Skip to content

Commit 34d06f4

Browse files
tamalsahatechknowlogick
tamalsaha
authored and
techknowlogick
committed
Handle CORS requests (#6289)
1 parent 6fb58a8 commit 34d06f4

File tree

170 files changed

+5220
-2124
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

170 files changed

+5220
-2124
lines changed

‎custom/conf/app.ini.sample

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,23 @@ WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
7474
; List of reasons why a Pull Request or Issue can be locked
7575
LOCK_REASONS=Too heated,Off-topic,Resolved,Spam
7676

77+
[cors]
78+
; More information about CORS can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#The_HTTP_response_headers
79+
; enable cors headers (disabled by default)
80+
ENABLED=false
81+
; scheme of allowed requests
82+
SCHEME=http
83+
; list of requesting domains that are allowed
84+
ALLOW_DOMAIN=*
85+
; allow subdomains of headers listed above to request
86+
ALLOW_SUBDOMAIN=false
87+
; list of methods allowed to request
88+
METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
89+
; max time to cache response
90+
MAX_AGE=10m
91+
; allow request with credentials
92+
ALLOW_CREDENTIALS=false
93+
7794
[ui]
7895
; Number of repositories that are displayed on one explore page
7996
EXPLORE_PAGING_NUM = 20

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,16 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`.
7676

7777
- `LOCK_REASONS`: **Too heated,Off-topic,Resolved,Spam**: A list of reasons why a Pull Request or Issue can be locked
7878

79+
## CORS (`cors`)
80+
81+
- `ENABLED`: **false**: enable cors headers (disabled by default)
82+
- `SCHEME`: **http**: scheme of allowed requests
83+
- `ALLOW_DOMAIN`: **\***: list of requesting domains that are allowed
84+
- `ALLOW_SUBDOMAIN`: **false**: allow subdomains of headers listed above to request
85+
- `METHODS`: **GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS**: list of methods allowed to request
86+
- `MAX_AGE`: **10m**: max time to cache response
87+
- `ALLOW_CREDENTIALS`: **false**: allow request with credentials
88+
7989
## UI (`ui`)
8090

8191
- `EXPLORE_PAGING_NUM`: **20**: Number of repositories that are shown in one explore page.

‎go.mod

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ require (
77
github.com/PuerkitoBio/goquery v0.0.0-20170324135448-ed7d758e9a34
88
github.com/RoaringBitmap/roaring v0.4.7 // indirect
99
github.com/Unknwon/cae v0.0.0-20160715032808-c6aac99ea2ca
10-
github.com/Unknwon/com v0.0.0-20170819223952-7677a1d7c113
10+
github.com/Unknwon/com v0.0.0-20190321035513-0fed4efef755
1111
github.com/Unknwon/i18n v0.0.0-20171114194641-b64d33658966
1212
github.com/Unknwon/paginater v0.0.0-20151104151617-7748a72e0141
1313
github.com/andybalholm/cascadia v0.0.0-20161224141413-349dd0209470 // indirect
@@ -48,6 +48,7 @@ require (
4848
github.com/go-macaron/binding v0.0.0-20160711225916-9440f336b443
4949
github.com/go-macaron/cache v0.0.0-20151013081102-561735312776
5050
github.com/go-macaron/captcha v0.0.0-20151123225153-8aa5919789ab
51+
github.com/go-macaron/cors v0.0.0-20190309005821-6fd6a9bfe14e9
5152
github.com/go-macaron/csrf v0.0.0-20180426211211-503617c6b372
5253
github.com/go-macaron/i18n v0.0.0-20160612092837-ef57533c3b0f
5354
github.com/go-macaron/inject v0.0.0-20160627170012-d8a0b8677191
@@ -113,17 +114,17 @@ require (
113114
github.com/willf/bitset v0.0.0-20180426185212-8ce1146b8621 // indirect
114115
github.com/yohcop/openid-go v0.0.0-20160914080427-2c050d2dae53
115116
go.etcd.io/bbolt v1.3.2 // indirect
116-
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793
117+
golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480
117118
golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519
118119
golang.org/x/oauth2 v0.0.0-20181101160152-c453e0c75759
119-
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223
120+
golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e
120121
golang.org/x/text v0.3.0
121122
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
122123
gopkg.in/asn1-ber.v1 v1.0.0-20150924051756-4e86f4367175 // indirect
123124
gopkg.in/bufio.v1 v1.0.0-20140618132640-567b2bfa514e // indirect
124125
gopkg.in/editorconfig/editorconfig-core-go.v1 v1.2.0
125126
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
126-
gopkg.in/ini.v1 v1.31.1
127+
gopkg.in/ini.v1 v1.42.0
127128
gopkg.in/ldap.v3 v3.0.2
128129
gopkg.in/macaron.v1 v1.3.2
129130
gopkg.in/redis.v2 v2.3.2 // indirect
@@ -135,6 +136,6 @@ require (
135136
)
136137

