Fix multi(sub)domain support

diff --git a/wcfsetup/install/files/js/WCF.js b/wcfsetup/install/files/js/WCF.js
index a77244604baa25d83ca8bb4c9b8bf4c323581ba5..74cddd02af11a99198ac7d9bc01151821a43c08b 100755 (executable)
--- a/wcfsetup/install/files/js/WCF.js
+++ b/wcfsetup/install/files/js/WCF.js
@@ -1547,6 +1547,7 @@ WCF.Action.Proxy = Class.extend({
                                        data: options.data,
                                        type: options.type,
                                        url: options.url,
+                                       withCredentials: (options.url === 'index.php?ajax-proxy/&t=' + SECURITY_TOKEN),
                                        responseType: (options.dataType === 'json' ? 'application/json' : ''),
                                        
                                        autoAbort: options.autoAbortPrevious,

diff --git a/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax.js b/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax.js
index b419e373cba3265b3a2895fc189716fe79a1e696..ba449226b330780cee4112ce89f6d94ada6a82a4 100644 (file)
--- a/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax.js
+++ b/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax.js
@@ -39,7 +39,10 @@ define(['AjaxRequest', 'Core', 'ObjectMap'], function(AjaxRequest, Core, ObjectM
                                options.pinData = true;
                                options.callbackObject = callbackObject;
                                
-                               if (!options.url) options.url = 'index.php?ajax-proxy/&t=' + SECURITY_TOKEN;
+                               if (!options.url) {
+                                       options.url = 'index.php?ajax-proxy/&t=' + SECURITY_TOKEN;
+                                       options.withCredentials = true;
+                               }
                                
                                request = new AjaxRequest(options);
                                
@@ -82,7 +85,10 @@ define(['AjaxRequest', 'Core', 'ObjectMap'], function(AjaxRequest, Core, ObjectM
                        
                        options.pinData = false;
                        options.callbackObject = null;
-                       if (!options.url) options.url = 'index.php?ajax-proxy/&t=' + SECURITY_TOKEN;
+                       if (!options.url) {
+                               options.url = 'index.php?ajax-proxy/&t=' + SECURITY_TOKEN;
+                               options.withCredentials = true;
+                       }
                        
                        var request = new AjaxRequest(options);
                        request.sendRequest();

diff --git a/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax/Request.js b/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax/Request.js
index 6bab12a61899d3535400359722ec7fe545abe15d..f8010ad16ddff2ccffe81dbb7928b5b55dab7887 100644 (file)
--- a/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax/Request.js
+++ b/wcfsetup/install/files/js/WoltLabSuite/Core/Ajax/Request.js
@@ -39,6 +39,7 @@ define(['Core', 'Language', 'Dom/ChangeListener', 'Dom/Util', 'Ui/Dialog', 'Wolt
                                responseType: 'application/json',
                                type: 'POST',
                                url: '',
+                               withCredentials: false,
                                
                                // behavior
                                autoAbort: false,
@@ -108,6 +109,9 @@ define(['Core', 'Language', 'Dom/ChangeListener', 'Dom/Util', 'Ui/Dialog', 'Wolt
                                this._xhr.setRequestHeader('Content-Type', this._options.contentType);
                        }
                        this._xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+                       if (this._options.withCredentials) {
+                               this._xhr.withCredentials = true;
+                       }
                        
                        var self = this;
                        var options = Core.clone(this._options);

diff --git a/wcfsetup/install/files/lib/system/WCF.class.php b/wcfsetup/install/files/lib/system/WCF.class.php
index 166ccef8398410f8c931c932841fc1add6c81313..79704154d43b2864f01636cfc50f24cebf74f52b 100644 (file)
--- a/wcfsetup/install/files/lib/system/WCF.class.php
+++ b/wcfsetup/install/files/lib/system/WCF.class.php
@@ -27,6 +27,7 @@ use wcf\system\language\LanguageFactory;
 use wcf\system\package\PackageInstallationDispatcher;
 use wcf\system\request\Request;
 use wcf\system\request\RequestHandler;
+use wcf\system\request\RouteHandler;
 use wcf\system\session\SessionFactory;
 use wcf\system\session\SessionHandler;
 use wcf\system\style\StyleHandler;
@@ -152,6 +153,7 @@ class WCF {
                $this->initCronjobs();
                $this->initCoreObjects();
                $this->initApplications();
+               $this->initCors();
                $this->initBlacklist();
                
                EventHandler::getInstance()->fireAction($this, 'initialized');
@@ -443,6 +445,36 @@ class WCF {
                }
        }
        
+       /**
+        * Responds with proper CORS headers.
+        */
+       protected function initCors() {
+               // Nothing to do here.
+               if (!isset($_SERVER['HTTP_ORIGIN'])) return;
+               
+               $allowed = array_reduce(ApplicationHandler::getInstance()->getApplications(), function ($carry, $item) {
+                       if ($_SERVER['HTTP_ORIGIN'] == RouteHandler::getProtocol().$item->domainName) return true;
+                       
+                       return $carry;
+               }, false);
+               
+               if (!$allowed) return;
+               
+               header('Access-Control-Allow-Origin: '.$_SERVER['HTTP_ORIGIN']);
+               header('Access-Control-Allow-Credentials: true');
+               header('Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers');
+               
+               if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+                       if (!isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) return;
+                       if (!isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) return;
+                       
+                       header('Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS');
+                       header('Access-Control-Allow-Headers: '.$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']);
+                       header('Access-Control-Max-Age: 5');
+                       exit;
+               }
+       }
+       
        /**
         * Initializes applications.
         */

diff --git a/wcfsetup/install/files/lib/system/WCFACP.class.php b/wcfsetup/install/files/lib/system/WCFACP.class.php
index f2cb24d6e0ad6c0062803a92e7c52b9980b2c974..f5982be89d7104b03962de7f5dd0cc201ef4500c 100644 (file)
--- a/wcfsetup/install/files/lib/system/WCFACP.class.php
+++ b/wcfsetup/install/files/lib/system/WCFACP.class.php
@@ -65,6 +65,7 @@ class WCFACP extends WCF {
                        $this->initApplications();
                }
                
+               $this->initCors();
                $this->initBlacklist();
                $this->initAuth();