From 0e664cc9694bd75af03641d148101e0d6ac011d0 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 15 Feb 2022 11:12:08 +0100 Subject: [PATCH] Fix API call from ajax --- htdocs/api/index.php | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/htdocs/api/index.php b/htdocs/api/index.php index d19754f9c35..869dacc5cc0 100644 --- a/htdocs/api/index.php +++ b/htdocs/api/index.php @@ -55,12 +55,27 @@ if (!empty($_SERVER['HTTP_DOLAPIENTITY'])) { define("DOLENTITY", (int) $_SERVER['HTTP_DOLAPIENTITY']); } +// Response for preflight requests (used by browser when into a CORS context) +if (!empty($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'OPTIONS' && !empty($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) { + header('Access-Control-Allow-Origin: *'); + header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); + header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); + http_response_code(204); + exit; +} + // When we request url to get the json file, we accept Cross site so we can include the descriptor into an external tool. if (preg_match('/\/explorer\/swagger\.json/', $_SERVER["PHP_SELF"])) { header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); } +// When we request url to get an API, we accept Cross site so we can make js API call inside another website +if (preg_match('/\/api\/index\.php/', $_SERVER["PHP_SELF"])) { + header('Access-Control-Allow-Origin: *'); + header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); + header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); +} $res = 0; if (!$res && file_exists("../main.inc.php")) { @@ -304,7 +319,7 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' && foreach ($listofendpoints as $endpointrule) { $tmparray = explode(':', $endpointrule); - if ($classfile == $tmparray[0] && $tmparray[1] == 1) { + if (($classfile == $tmparray[0] || $classfile.'api' == $tmparray[0]) && $tmparray[1] == 1) { $endpointisallowed = true; break; }