIN']) && filter_var($_SERVER['HTTP_ORIGIN'], FILTER_VALIDATE_URL) !== false && FindCorsBaseUrl($boardurl, true) === FindCorsBaseUrl($_SERVER['HTTP_ORIGIN'], true))
	{
		$context['cors_domain'] = $_SERVER['HTTP_ORIGIN'];
		$context['valid_cors_found'] = 'subdomain';
	}

	// Support forum_alias_urls as well, which is supported by our login cookie, so we implant it similar here.
	if (empty($context['cors_domain']) && !empty($modSettings['forum_alias_urls']) && !empty($_SERVER['HTTP_ORIGIN']) && filter_var($_SERVER['HTTP_ORIGIN'], FILTER_VALIDATE_URL) !== false)
	{
		$aliases = explode(',', $modSettings['forum_alias_urls']);

		foreach ($aliases as $alias)
		{
			if ($alias === $_SERVER['HTTP_ORIGIN'])
			{
				$context['cors_domain'] = $_SERVER['HTTP_ORIGIN'];
				$context['valid_cors_found'] = 'alias';
				break;
			}
		}
	}

	// Additional CORS domains but its just a wildcard for everything.
	if (empty($context['cors_domain']) && !empty($modSettings['cors_domains']) && !empty($_SERVER['HTTP_ORIGIN']) && filter_var($_SERVER['HTTP_ORIGIN'], FILTER_VALIDATE_URL) !== false)
	{
		$cors_domains = explode(',', $modSettings['cors_domains']);
		$origin_base = FindCorsBaseUrl($_SERVER['HTTP_ORIGIN']);

		foreach ($cors_domains as $domain)
		{
			if ($domain === $_SERVER['HTTP_ORIGIN'])
			{
				$context['cors_domain'] = $_SERVER['HTTP_ORIGIN'];
				$context['valid_cors_found'] = 'additional';
				break;
			}

			// If we find a * in the host, then its a wildcard and lets allow it.  This will have issues if the forum is at forum.domain.tld and the origin we are at is more.sub.domain.tld.
			if ('*' === implode('.', array_slice(explode('.', parse_url($domain, PHP_URL_HOST)), 0, 1)) && FindCorsBaseUrl($domain, true) === $origin_base)
			{
				$context['cors_domain'] = $_SERVER['HTTP_ORIGIN'];
				$context['valid_cors_found'] = 'additional_wildcard';
				break;
			}
		}
	}

	// The default is just to place the domain of the boardurl into the policy.
	if (empty($context['cors_domain']) || empty($context['valid_cors_found']))
	{
		$boardurl_parts = parse_url($boardurl);

		// Default the CORS to the current domain
		$context['cors_domain'] = $boardurl_parts['scheme'] . '://' . $boardurl_parts['host'];

		// Attach the port if needed.
		if (!empty($boardurl_parts['port']))
			$context['cors_domain'] .= ':' . $boardurl_parts['port'];

		$context['valid_cors_found'] = 'same';
	}

	$context['cors_headers'] = 'X-SMF-AJAX';

	// Any additional headers?
	if (!empty($modSettings['cors_headers']))
	{
		// Cleanup any typos.
		$cors_headers = explode(',', $modSettings['cors_headers']);
		foreach ($cors_headers as &$ch)
			$ch = trim(str_replace(' ', '-', $ch));

		$context['cors_headers'] += implode(',', $cors_headers);
	}

	// Allowing Cross-Origin Resource Sharing (CORS).
	if ($set_header && !empty($modSettings['allow_cors']) && !empty($context['valid_cors_found']) && !empty($context['cors_domain']))
	{
		header('Access-Control-Allow-Origin: ' . $context['cors_domain']);
		header('Access-Control-Allow-Headers: ' . $context['cors_headers']);

		// Be careful with this, your allowing a external site to allow the browser to send cookies with this.
		if (!empty($modSettings['allow_cors_credentials']))
			header('Access-Control-Allow-Credentials: true');
	}
?>