AI_Assistant/grid-apps-cmms
Watch
1
0
Fork
You've already forked grid-apps-cmms
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add explicit app control over cross-origin permissions

Browse source
This commit is contained in:
Stewart Allen 2022-09-23 12:55:14 -04:00
commit bfb105973c
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
app.js
View file

@ -22,6 +22,7 @@ const load = [];
const synth = {}; const synth = {};
const api = {}; const api = {};
let crossOrigin = false;
let setupFn; let setupFn;
let cacheDir; let cacheDir;
let startTime; let startTime;
@ -52,6 +53,7 @@ function init(mod) {
logger = mod.log; logger = mod.log;
debug = mod.env.debug || mod.meta.debug; debug = mod.env.debug || mod.meta.debug;
oversion = mod.env.over || mod.meta.over; oversion = mod.env.over || mod.meta.over;
crossOrigin = mod.env.xorigin || mod.meta.xorigin || false;
http = mod.http; http = mod.http;
util = mod.util; util = mod.util;
dir = mod.dir; dir = mod.dir;
@ -297,7 +299,8 @@ function initModule(mod, file, dir) {
api: api, api: api,
adm: { adm: {
reload: prepareScripts, reload: prepareScripts,
setver: (ver) => { oversion = ver } setver: (ver) => { oversion = ver },
crossOrigin: (bool) => { crossOrigin = bool }
}, },
events, events,
const: { const: {
@ -738,8 +741,10 @@ function addCorsHeaders(req, res) {
res.setHeader('Access-Control-Allow-Credentials', 'true'); res.setHeader('Access-Control-Allow-Credentials', 'true');
res.setHeader('Access-Control-Allow-Headers', 'X-Moto-Ajax, Content-Type'); res.setHeader('Access-Control-Allow-Headers', 'X-Moto-Ajax, Content-Type');
res.setHeader('Access-Control-Allow-Origin', req.headers['origin'] || '*'); res.setHeader('Access-Control-Allow-Origin', req.headers['origin'] || '*');
res.setHeader("Cross-Origin-Opener-Policy", 'same-origin'); if (!crossOrigin) {
res.setHeader("Cross-Origin-Embedder-Policy", 'require-corp'); res.setHeader("Cross-Origin-Opener-Policy", 'same-origin');
res.setHeader("Cross-Origin-Embedder-Policy", 'require-corp');
}
res.setHeader("Allow", "GET,POST,OPTIONS"); res.setHeader("Allow", "GET,POST,OPTIONS");
} }