From 8d178ff529ff80f0d3276a56b24cac5126c62ce3 Mon Sep 17 00:00:00 2001 From: mattf Date: Fri, 18 Jun 2021 19:34:48 +0000 Subject: [PATCH] Minor issue fix for CORS support git-svn-id: svn://192.168.202.10@3461 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/docs/CORS_SUPPORT.txt | 4 +- agc_2-X/trunk/www/agc/agentCORS.php | 121 +++++++++++----------- agc_2-X/trunk/www/vicidial/adminCORS.php | 122 ++++++++++++----------- 3 files changed, 125 insertions(+), 122 deletions(-) diff --git a/agc_2-X/trunk/docs/CORS_SUPPORT.txt b/agc_2-X/trunk/docs/CORS_SUPPORT.txt index 5ed39f82..7dcd1c23 100644 --- a/agc_2-X/trunk/docs/CORS_SUPPORT.txt +++ b/agc_2-X/trunk/docs/CORS_SUPPORT.txt @@ -23,7 +23,7 @@ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options VICIDIAL AGENT WEB SCREEN SCRIPTS SUPPORT: -Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following configurable variables to the "agc/options.php" file on your webserver: +Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3461) with the addition of the "agentCORS.php" file and the addition of the following configurable variables to the "agc/options.php" file on your webserver: (NOTE: If you have never set up an "agc/options.php" file on your webserver before, just use a copy the file "agc/options-example.php") @@ -52,7 +52,7 @@ NOTES: VICIDIAL ADMIN WEB SCREEN SCRIPTS SUPPORT: -The implementation of CORS on tha admin side is very similar to the agent side, except only a limited number of admin PHP scripts are CORS-enabled at this time, and there is no '--ALL--' option for the $CORS_affected_scripts variable, so you must include every script you want to have CORS enabled on for the admin side in that variable. Support for CORS configuration for these limited admin "vicidial" web directory PHP scripts was added on 2021-06-18(svn/trunk revision 3460) with the addition of the "adminCORS.php" file and the addition of the following configurable variables to the "vicidial/options.php" file on your webserver: +The implementation of CORS on tha admin side is very similar to the agent side, except only a limited number of admin PHP scripts are CORS-enabled at this time, and there is no '--ALL--' option for the $CORS_affected_scripts variable, so you must include every script you want to have CORS enabled on for the admin side in that variable. Support for CORS configuration for these limited admin "vicidial" web directory PHP scripts was added on 2021-06-18(svn/trunk revision 3461) with the addition of the "adminCORS.php" file and the addition of the following configurable variables to the "vicidial/options.php" file on your webserver: (NOTE: If you have never set up an "vicidial/options.php" file on your webserver before, just use a copy the file "vicidial/options-example.php") List of CORS-enabled admin("vicidial") PHP scripts: diff --git a/agc_2-X/trunk/www/agc/agentCORS.php b/agc_2-X/trunk/www/agc/agentCORS.php index d1b868ba..510f84f0 100644 --- a/agc_2-X/trunk/www/agc/agentCORS.php +++ b/agc_2-X/trunk/www/agc/agentCORS.php @@ -25,53 +25,70 @@ $NOW_TIME = date("Y-m-d H:i:s"); if (strlen($php_script) < 1) - {exit;} - -$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server -$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one -$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below - -if ($CORS_debug > 0) + {$donothing=1;} +else { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n"); - fclose($fp); - } + $CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server + $CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one + $CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below -# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing -if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) ) - { if ($CORS_debug > 0) { $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n"); + fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n"); fclose($fp); } - } -else - { - # check for affected scripts match (--ALL--, one-of-many) - if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') ) - { - # check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many) - if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) ) - { - header('Access-Control-Allow-Origin: ' . $CORS_origin); - header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods); - if (strlen($CORS_allowed_headers) > 0) + # if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing + if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) ) + { + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n"); + fclose($fp); + } + } + else + { + # check for affected scripts match (--ALL--, one-of-many) + if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') ) + { + # check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many) + if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) ) { - header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers); + header('Access-Control-Allow-Origin: ' . $CORS_origin); + header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods); + + if (strlen($CORS_allowed_headers) > 0) + { + header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers); + } + if ($CORS_allowed_credentials == 'Y') + { + header('Access-Control-Allow-Credentials: true'); + } + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); + fclose($fp); + } } - if ($CORS_allowed_credentials == 'Y') + else { - header('Access-Control-Allow-Credentials: