#149 preview: disallow by default

digital-blueprint · Jan 17, 2024 · daf5bb6 · daf5bb6
1 parent 629e4b3
commit daf5bb6
Showing 1 changed file with 3 additions and 5 deletions.
diff --git a/lib/Controller/PreviewController.php b/lib/Controller/PreviewController.php
@@ -65,11 +65,9 @@ public function getPreviewByFileId(
      */
     public function preflightedCors()
     {
-        if (isset($this->request->server['HTTP_ORIGIN'])) {
-            $origin = $this->request->server['HTTP_ORIGIN'];
-        } else {
-            $origin = '*';
-        }
+        // Disallow by default
+        // "null" is not advised to be used as an origin
+        $origin = $this->request->server['HTTP_ORIGIN'] ?? '';
 
         $response = new Response();
         $response->addHeader('Access-Control-Allow-Origin', $origin);