SWAMPy

✎ CARVE FLESH

EDITING: cors.php

<?php
require_once __DIR__ . '/../config.php';

/**
 * CORS for the public, read-only GET endpoints (api/gallery.php,
 * api/services.php). No cookies involved, so any origin in ALLOWED_ORIGINS
 * is fine.
 */
function send_cors_headers(): void
{
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
    if (in_array($origin, ALLOWED_ORIGINS, true)) {
        header('Access-Control-Allow-Origin: ' . $origin);
    }
    header('Access-Control-Allow-Methods: GET, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type');
    header('Vary: Origin');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        http_response_code(204);
        exit;
    }
}

/**
 * CORS for the admin API (api/admin/*.php). These requests carry a login
 * session cookie cross-site (the admin dashboard is a separate app on its
 * own domain), so exactly one origin — ADMIN_ORIGIN — is ever allowed, and
 * credentials must be explicitly turned on. Never widen this to a list or
 * a wildcard.
 */
function send_admin_cors_headers(): void
{
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
    if ($origin === ADMIN_ORIGIN) {
        header('Access-Control-Allow-Origin: ' . $origin);
        header('Access-Control-Allow-Credentials: true');
    }
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, X-CSRF-Token');
    header('Vary: Origin');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        http_response_code(204);
        exit;
    }
}

function json_response($data, int $status = 200): void
{
    http_response_code($status);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($data, JSON_UNESCAPED_SLASHES);
    exit;
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 api_auth.php	PHP	1.5 KB	2026-09-09 10:08	EDIT
📄 cors.php	PHP	1.7 KB	2026-09-09 10:08	EDIT
📄 upload.php	PHP	2 KB	2026-09-09 10:08	EDIT