diff --git a/app/app.php b/app/app.php index 8e268d7e1..f000b234d 100644 --- a/app/app.php +++ b/app/app.php @@ -32,7 +32,16 @@ $webhook = new Event('v1-webhooks', 'WebhooksV1'); $audit = new Event('v1-audits', 'AuditsV1'); $usage = new Event('v1-usage', 'UsageV1'); -$utopia->init(function() use ($utopia, $request, $response, $register, &$user, $project, $consoleDB, $roles, $webhook, $audit, $usage, $domain) { +$clients = array_map(function($node) { + return $node['url']; +}, array_filter($project->getAttribute('platforms', []), function($node) { + if(isset($node['type']) && $node['type'] === 'web' && isset($node['url']) && !empty($node['url'])) { + return true; + } + return false; +})); + +$utopia->init(function() use ($utopia, $request, $response, $register, &$user, $project, $roles, $webhook, $audit, $usage, $domain, $clients) { $route = $utopia->match($request); @@ -49,15 +58,7 @@ $utopia->init(function() use ($utopia, $request, $response, $register, &$user, $ $referrer = $request->getServer('HTTP_REFERER', ''); $origin = $request->getServer('HTTP_ORIGIN', parse_url($referrer, PHP_URL_SCHEME) . '://' . parse_url($referrer, PHP_URL_HOST)); - // //var_dump($project->getAttribute('clients', []), $project); - // print_r(array_map(function($node) { - // var_dump($node); - // if(isset($node['type']) && $node['type'] === 'web') { - // return $node['domains']; - // } - // }, $project->getAttribute('platforms', []))); - // exit(); - $refDomain = (in_array($origin, array_merge($project->getAttribute('clients', [])))) + $refDomain = (in_array($origin, $clients)) ? $origin : 'http://localhost'; /** @@ -82,7 +83,7 @@ $utopia->init(function() use ($utopia, $request, $response, $register, &$user, $ * Validate Client Domain - Check to avoid CSRF attack * Adding appwrite api domains to allow XDOMAIN communication */ - $hostValidator = new Host(array_merge($project->getAttribute('clients', []), ['http://localhost', 'https://localhost', 'https://appwrite.test', 'https://appwrite.io'])); + $hostValidator = new Host(array_merge($clients, ['http://localhost', 'https://localhost', 'https://appwrite.test', 'https://appwrite.io'])); if(!$hostValidator->isValid($request->getServer('HTTP_ORIGIN', $request->getServer('HTTP_REFERER', ''))) && in_array($request->getMethod(), [Request::METHOD_POST, Request::METHOD_PUT, Request::METHOD_PATCH, Request::METHOD_DELETE]) @@ -425,7 +426,7 @@ $utopia->get('/v1/xss') ->label('scope', 'public') ->label('docs', false) ->action( - function() use ($response, $project) { + function() { throw new Exception('XSS detected and reported by a browser client', 500); } ); @@ -434,11 +435,11 @@ $utopia->get('/v1/proxy') ->label('scope', 'public') ->label('docs', false) ->action( - function() use ($response, $project, $console) { + function() use ($response, $console, $clients) { $view = new View(__DIR__ . '/views/proxy.phtml'); $view ->setParam('routes', '') - ->setParam('clients', array_merge($project->getAttribute('clients', []), $console->getAttribute('clients', []))) + ->setParam('clients', array_merge($clients, $console->getAttribute('clients', []))) ; $response diff --git a/app/views/console/home/index.phtml b/app/views/console/home/index.phtml index 8196f6434..07f20ed27 100644 --- a/app/views/console/home/index.phtml +++ b/app/views/console/home/index.phtml @@ -84,12 +84,12 @@ $graph = $this->getParam('graph', false); - @@ -209,8 +209,8 @@ $graph = $this->getParam('graph', false); -
-   -
+
+ +   \ No newline at end of file diff --git a/app/views/console/settings/index.phtml b/app/views/console/settings/index.phtml index 82980104f..0211ae4e5 100644 --- a/app/views/console/settings/index.phtml +++ b/app/views/console/settings/index.phtml @@ -56,39 +56,7 @@ use Utopia\Locale\Locale;
- -

Clients

- - - -
-
-
-
- -
-
- -
-
-
-
- -
-
-
-
- -
-
- -
-
-
-
- -
- + diff --git a/public/dist/scripts/app-all.js b/public/dist/scripts/app-all.js index ef75f95d3..f906788dd 100644 --- a/public/dist/scripts/app-all.js +++ b/public/dist/scripts/app-all.js @@ -4,7 +4,7 @@ {http.addGlobalHeader('X-Appwrite-Key',value);config.key=value;return this;};let setLocale=function(value) {http.addGlobalHeader('X-Appwrite-Locale',value);config.locale=value;return this;};let setMode=function(value) {http.addGlobalHeader('X-Appwrite-Mode',value);config.mode=value;return this;};let http=function(document){let globalParams=[],globalHeaders=[];let addParam=function(url,param,value){let a=document.createElement('a'),regex=/(?:\?|&|&)+([^=]+)(?:=([^&]*))*/g;let match,str=[];a.href=url;param=encodeURIComponent(param);while(match=regex.exec(a.search))if(param!==match[1])str.push(match[1]+(match[2]?"="+match[2]:""));str.push(param+(value?"="+encodeURIComponent(value):""));a.search=str.join("&");return a.href;};let buildQuery=function(params){let str=[];for(let p in params){if(params.hasOwnProperty(p)){str.push(encodeURIComponent(p)+"="+encodeURIComponent(params[p]));}} -return str.join("&");};let addGlobalHeader=function(key,value){globalHeaders[key]={key:key.toLowerCase(),value:value.toLowerCase()};};let addGlobalParam=function(key,value){globalParams.push({key:key,value:value});};addGlobalHeader('x-sdk-version','appwrite:javascript:v1.0.9');addGlobalHeader('content-type','');let call=function(method,path,headers={},params={},progress=null){let i;path=config.endpoint+path;if(-1===['GET','POST','PUT','DELETE','TRACE','HEAD','OPTIONS','CONNECT','PATCH'].indexOf(method)){throw new Error('var method must contain a valid HTTP method name');} +return str.join("&");};let addGlobalHeader=function(key,value){globalHeaders[key]={key:key.toLowerCase(),value:value.toLowerCase()};};let addGlobalParam=function(key,value){globalParams.push({key:key,value:value});};addGlobalHeader('x-sdk-version','appwrite:javascript:v1.0.10');addGlobalHeader('content-type','');let call=function(method,path,headers={},params={},progress=null){let i;path=config.endpoint+path;if(-1===['GET','POST','PUT','DELETE','TRACE','HEAD','OPTIONS','CONNECT','PATCH'].indexOf(method)){throw new Error('var method must contain a valid HTTP method name');} if(typeof path!=='string'){throw new Error('var path must be of type string');} if(typeof headers!=='object'){throw new Error('var headers must be of type object');} for(i=0;i