Re: com web/php: Fix potential Access-Control-Allow-Origin bug in vote-note.php - Bug #65887: manual/vote-note.php

On Tue, Dec 10, 2013 at 2:41 PM, Sherif Ramadan <theanomaly.is@gmail.com> wrote: > > > > On Tue, Dec 10, 2013 at 5:30 PM, Hannes Magnusson > <hannes.magnusson@gmail.com> wrote: >> >> On Tue, Dec 10, 2013 at 1:55 PM, Sherif Ramadan <googleguy@php.net> wrote: >> > Commit: 540872824575ecfcdf42511a7784ccbd1d3f4e13 >> > Author: Sherif Ramadan <googleguy@php.net> Tue, 10 Dec 2013 >> > 16:55:48 -0500 >> > Parents: 92aa114f859b695b82743feba122a3b27a6925a7 >> > Branches: master >> > >> > Link: >> > >> > http://git.php.net/?p=web/php.git;a=commitdiff;h=540872824575ecfcdf42511a7784ccbd1d3f4e13 >> > >> > Log: >> > Fix potential Access-Control-Allow-Origin bug in vote-note.php - Bug >> > #65887 >> > >> >> Hmmmh... I already added this to prepend.inc, which this page is >> including.. Is that fix not working? >> I think its better to fix it there then specifically for this page only. >> >> -Hannes > > > > Apparently I did not see that. Your fix seems to be relying > $_SERVER["HTTP_ORIGIN"], but when the request comes from > http://php.net the > Access-Control-Allow-Origin response header is always > 'http://', which the > UA does not accept. Well.. That fix fixed the problem of loading javascript resources (such as autocopmlete) from http://www.php.net when accessing http://php.net So I'm uncertain what exactly you mean by "response header is always 'http://'" ? -Hannes