true'); + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); + fclose($fp); + } } - if ($CORS_debug > 0) + # For OPTIONS preflight requests, exit without processing the script further + if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) ) { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n"); - fclose($fp); + flush(); + die(); } } else @@ -79,38 +96,22 @@ else if ($CORS_debug > 0) { $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n"); + fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n"); fclose($fp); } } - # For OPTIONS preflight requests, exit without processing the script further - if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) ) - { - flush(); - die(); - } - } - else - { - if ($CORS_debug > 0) - { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n"); - fclose($fp); - } - } - # add $Xframe_options if defined - if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') ) - { - header('X-Frame-Options: ' . $Xframe_options); - if ($CORS_debug > 0) + # add $Xframe_options if defined + if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') ) { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|\n"); - fclose($fp); + header('X-Frame-Options: ' . $Xframe_options); + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n"); + fclose($fp); + } } } } - ?> \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/adminCORS.php b/agc_2-X/trunk/www/vicidial/adminCORS.php index edf9e685..424de851 100644 --- a/agc_2-X/trunk/www/vicidial/adminCORS.php +++ b/agc_2-X/trunk/www/vicidial/adminCORS.php @@ -25,54 +25,71 @@ $NOW_TIME = date("Y-m-d H:i:s"); if (strlen($php_script) < 1) - {exit;} - -$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server -$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one -$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below - -if ($CORS_debug > 0) + {$donothing=1;} +else { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n"); - fclose($fp); - } + $CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server + $CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one + $CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below -# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing -if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) ) - { if ($CORS_debug > 0) { $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n"); + fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n"); fclose($fp); } - } -else - { - # check for affected scripts match (--ALL--, one-of-many) - #if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') ) - if (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) - { - # check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many) - if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) ) - { - header('Access-Control-Allow-Origin: ' . $CORS_origin); - header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods); - if (strlen($CORS_allowed_headers) > 0) + # if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing + if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) ) + { + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n"); + fclose($fp); + } + } + else + { + # check for affected scripts match (--ALL--, one-of-many) + #if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') ) + if (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) + { + # check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many) + if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) ) { - header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers); + header('Access-Control-Allow-Origin: ' . $CORS_origin); + header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods); + + if (strlen($CORS_allowed_headers) > 0) + { + header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers); + } + if ($CORS_allowed_credentials == 'Y') + { + header('Access-Control-Allow-Credentials: true'); + } + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); + fclose($fp); + } } - if ($CORS_allowed_credentials == 'Y') + else { - header('Access-Control-Allow-Credentials: true'); + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); + fclose($fp); + } } - if ($CORS_debug > 0) + # For OPTIONS preflight requests, exit without processing the script further + if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) ) { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); - fclose($fp); + flush(); + die(); } } else @@ -80,36 +97,21 @@ else if ($CORS_debug > 0) { $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n"); + fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n"); fclose($fp); } } - # For OPTIONS preflight requests, exit without processing the script further - if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) ) - { - flush(); - die(); - } - } - else - { - if ($CORS_debug > 0) - { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n"); - fclose($fp); - } - } - # add $Xframe_options if defined - if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') ) - { - header('X-Frame-Options: ' . $Xframe_options); - if ($CORS_debug > 0) + # add $Xframe_options if defined + if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') ) { - $fp = fopen ("./CORSdebug_log.txt", "a"); - fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n"); - fclose($fp); + header('X-Frame-Options: ' . $Xframe_options); + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n"); + fclose($fp); + } } } }