Fix blank homepage from cached CORS rejection

philip · philip · commit 10d20b52f90c · 2026-07-15T14:06:14.000-07:00
diff --git a/include/prepend.inc b/include/prepend.inc
@@ -26,9 +26,12 @@ header("Permissions-Policy: interest-cohort=()");
     }
 
     $host = parse_url($_SERVER["HTTP_ORIGIN"]);
-    if (!preg_match('/^(.+\.)?php\.net$/', $host["host"])) {
-        if ($host["host"] != $_SERVER["SERVER_NAME"]) {
-            exit(10);
+    if (!preg_match('/^(.+\.)?php\.net$/', $host["host"] ?? '')) {
+        if (($host["host"] ?? '') != $_SERVER["SERVER_NAME"]) {
+            // Unknown origin: just skip the CORS headers. Don't exit,
+            // or we send a blank 200 with no Cache-Control that the CDN
+            // happily caches as an empty homepage (see issue #1955).
+            return;
         }
     }
     if (isset($host["port"])) {

Original file line number	Diff line number	Diff line change
`@@ -26,9 +26,12 @@ header("Permissions-Policy: interest-cohort=()");`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`$host = parse_url($_SERVER["HTTP_ORIGIN"]);`
`29`		`- if (!preg_match('/^(.+\.)?php\.net$/', $host["host"])) {`
`30`		`- if ($host["host"] != $_SERVER["SERVER_NAME"]) {`
`31`		`- exit(10);`
	`29`	`+ if (!preg_match('/^(.+\.)?php\.net$/', $host["host"] ?? '')) {`
	`30`	`+ if (($host["host"] ?? '') != $_SERVER["SERVER_NAME"]) {`
	`31`	`+ // Unknown origin: just skip the CORS headers. Don't exit,`
	`32`	`+ // or we send a blank 200 with no Cache-Control that the CDN`
	`33`	`+ // happily caches as an empty homepage (see issue #1955).`
	`34`	`+ return;`
`32`	`35`	`}`
`33`	`36`	`}`
`34`	`37`	`if (isset($host["port"])) {`