From b69ff36ddb2dc59d4699fd0a86d188c2513faaf6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Ba=C4=8Do?= Date: Mon, 23 Jun 2025 11:57:06 +0200 Subject: [PATCH] Manual QA fixes --- app/controllers/general.php | 7 ++++--- app/init/resources.php | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/app/controllers/general.php b/app/controllers/general.php index a47ae510fa..3745a41c9a 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -1055,8 +1055,7 @@ App::options() ->inject('project') ->inject('devKey') ->inject('apiKey') - ->inject('httpReferrerSafe') - ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, string $httpReferrerSafe) { + ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey) { /* * Appwrite Router */ @@ -1069,12 +1068,14 @@ App::options() } } + $origin = $request->getOrigin(); + $response ->addHeader('Server', 'Appwrite') ->addHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE') ->addHeader('Access-Control-Allow-Headers', 'Origin, Cookie, Set-Cookie, X-Requested-With, Content-Type, Access-Control-Allow-Origin, Access-Control-Request-Headers, Accept, X-Appwrite-Project, X-Appwrite-Key, X-Appwrite-Dev-Key, X-Appwrite-Locale, X-Appwrite-Mode, X-Appwrite-JWT, X-Appwrite-Response-Format, X-Appwrite-Timeout, X-SDK-Version, X-SDK-Name, X-SDK-Language, X-SDK-Platform, X-SDK-GraphQL, X-Appwrite-ID, X-Appwrite-Timestamp, Content-Range, Range, Cache-Control, Expires, Pragma, X-Appwrite-Session, X-Fallback-Cookies, X-Forwarded-For, X-Forwarded-User-Agent') ->addHeader('Access-Control-Expose-Headers', 'X-Appwrite-Session, X-Fallback-Cookies') - ->addHeader('Access-Control-Allow-Origin', $httpReferrerSafe) + ->addHeader('Access-Control-Allow-Origin', $origin) ->addHeader('Access-Control-Allow-Credentials', 'true') ->noContent(); diff --git a/app/init/resources.php b/app/init/resources.php index eb77598adc..18203869df 100644 --- a/app/init/resources.php +++ b/app/init/resources.php @@ -953,9 +953,9 @@ App::setResource('httpReferrer', function (Request $request): string { App::setResource('httpReferrerSafe', function (Request $request, string $httpReferrer, array $clients, Database $dbForPlatform, Document $project, App $utopia): string { $origin = \parse_url($request->getOrigin($httpReferrer), PHP_URL_HOST); - // Safe if route is public + // Safe if route is publicly accessible $route = $utopia->getRoute(); - if (!$route->getLabel('origin', false)) { + if ($route->getLabel('origin', false)) { goto originToUrl; }