myron/jarvis
1
0
Fork 0
mirror of https://github.com/myronblair/jarvis synced 2026-07-28 16:52:46 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix code review findings: unauthenticated infra doc + backup file exposure, onclick-attribute XSS breakouts (admin panel and front-end), plaintext calendar passwords, k()->j() typo, wildcard CORS, session cookie hardening (HttpOnly/SameSite)

Browse Source
This commit is contained in:
Myron Blair
2026-07-05 20:09:52 -05:00
parent cfb5b2a3f9
commit 24bc876c1d
4 changed files with 56 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public_html/api.php
+6 -1
View File
@@ -27,7 +27,12 @@ if (!$_skipSession) {
}
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
$_allowedOrigins = ['https://jarvis.orbishosting.com', 'http://jarvis.orbishosting.com'];
$_origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (in_array($_origin, $_allowedOrigins, true)) {
header('Access-Control-Allow-Origin: ' . $_origin);
header('Access-Control-Allow-Credentials: true');
}
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, X-Session-Token');