Changeset 40600

Timestamp:

05/10/2017 04:22:01 AM (9 years ago)

Author:

rmccue

Message:

REST API: Allow "Origin: null" from file: URLs.

Browsers send an "Origin: null" header value for file and data URLs, as they can be generated by any document, and their origin is not guaranteed. Since we want to allow any URL to access the API (intentionally disabling the CORS protections), we need to special-case the non-URL "null" value.

Props joehoyle.
Fixes #40011.

File:

• trunk/src/wp-includes/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/rest-api.php

@@ -526 +526 @@
 
         if ( $origin ) {
-                header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
+                // Requests from file:// and data: URLs send "Origin: null"
+                if ( 'null' !== $origin ) {
+                        $origin = esc_url_raw( $origin );
+                }
+                header( 'Access-Control-Allow-Origin: ' . $origin );
                 header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
                 header( 'Access-Control-Allow-Credentials: true' );