Skip to content

Commit c6e249a

Browse files
committed
fix: patch up regex issue
1 parent 10934a7 commit c6e249a

2 files changed

Lines changed: 15 additions & 8 deletions

File tree

README.md

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
[![Total Downloads](https://poser.pugx.org/leafs/cors/downloads)](https://packagist.org/packages/leafs/cors)
1313
[![License](https://poser.pugx.org/leafs/cors/license)](https://packagist.org/packages/leafs/cors)
1414

15-
This is a [Leaf PHP](https://leafphp.netlify.app/) module used to enable and configure [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options. This module can be used both in and out of Leaf and so can be considered a general module. It is also inspired by the [ExpressJS](https://github.com/expressjs/express) [cors package](https://github.com/expressjs/cors).
15+
This is the CORS handler for Leaf.
1616

1717
## Installation
1818

@@ -98,7 +98,3 @@ The default configuration is the equivalent of:
9898
"optionsSuccessStatus": 204,
9999
}
100100
```
101-
102-
## View Leaf's docs [here](https://leafphp.netlify.app/#/)
103-
104-
Built with ❤ by [**Mychi Darko**](https://mychi.netlify.app)

src/Cors.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ protected static function configureCredentials()
127127
protected static function isOriginAllowed($allowedOrigin)
128128
{
129129
$origin = $_SERVER['HTTP_ORIGIN'] ?? $_SERVER['HTTP_HOST'];
130-
130+
131131
if (is_array($allowedOrigin)) {
132132
for ($i = 0; $i < count($allowedOrigin); $i++) {
133133
if (static::isOriginAllowed($allowedOrigin[$i])) {
@@ -137,11 +137,22 @@ protected static function isOriginAllowed($allowedOrigin)
137137

138138
return false;
139139
} else if (is_string($allowedOrigin)) {
140-
if ($allowedOrigin === "*" || $origin === $allowedOrigin) {
140+
if ($allowedOrigin === '*' || $origin === $allowedOrigin) {
141141
return true;
142142
}
143143

144-
return preg_match($allowedOrigin, $origin) !== false;
144+
if (preg_match("/^\/.+\/[a-z]*$/i", $allowedOrigin)) {
145+
return preg_match($allowedOrigin, $origin) !== false;
146+
}
147+
148+
if (
149+
strpos($allowedOrigin, $origin) !== false ||
150+
strpos($origin, $allowedOrigin) !== false
151+
) {
152+
return true;
153+
}
154+
155+
return false;
145156
}
146157
}
147158
}

0 commit comments

Comments
 (0)