cuongpv/faveo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package and depencies

Browse Source
This commit is contained in:
RafficMohammed
2023-01-08 02:57:24 +05:30
parent d5332eb421
commit 1d54b8bc7f
4309 changed files with 193331 additions and 172289 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
vendor/fruitcake/laravel-cors/.editorconfig vendored
View File

@@ -1,15 +0,0 @@
root = true
[*]
charset = utf-8
indent_size = 4
indent_style = space
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
[*.md]
trim_trailing_whitespace = false
[*.{yml,yaml}]
indent_size = 2

43
vendor/fruitcake/laravel-cors/changelog.md vendored
View File

@@ -1,43 +0,0 @@
# Change Log
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/)
and this project adheres to [Semantic Versioning](http://semver.org/).
## v2.0 (2020-05-11)
[asm89/stack-cors 2.x](https://github.com/asm89/stack-cors/releases/tag/2.0.0) is now used, with these notable changes:
### Added
- CORS headers are better cachable now, with correct Vary headers (#https://github.com/asm89/stack-cors/pull/70, #https://github.com/asm89/stack-cors/pull/74)
### Changed
- CORS headers are added to non-Origin requests when possible (#https://github.com/asm89/stack-cors/pull/73)
- Requests are no longer blocked by the server, only by the browser (#https://github.com/asm89/stack-cors/pull/70)
## v1.0 (2019-12-27)
### Breaking changes
- Adding the middleware on Route groups is no longer supported. You can use the new `paths` option to match your routes
- The config file has been changed from `camelCase` to `snake_case`, please update your own config.
- The deprecated Lumen ServiceProvider has been removed.
- There is no need to manually configure the `cors` config in Lumen.
### Added
- The `paths` option is added to match certain routes only, while still using global middleware. This allows for better error handling.
## v0.11.0 (2017-12-xx)
### Breaking changes
- The wildcard matcher is changed. You can use `allowedOriginPatterns` for your own patterns,
or simple wildcards in the normal origins. Eg. `*.laravel.com` should still work.
## v0.9.0 (2016-03-2017)
### Breaking changes
- The `cors` alias is no longer added by default. Use the full class or add the alias yourself.
- The Lumen ServiceProvider has been removed. Both Laravel and Lumen should use `Barryvdh\Cors\ServiceProvider::class`.
- `Barryvdh\Cors\Stack\CorsService` moves to `\Barryvdh\Cors\CorsService` (namespace changed).
- `Barryvdh\Cors@addActualRequestHeaders` will automatically attached when Exception occured.
### Added
- Better error-handling when exceptions occur.
- A lot of tests, also on older Laravel versions.

54
vendor/fruitcake/laravel-cors/composer.json vendored
View File

@@ -1,54 +0,0 @@
{
"name": "fruitcake/laravel-cors",
"description": "Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application",
"keywords": ["laravel", "cors", "crossdomain", "api"],
"license": "MIT",
"authors": [
{
"name": "Fruitcake",
"homepage": "https://fruitcake.nl"
},
{
"name": "Barry vd. Heuvel",
"email": "barryvdh@gmail.com"
}
],
"require": {
"php": ">=7.2",
"illuminate/support": "^6|^7|^8|^9",
"illuminate/contracts": "^6|^7|^8|^9",
"asm89/stack-cors": "^2.0.1"
},
"require-dev": {
"laravel/framework": "^6|^7.24|^8",
"phpunit/phpunit": "^6|^7|^8|^9",
"squizlabs/php_codesniffer": "^3.5",
"orchestra/testbench-dusk": "^4|^5|^6|^7"
},
"autoload": {
"psr-4": {
"Fruitcake\\Cors\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Fruitcake\\Cors\\Tests\\": "tests/"
}
},
"extra": {
"branch-alias": {
"dev-master": "2.1-dev"
},
"laravel": {
"providers": [
"Fruitcake\\Cors\\CorsServiceProvider"
]
}
},
"scripts": {
"test": "phpunit",
"check-style": "phpcs -p --standard=psr12 src/",
"fix-style": "phpcbf -p --standard=psr12 src/"
},
"minimum-stability": "dev"
}

