From: Alexander Ebert <ebert@woltlab.com>
Date: Thu, 15 Dec 2016 12:59:16 +0000 (+0100)
Subject: Avoid CORS by mirroring API endpoints
X-Git-Tag: 3.0.0_RC_2~49
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=5d1c96bc6e92b8b44170922b8abb26b898582f8c;p=GitHub%2FWoltLab%2FWCF.git

Avoid CORS by mirroring API endpoints
---

diff --git a/com.woltlab.wcf/templates/headIncludeJavaScript.tpl b/com.woltlab.wcf/templates/headIncludeJavaScript.tpl
index 91df60c4f5..7dfb376b97 100644
--- a/com.woltlab.wcf/templates/headIncludeJavaScript.tpl
+++ b/com.woltlab.wcf/templates/headIncludeJavaScript.tpl
@@ -5,7 +5,7 @@
 <script>
 	var SID_ARG_2ND	= '';
 	var WCF_PATH = '{@$__wcf->getPath()}';
-	var WSC_API_URL = '{@$__wcf->getPath()}';
+	var WSC_API_URL = '{@$__wcf->getActivePath()}';
 	var SECURITY_TOKEN = '{@SECURITY_TOKEN}';
 	var LANGUAGE_ID = {@$__wcf->getLanguage()->languageID};
 	var LANGUAGE_USE_INFORMAL_VARIANT = {if LANGUAGE_USE_INFORMAL_VARIANT}true{else}false{/if};
diff --git a/wcfsetup/install/files/acp/templates/header.tpl b/wcfsetup/install/files/acp/templates/header.tpl
index 36e978405d..09407f1ddc 100644
--- a/wcfsetup/install/files/acp/templates/header.tpl
+++ b/wcfsetup/install/files/acp/templates/header.tpl
@@ -18,7 +18,7 @@
 	<script>
 		var SID_ARG_2ND = '';
 		var WCF_PATH = '{@$__wcf->getPath()}';
-		var WSC_API_URL = '{@$__wcf->getPath()}acp/';
+		var WSC_API_URL = '{@$__wcf->getActivePath()}acp/';
 		var SECURITY_TOKEN = '{@SECURITY_TOKEN}';
 		var LANGUAGE_ID = {@$__wcf->getLanguage()->languageID};
 		var LANGUAGE_USE_INFORMAL_VARIANT = {if LANGUAGE_USE_INFORMAL_VARIANT}true{else}false{/if};
diff --git a/wcfsetup/install/files/lib/system/WCF.class.php b/wcfsetup/install/files/lib/system/WCF.class.php
index 28d70129b5..a74ec00388 100644
--- a/wcfsetup/install/files/lib/system/WCF.class.php
+++ b/wcfsetup/install/files/lib/system/WCF.class.php
@@ -147,7 +147,6 @@ class WCF {
 		// start initialization
 		$this->initDB();
 		$this->loadOptions();
-		$this->initCors();
 		$this->initSession();
 		$this->initLanguage();
 		$this->initTPL();
@@ -445,36 +444,6 @@ class WCF {
 		}
 	}
 	
-	/**
-	 * Responds with proper CORS headers.
-	 */
-	protected function initCors() {
-		// Nothing to do here.
-		if (!isset($_SERVER['HTTP_ORIGIN'])) return;
-		
-		$allowed = array_reduce(ApplicationHandler::getInstance()->getApplications(), function ($carry, $item) {
-			if ($_SERVER['HTTP_ORIGIN'] == RouteHandler::getProtocol().$item->domainName) return true;
-			
-			return $carry;
-		}, false);
-		
-		if (!$allowed) return;
-		
-		header('Access-Control-Allow-Origin: '.$_SERVER['HTTP_ORIGIN']);
-		header('Access-Control-Allow-Credentials: true');
-		header('Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers');
-		
-		if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-			if (!isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) return;
-			if (!isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) return;
-			
-			header('Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS');
-			header('Access-Control-Allow-Headers: '.$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']);
-			header('Access-Control-Max-Age: 5');
-			exit;
-		}
-	}
-	
 	/**
 	 * Initializes applications.
 	 */
@@ -822,6 +791,20 @@ class WCF {
 		return self::$applications[$abbreviation]->getPageURL();
 	}
 	
+	/**
+	 * Returns the domain path for the currently active application,
+	 * used to avoid CORS requests.
+	 * 
+	 * @return      string
+	 */
+	public static function getActivePath() {
+		if (!PACKAGE_ID) {
+			return self::getPath();
+		}
+		
+		return self::getPath(ApplicationHandler::getInstance()->getAbbreviation(ApplicationHandler::getInstance()->getActiveApplication()->packageID));
+	}
+	
 	/**
 	 * Returns a fully qualified anchor for current page.
 	 * 
diff --git a/wcfsetup/install/files/lib/system/WCFACP.class.php b/wcfsetup/install/files/lib/system/WCFACP.class.php
index c8f2984135..f2cb24d6e0 100644
--- a/wcfsetup/install/files/lib/system/WCFACP.class.php
+++ b/wcfsetup/install/files/lib/system/WCFACP.class.php
@@ -53,7 +53,6 @@ class WCFACP extends WCF {
 		// start initialization
 		$this->initDB();
 		$this->loadOptions();
-		$this->initCors();
 		$this->initPackage();
 		$this->initSession();
 		$this->initLanguage();
diff --git a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
index 99f27da6d1..068d03b930 100644
--- a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
+++ b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
@@ -72,8 +72,10 @@ class ControllerMap extends SingletonFactory {
 			$parts = array_map('ucfirst', $parts);
 			$controller = implode('', $parts);
 			
-			// work-around for upgrade path 2.1 -> 3.0
+			// work-around for legacy action controllers for upgrade and CORS avoidance
 			if ($controller === 'AjaxProxy') $controller = 'AJAXProxy';
+			else if ($controller === 'AjaxUpload') $controller = 'AJAXUpload';
+			else if ($controller === 'AjaxInvoke') $controller = 'AJAXInvoke';
 			
 			// work-around for package installation during upgrade 2.1 -> 3.0
 			if ($isAcpRequest && $controller === 'InstallPackage') $application = 'wcf';
@@ -329,7 +331,16 @@ class ControllerMap extends SingletonFactory {
 	protected function getClassData($application, $controller, $isAcpRequest, $pageType) {
 		$className = $application . '\\' . ($isAcpRequest ? 'acp\\' : '') . $pageType . '\\' . $controller . ucfirst($pageType);
 		if (!class_exists($className)) {
-			return null;
+			// avoid CORS by allowing action classes invoked form every application domain
+			if ($pageType === 'action' && $application !== 'wcf') {
+				$className = 'wcf\\' . ($isAcpRequest ? 'acp\\' : '') . $pageType . '\\' . $controller . ucfirst($pageType);
+				if (!class_exists($className)) {
+					return null;
+				}
+			}
+			else {
+				return null;
+			}
 		}
 		
 		// check for abstract classes