137138
replace (
138-
github.com/denisenkom/go-mssqldb v0.0.0-20181014144952-4e0d7dc8888f => github.com/denisenkom/go-mssqldb v0.0.0-20161128230840-e32ca5036449
139-
github.com/go-sql-driver/mysql v1.4.0 => github.com/go-sql-driver/mysql v0.0.0-20181218123637-c45f530f8e7f
139+
github.com/denisenkom/go-mssqldb => github.com/denisenkom/go-mssqldb v0.0.0-20161128230840-e32ca5036449
140+
github.com/go-sql-driver/mysql => github.com/go-sql-driver/mysql v0.0.0-20181218123637-c45f530f8e7f
140141
)

‎go.sum

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ github.com/RoaringBitmap/roaring v0.4.7 h1:eGUudvFzvF7Kxh7JjYvXfI1f7l22/2duFby7r
77
github.com/RoaringBitmap/roaring v0.4.7/go.mod h1:8khRDP4HmeXns4xIj9oGrKSz7XTQiJx2zgh7AcNke4w=
88
github.com/Unknwon/cae v0.0.0-20160715032808-c6aac99ea2ca h1:xU8R31tsvj6TesCBog973+UgI3TXjh/LqN5clki6hcc=
99
github.com/Unknwon/cae v0.0.0-20160715032808-c6aac99ea2ca/go.mod h1:IRSre9/SEhVuy972TVuJLyaPTS73+8Owhe0Y0l9NXHc=
10-
github.com/Unknwon/com v0.0.0-20170819223952-7677a1d7c113 h1:YwXm6KwmrA5R5yJRhcnpqRUHmBXSKciHuWtK9zP5qKQ=
11-
github.com/Unknwon/com v0.0.0-20170819223952-7677a1d7c113/go.mod h1:KYCjqMOeHpNuTOiFQU6WEcTG7poCJrUs0YgyHNtn1no=
10+
github.com/Unknwon/com v0.0.0-20190321035513-0fed4efef755 h1:1B7wb36fHLSwZfHg6ngZhhtIEHQjiC5H4p7qQGBEffg=
11+
github.com/Unknwon/com v0.0.0-20190321035513-0fed4efef755/go.mod h1:voKvFVpXBJxdIPeqjoJuLK+UVcRlo/JLjeToGxPYu68=
1212
github.com/Unknwon/i18n v0.0.0-20171114194641-b64d33658966 h1:Mp8GNJ/tdTZIEdLdZfykEJaL3mTyEYrSzYNcdoQKpJk=
1313
github.com/Unknwon/i18n v0.0.0-20171114194641-b64d33658966/go.mod h1:SFtfq0zFPsENI7DpE87QM2hcYu5QQ0fRdCgP+P1Hrqo=
1414
github.com/Unknwon/paginater v0.0.0-20151104151617-7748a72e0141 h1:SSvHGK7iMpeypcHjI8UzNMz7zW/K8/dcgqk/82lCYP0=
@@ -105,6 +105,8 @@ github.com/go-macaron/cache v0.0.0-20151013081102-561735312776 h1:UYIHS1r0WotqB5
105105
github.com/go-macaron/cache v0.0.0-20151013081102-561735312776/go.mod h1:hHAsZm/oBZVcY+S7qdQL6Vbg5VrXF6RuKGuqsszt3Ok=
106106
github.com/go-macaron/captcha v0.0.0-20151123225153-8aa5919789ab h1:4VFhsA3GE5Wwq1Ymr8KWCmrOWi1wRLEgdj48LPfQjxI=
107107
github.com/go-macaron/captcha v0.0.0-20151123225153-8aa5919789ab/go.mod h1:j9TJ+0nwUOWBvNnm0bheHIPFf3cC62EQo7n7O6PbjZA=
108+
github.com/go-macaron/cors v0.0.0-20190309005821-6fd6a9bfe14e9 h1:A0QGzY6UHHEil0I2e7C21JenNNG0mmrj5d9SFWTlgr8=
109+
github.com/go-macaron/cors v0.0.0-20190309005821-6fd6a9bfe14e9/go.mod h1:utmMRnVIrXPSfA9MFcpIYKEpKawjKxf62vv62k4707E=
108110
github.com/go-macaron/csrf v0.0.0-20180426211211-503617c6b372 h1:acrx8CnDmlKl+BPoOOLEK9Ko+SrWFB5pxRuGkKj4iqo=
109111
github.com/go-macaron/csrf v0.0.0-20180426211211-503617c6b372/go.mod h1:oZGMxI7MBnicI0jJqJvH4qQzyrWKhtiKxLSJKHC+ydc=
110112
github.com/go-macaron/i18n v0.0.0-20160612092837-ef57533c3b0f h1:wDKrZFc9pYJlqFOf7EzGbFMrSFFtyHt3plr2uTdo8Rg=
@@ -148,6 +150,8 @@ github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASu
148150
github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
149151
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
150152
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
153+
github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
154+
github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
151155
github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
152156
github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
153157
github.com/gorilla/mux v1.6.2 h1:Pgr17XVTNXAk3q/r4CpKzC5xBM/qW1uVLV+IhRZpIIk=
@@ -178,6 +182,7 @@ github.com/jmhodges/levigo v1.0.0 h1:q5EC36kV79HWeTBWsod3mG11EgStG3qArTKcvlksN1U
178182
github.com/jmhodges/levigo v1.0.0/go.mod h1:Q6Qx+uH3RAqyK4rFQroq9RL7mdkABMcfhEI+nNuzMJQ=
179183
github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
180184
github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
185+
github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
181186
github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
182187
github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
183188
github.com/kballard/go-shellquote v0.0.0-20170619183022-cd60e84ee657 h1:vE7J1m7cCpiRVEIr1B5ccDxRpbPsWT5JU3if2Di5nE4=
@@ -281,6 +286,9 @@ github.com/siddontang/go-snappy v0.0.0-20140704025258-d8f7bb82a96d h1:qQWKKOvHN7
281286
github.com/siddontang/go-snappy v0.0.0-20140704025258-d8f7bb82a96d/go.mod h1:vq0tzqLRu6TS7Id0wMo2N5QzJoKedVeovOpHjnykSzY=
282287
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
283288
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
289+
github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
290+
github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
291+
github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
284292
github.com/smartystreets/goconvey v0.0.0-20190306220146-200a235640ff h1:86HlEv0yBCry9syNuylzqznKXDK11p6D0DT596yNMys=
285293
github.com/smartystreets/goconvey v0.0.0-20190306220146-200a235640ff/go.mod h1:KSQcGKpxUMHk3nbYzs/tIBAM2iDooCn0BmttHOJEbLs=
286294
github.com/src-d/gcfg v1.4.0 h1:xXbNR5AlLSA315x2UO+fTSSAXCDf+Ar38/6oyGbDKQ4=
@@ -316,6 +324,8 @@ go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
316324
golang.org/x/crypto v0.0.0-20180820150726-614d502a4dac/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
317325
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793 h1:u+LnwYTOOW7Ukr/fppxEb1Nwz0AtPflrblfvUudpo+I=
318326
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
327+
golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480 h1:O5YqonU5IWby+w98jVUG9h7zlCWCcH4RHyPVReBmhzk=
328+
golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
319329
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
320330
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
321331
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -332,6 +342,8 @@ golang.org/x/sys v0.0.0-20180903190138-2b024373dcd9/go.mod h1:STP8DvDyc/dI5b8T5h
332342
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
333343
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223 h1:DH4skfRX4EBpamg7iV4ZlCpblAHI6s6TDM39bFZumv8=
334344
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
345+
golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e h1:nFYrTHrdrAOpShe27kaFHjsqYSEQ0KWqdWLu3xuZJts=
346+
golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
335347
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
336348
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
337349
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -353,8 +365,8 @@ gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
353365
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
354366
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
355367
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
356-
gopkg.in/ini.v1 v1.31.1 h1:8EY/6KDwKM9Qg4vu1+01ZpsxClC/XV71R+nZ/TL7D4M=
357-
gopkg.in/ini.v1 v1.31.1/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
368+
gopkg.in/ini.v1 v1.42.0 h1:7N3gPTt50s8GuLortA00n8AqRTk75qOP98+mTPpgzRk=
369+
gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
358370
gopkg.in/ldap.v3 v3.0.2 h1:R6RBtabK6e1GO0eQKtkyOFbAHO73QesLzI2w2DZ6b9w=
359371
gopkg.in/ldap.v3 v3.0.2/go.mod h1:oxD7NyBuxchC+SgJDE1Q5Od05eGt29SDQVBmV+HYbzw=
360372
gopkg.in/macaron.v1 v1.3.2 h1:AvWIaPmwBUA87/OWzePkoxeaw6YJWDfBt1pDFPBnLf8=

‎integrations/cors_test.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Copyright 2019 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package integrations
6+
7+
import (
8+
"net/http"
9+
"testing"
10+
11+
"github.com/stretchr/testify/assert"
12+
)
13+
14+
func TestCORSNotSet(t *testing.T) {
15+
prepareTestEnv(t)
16+
req := NewRequestf(t, "GET", "/api/v1/version")
17+
session := loginUser(t, "user2")
18+
resp := session.MakeRequest(t, req, http.StatusOK)
19+
assert.Equal(t, resp.Code, http.StatusOK)
20+
corsHeader := resp.Header().Get("Access-Control-Allow-Origin")
21+
assert.Equal(t, corsHeader, "", "Access-Control-Allow-Origin: generated header should match") // header not set
22+
}

‎modules/setting/cors.go

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Copyright 2019 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package setting
6+
7+
import (
8+
"time"
9+
10+
"code.gitea.io/gitea/modules/log"
11+
12+
"github.com/go-macaron/cors"
13+
)
14+
15+
var (
16+
// CORSConfig defines CORS settings
17+
CORSConfig cors.Options
18+
// EnableCORS defines whether CORS settings is enabled or not
19+
EnableCORS bool
20+
)
21+
22+
func newCORSService() {
23+
sec := Cfg.Section("cors")
24+
// Check cors setting.
25+
EnableCORS = sec.Key("ENABLED").MustBool(false)
26+
27+
maxAge := sec.Key("MAX_AGE").MustDuration(10 * time.Minute)
28+
29+
CORSConfig = cors.Options{
30+
Scheme: sec.Key("SCHEME").String(),
31+
AllowDomain: sec.Key("ALLOW_DOMAIN").String(),
32+
AllowSubdomain: sec.Key("ALLOW_SUBDOMAIN").MustBool(),
33+
Methods: sec.Key("METHODS").Strings(","),
34+
MaxAgeSeconds: int(maxAge.Seconds()),
35+
AllowCredentials: sec.Key("ALLOW_CREDENTIALS").MustBool(),
36+
}
37+
38+
if EnableCORS {
39+
log.Info("CORS Service Enabled")
40+
}
41+
}

‎modules/setting/setting.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1006,6 +1006,7 @@ func NewServices() {
10061006
NewLogServices(false)
10071007
newCacheService()
10081008
newSessionService()
1009+
newCORSService()
10091010
newMailService()
10101011
newRegisterMailService()
10111012
newNotifyMailService()

‎routers/api/v1/api.go

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ import (
7474
"code.gitea.io/gitea/routers/api/v1/user"
7575

7676
"github.com/go-macaron/binding"
77-
"gopkg.in/macaron.v1"
77+
"github.com/go-macaron/cors"
78+
macaron "gopkg.in/macaron.v1"
7879
)
7980

8081
func sudo() macaron.Handler {
@@ -500,6 +501,12 @@ func RegisterRoutes(m *macaron.Macaron) {
500501
m.Get("/swagger", misc.Swagger) //Render V1 by default
501502
}
502503

504+
var handlers []macaron.Handler
505+
if setting.EnableCORS {
506+
handlers = append(handlers, cors.CORS(setting.CORSConfig))
507+
}
508+
handlers = append(handlers, securityHeaders(), context.APIContexter(), sudo())
509+
503510
m.Group("/v1", func() {
504511
// Miscellaneous
505512
if setting.API.EnableSwagger {
@@ -841,5 +848,15 @@ func RegisterRoutes(m *macaron.Macaron) {
841848
m.Group("/topics", func() {
842849
m.Get("/search", repo.TopicSearch)
843850
})
844-
}, context.APIContexter(), sudo())
851+
}, handlers...)
852+
}
853+
854+
func securityHeaders() macaron.Handler {
855+
return func(ctx *macaron.Context) {
856+
ctx.Resp.Before(func(w macaron.ResponseWriter) {
857+
// CORB: https://www.chromium.org/Home/chromium-security/corb-for-developers
858+
// http://stackoverflow.com/a/3146618/244009
859+
w.Header().Set("x-content-type-options", "nosniff")
860+
})
861+
}
845862
}

‎vendor/github.com/Unknwon/com/dir.go

Lines changed: 49 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/Unknwon/com/go.mod

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)