Changeset 21988

Timestamp:

09/24/2012 09:39:04 PM (12 years ago)

Author:

ryan

Message:

Handle pre-flighted OPTIONS requests in send_origin_headers(). Props nacin. fixes #21024

File:

• trunk/wp-includes/http.php (modified) (2 diffs)

trunk/wp-includes/http.php

@@ -285 +285 @@
  * is from an allowed origin.
  *
+ * If the request is an OPTIONS request, the script exits with either access
+ * control headers sent, or a 403 response if the origin is not allowed. For
+ * other request methods, you will receive a return value.
+ *
  * @since 3.4.0
  *
@@ -292 +296 @@
 function send_origin_headers() {
     $origin = get_http_origin();
-    if ( ! is_allowed_http_origin( $origin ) )
-        return false;
-
-    @header( 'Access-Control-Allow-Origin: ' .  $origin );
-    @header( 'Access-Control-Allow-Credentials: true' );
-
-    return $origin;
-}
+
+    if ( is_allowed_http_origin( $origin ) ) {
+        @header( 'Access-Control-Allow-Origin: ' .  $origin );
+        @header( 'Access-Control-Allow-Credentials: true' );
+        if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
+            exit;
+        return $origin;
+    }
+
+    if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
+        status_header( 403 );
+        exit;
+    }
+
+    return false;
+}