still trying to fix cors

2 files changed, 9 insertions, 10 deletions

diff --git a/external/newsapi.php b/external/newsapi.php
index 2400041cb..489f27f72 100644
--- a/external/newsapi.php
+++ b/external/newsapi.php
@@ -80,13 +80,13 @@ class NewsAPI extends Controller {
 	public function cors() {
 		// needed for webapps access due to cross origin request policy
 		if(array_key_exists('Origin', $this->request->server)) {
-			$allowed = $this->request->server['Origin'];
+			$origin = $this->request->server['Origin'];
 		} else {
-			$allowed = '*';
+			$origin = '*';
 		}
 
 		$response = new Response();
-		$response->addHeader('Access-Control-Allow-Origin', $allowed);
+		$response->addHeader('Access-Control-Allow-Origin', $origin);
 		$response->addHeader('Access-Control-Allow-Methods', 'PUT, POST, GET, DELETE');
 		$response->addHeader('Access-Control-Allow-Credentials', 'true');
 		$response->addHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
diff --git a/middleware/corsmiddleware.php b/middleware/corsmiddleware.php
index 7bde0a891..e0d3e23ad 100644
--- a/middleware/corsmiddleware.php
+++ b/middleware/corsmiddleware.php
@@ -52,15 +52,14 @@ class CORSMiddleware extends Middleware {
 	public function afterController($controller, $methodName, Response $response){
 		$annotationReader = new MethodAnnotationReader($controller, $methodName);
 
-		if(array_key_exists('Origin', $this->request->server)) {
-			$allowed = $this->request->server['Origin'];
-		} else {
-			$allowed = '*';
-		}
+		// only react if its an API request and if the request sends origin
+		if(array_key_exists('Origin', $this->request->server) &&
+			$annotationReader->hasAnnotation('API')) {
 
-		if($annotationReader->hasAnnotation('API')) {
-			$response->addHeader('Access-Control-Allow-Origin', $allowed);
+			$origin = $this->request->server['Origin'];
+			$response->addHeader('Access-Control-Allow-Origin', $origin);
 			$response->addHeader('Access-Control-Allow-Credentials', 'true');
+			
 		}
 		return $response;
 	}