60
vendor/fruitcake/laravel-cors/config/cors.php vendored
View File

@@ -1,60 +0,0 @@
<?php
return [
/*
|--------------------------------------------------------------------------
| Laravel CORS Options
|--------------------------------------------------------------------------
|
| The allowed_methods and allowed_headers options are case-insensitive.
|
| You don't need to provide both allowed_origins and allowed_origins_patterns.
| If one of the strings passed matches, it is considered a valid origin.
|
| If ['*'] is provided to allowed_methods, allowed_origins or allowed_headers
| all methods / origins / headers are allowed.
|
*/
/*
* You can enable CORS for 1 or multiple paths.
* Example: ['api/*']
*/
'paths' => [],
/*
* Matches the request method. `['*']` allows all methods.
*/
'allowed_methods' => ['*'],
/*
* Matches the request origin. `['*']` allows all origins. Wildcards can be used, eg `*.mydomain.com`
*/
'allowed_origins' => ['*'],
/*
* Patterns that can be used with `preg_match` to match the origin.
*/
'allowed_origins_patterns' => [],
/*
* Sets the Access-Control-Allow-Headers response header. `['*']` allows all headers.
*/
'allowed_headers' => ['*'],
/*
* Sets the Access-Control-Expose-Headers response header with these headers.
*/
'exposed_headers' => [],
/*
* Sets the Access-Control-Max-Age response header when > 0.
*/
'max_age' => 0,
/*
* Sets the Access-Control-Allow-Credentials header.
*/
'supports_credentials' => false,
];

174
vendor/fruitcake/laravel-cors/readme.md vendored
View File

@@ -1,174 +0,0 @@
# CORS Middleware for Laravel
[![Build Status][ico-actions]][link-actions]
[![Software License][ico-license]](LICENSE.md)
[![Total Downloads][ico-downloads]][link-downloads]
[![Fruitcake](https://img.shields.io/badge/Powered%20By-Fruitcake-b2bc35.svg)](https://fruitcake.nl/)
Implements https://github.com/fruitcake/php-cors for Laravel
## About
The `laravel-cors` package allows you to send [Cross-Origin Resource Sharing](http://enable-cors.org/)
headers with Laravel middleware configuration.
If you want to have a global overview of CORS workflow, you can browse
this [image](http://www.html5rocks.com/static/images/cors_server_flowchart.png).
## Upgrading from 0.x (barryvdh/laravel-cors)
When upgrading from 0.x versions, there are some breaking changes:
- **A new 'paths' property is used to enable/disable CORS on certain routes. This is empty by default, so fill it correctly!**
- **Group middleware is no longer supported, use the global middleware**
- The vendor name has changed (see installation/usage)
- The casing on the props in `cors.php` has changed from camelCase to snake_case, so if you already have a `cors.php` file you will need to update the props in there to match the new casing.
## Features
* Handles CORS pre-flight OPTIONS requests
* Adds CORS headers to your responses
* Match routes to only add CORS to certain Requests
## Installation
Require the `fruitcake/laravel-cors` package in your `composer.json` and update your dependencies:
```sh
composer require fruitcake/laravel-cors
```
If you get a conflict, this could be because an older version of barryvdh/laravel-cors or fruitcake/laravel-cors is installed. Remove the conflicting package first, then try install again:
```sh
composer remove barryvdh/laravel-cors fruitcake/laravel-cors
composer require fruitcake/laravel-cors
```
## Global usage
To allow CORS for all your routes, add the `HandleCors` middleware at the top of the `$middleware` property of `app/Http/Kernel.php` class:
```php
protected $middleware = [
\Fruitcake\Cors\HandleCors::class,
// ...
];
```
Now update the config to define the paths you want to run the CORS service on, (see Configuration below):
```php
'paths' => ['api/*'],
```
## Configuration
The defaults are set in `config/cors.php`. Publish the config to copy the file to your own config:
```sh
php artisan vendor:publish --tag="cors"
```
> **Note:** When using custom headers, like `X-Auth-Token` or `X-Requested-With`, you must set the `allowed_headers` to include those headers. You can also set it to `['*']` to allow all custom headers.
> **Note:** If you are explicitly whitelisting headers, you must include `Origin` or requests will fail to be recognized as CORS.
### Options
| