add allowed origin

pdsinterop · Jan 19, 2024 · b50fb8b · b50fb8b
1 parent 4da0bd5
commit b50fb8b
Showing 1 changed file with 16 additions and 13 deletions.
diff --git a/solid/lib/Controller/StorageController.php b/solid/lib/Controller/StorageController.php
@@ -338,6 +338,9 @@ public function handleRequest($userId, $path) {
 			if (isset($clientRegistration['client_name'])) {
 				$allowedOrigins[] = $clientRegistration['client_name'];
 			}
+			if (isset($clientRegistration['origin'])) {
+				$allowedOrigins[] = $clientRegistration['origin'];
+			}
 		}
 		if (!$this->WAC->isAllowed($request, $webId, $origin, $allowedOrigins)) {
 			$response = $this->resourceServer->getResponse()
@@ -428,19 +431,19 @@ private function respond($response) {
 //		$result->addHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
 //		$result->addHeader('Access-Control-Allow-Origin', $origin);
 
-                $policy = new EmptyContentSecurityPolicy();
-                $policy->addAllowedStyleDomain("*");
-                $policy->addAllowedStyleDomain("data:");
-                $policy->addAllowedScriptDomain("*");
-                $policy->addAllowedImageDomain("*");
-                $policy->addAllowedFontDomain("*");
-                $policy->addAllowedConnectDomain("*");
-                $policy->allowInlineStyle(true);
-                $policy->allowInlineScript(true);
-                $policy->allowEvalScript(true);
-                $result->setContentSecurityPolicy($policy);
-                
-                $result->setStatus($statusCode);
+		$policy = new EmptyContentSecurityPolicy();
+		$policy->addAllowedStyleDomain("*");
+		$policy->addAllowedStyleDomain("data:");
+		$policy->addAllowedScriptDomain("*");
+		$policy->addAllowedImageDomain("*");
+		$policy->addAllowedFontDomain("*");
+		$policy->addAllowedConnectDomain("*");
+		$policy->allowInlineStyle(true);
+		$policy->allowInlineScript(true);
+		$policy->allowEvalScript(true);
+		$result->setContentSecurityPolicy($policy);
+		
+		$result->setStatus($statusCode);
 		return $result;
 	}
 }