mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_http: Fix reliance on previous tostring() format of util.set

Browse source 
a863e4237b91 unintentionally changed the format of HTTP CORS headers,
which were apparently relying on the output of tostring(), which it
shouldn't have.

Explicitly serializing it this time.
This commit is contained in:
Kim Alvefur 2023-04-10 11:50:27 +02:00
parent 06450fb65b
commit 59be792439
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
plugins/mod_http.lua
View file

@ -17,6 +17,7 @@ local url_parse = require "socket.url".parse;
local url_build = require "socket.url".build;
local normalize_path = require "prosody.util.http".normalize_path;
local set = require "prosody.util.set";
local array = require "util.array";
local ip_util = require "prosody.util.ip";
local new_ip = ip_util.new_ip;
@ -112,12 +113,16 @@ function moduleapi.http_url(module, app_name, default_path)
return "http://disabled.invalid/";
end
local function header_set_tostring(header_value)
return array(pairs(header_value._items)):concat(", ");
end
local function apply_cors_headers(response, methods, headers, max_age, allow_credentials, allowed_origins, origin)
if allowed_origins and not allowed_origins[origin] then
return;
end
response.headers.access_control_allow_methods = tostring(methods);
response.headers.access_control_allow_headers = tostring(headers);
response.headers.access_control_allow_methods = header_set_tostring(methods);
response.headers.access_control_allow_headers = header_set_tostring(headers);
response.headers.access_control_max_age = tostring(max_age)
response.headers.access_control_allow_origin = origin or "*";
if allow_credentials then