Ticket #45477: 45477.diff

package-lock.json

@@ -1 +1 @@
 {
         "name": "WordPress",
-        "version": "5.0.0",
+        "version": "5.1.0",
         "lockfileVersion": 1,
         "requires": true,
         "dependencies": {
@@ -3643 +3643 @@
                                         "version": "1.0.5",
                                         "bundled": true,
                                         "dev": true,
+                                        "optional": true,
                                         "requires": {
                                                 "delayed-stream": "~1.0.0"
                                         }
@@ -3705 +3706 @@
                                 "delayed-stream": {
                                         "version": "1.0.0",
                                         "bundled": true,
-                                        "dev": true
+                                        "dev": true,
+                                        "optional": true
                                 },
                                 "delegates": {
                                         "version": "1.0.0",
@@ -3993 +3995 @@
                                 "mime-db": {
                                         "version": "1.27.0",
                                         "bundled": true,
-                                        "dev": true
+                                        "dev": true,
+                                        "optional": true
                                 },
                                 "mime-types": {
                                         "version": "2.1.15",
                                         "bundled": true,
                                         "dev": true,
+                                        "optional": true,
                                         "requires": {
                                                 "mime-db": "~1.27.0"
                                         }
@@ -4074 +4078 @@
                                 "number-is-nan": {
                                         "version": "1.0.1",
                                         "bundled": true,
-                                        "dev": true
+                                        "dev": true,
+                                        "optional": true
                                 },
                                 "oauth-sign": {
                                         "version": "0.8.2",

src/wp-includes/rest-api.php

@@ -527 +527 @@
 
 /**
  * Sends Cross-Origin Resource Sharing headers with API requests.
- *
+ * 
+ * Note: Any incoming Origin URL is verified against a safe-list of Origins
+ * using the Allowed Origin API, before these headers are sent.
+ * {@see 'allowed_http_origins'} filter on how to add an Origin to this list 
+ * 
  * @since 4.4.0
  *
  * @param mixed $value Response data.
@@ -535 +539 @@
  */
 function rest_send_cors_headers( $value ) {
         $origin = get_http_origin();
-
-        if ( $origin ) {
+        $allowed_origins = get_allowed_http_origins();
+        if ( $origin && in_array( $origin, $allowed_origins ) {
                 // Requests from file:// and data: URLs send "Origin: null"
                 if ( 'null' !== $origin ) {
                         $origin = esc_url_raw( $origin );