ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Minor issue fix for CORS support

Browse Source 
git-svn-id: svn://192.168.202.10@3461 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-18 19:34:48 +00:00
parent d213754cd4
commit 8d178ff529
3 changed files with 125 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/docs/CORS_SUPPORT.txt
+2 -2
View File
@@ -23,7 +23,7 @@ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
VICIDIAL AGENT WEB SCREEN SCRIPTS SUPPORT:
Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following configurable variables to the "agc/options.php" file on your webserver:
Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3461) with the addition of the "agentCORS.php" file and the addition of the following configurable variables to the "agc/options.php" file on your webserver:
(NOTE: If you have never set up an "agc/options.php" file on your webserver before, just use a copy the file "agc/options-example.php")
@@ -52,7 +52,7 @@ NOTES:
VICIDIAL ADMIN WEB SCREEN SCRIPTS SUPPORT:
The implementation of CORS on tha admin side is very similar to the agent side, except only a limited number of admin PHP scripts are CORS-enabled at this time, and there is no '--ALL--' option for the $CORS_affected_scripts variable, so you must include every script you want to have CORS enabled on for the admin side in that variable. Support for CORS configuration for these limited admin "vicidial" web directory PHP scripts was added on 2021-06-18(svn/trunk revision 3460) with the addition of the "adminCORS.php" file and the addition of the following configurable variables to the "vicidial/options.php" file on your webserver:
The implementation of CORS on tha admin side is very similar to the agent side, except only a limited number of admin PHP scripts are CORS-enabled at this time, and there is no '--ALL--' option for the $CORS_affected_scripts variable, so you must include every script you want to have CORS enabled on for the admin side in that variable. Support for CORS configuration for these limited admin "vicidial" web directory PHP scripts was added on 2021-06-18(svn/trunk revision 3461) with the addition of the "adminCORS.php" file and the addition of the following configurable variables to the "vicidial/options.php" file on your webserver:
(NOTE: If you have never set up an "vicidial/options.php" file on your webserver before, just use a copy the file "vicidial/options-example.php")
List of CORS-enabled admin("vicidial") PHP scripts:
agc_2-X/trunk/www/agc/agentCORS.php
+61 -60
View File
@@ -25,53 +25,70 @@
$NOW_TIME = date("Y-m-d H:i:s");
if (strlen($php_script) < 1)
{exit;}
$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
if ($CORS_debug > 0)
{$donothing=1;}
else
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
fclose($fp);
}
$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
fclose($fp);
}
}
else
{
# check for affected scripts match (--ALL--, one-of-many)
if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
{
# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
{
header('Access-Control-Allow-Origin: ' . $CORS_origin);
header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
if (strlen($CORS_allowed_headers) > 0)
# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
fclose($fp);
}
}
else
{
# check for affected scripts match (--ALL--, one-of-many)
if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
{
# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
{
header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
header('Access-Control-Allow-Origin: ' . $CORS_origin);
header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
if (strlen($CORS_allowed_headers) > 0)
{
header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
}
if ($CORS_allowed_credentials == 'Y')
{
header('Access-Control-Allow-Credentials: true');
}
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
if ($CORS_allowed_credentials == 'Y')
else
{
header('Access-Control-Allow-Credentials: true');
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
if ($CORS_debug > 0)
# For OPTIONS preflight requests, exit without processing the script further
if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n");
fclose($fp);
flush();
die();
}
}
else
@@ -79,38 +96,22 @@ else
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n");
fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
fclose($fp);
}
}
# For OPTIONS preflight requests, exit without processing the script further
if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
{
flush();
die();
}
}
else
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
fclose($fp);
}
}
# add $Xframe_options if defined
if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
{
header('X-Frame-Options: ' . $Xframe_options);
if ($CORS_debug > 0)
# add $Xframe_options if defined
if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|\n");
fclose($fp);
header('X-Frame-Options: ' . $Xframe_options);
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n");
fclose($fp);
}
}
}
}
?>
agc_2-X/trunk/www/vicidial/adminCORS.php
+62 -60
View File
@@ -25,54 +25,71 @@
$NOW_TIME = date("Y-m-d H:i:s");
if (strlen($php_script) < 1)
{exit;}
$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
if ($CORS_debug > 0)
{$donothing=1;}
else
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
fclose($fp);
}
$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
fclose($fp);
}
}
else
{
# check for affected scripts match (--ALL--, one-of-many)
#if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
if (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts))
{
# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
{
header('Access-Control-Allow-Origin: ' . $CORS_origin);
header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
if (strlen($CORS_allowed_headers) > 0)
# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
fclose($fp);
}
}
else
{
# check for affected scripts match (--ALL--, one-of-many)
#if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
if (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts))
{
# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
{
header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
header('Access-Control-Allow-Origin: ' . $CORS_origin);
header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
if (strlen($CORS_allowed_headers) > 0)
{
header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
}
if ($CORS_allowed_credentials == 'Y')
{
header('Access-Control-Allow-Credentials: true');
}
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
if ($CORS_allowed_credentials == 'Y')
else
{
header('Access-Control-Allow-Credentials: true');
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
if ($CORS_debug > 0)
# For OPTIONS preflight requests, exit without processing the script further
if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
flush();
die();
}
}
else
@@ -80,36 +97,21 @@ else
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
fclose($fp);
}
}
# For OPTIONS preflight requests, exit without processing the script further
if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
{
flush();
die();
}
}
else
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
fclose($fp);
}
}
# add $Xframe_options if defined
if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
{
header('X-Frame-Options: ' . $Xframe_options);
if ($CORS_debug > 0)
# add $Xframe_options if defined
if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n");
fclose($fp);
header('X-Frame-Options: ' . $Xframe_options);
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n");
fclose($fp);
}
}
}
}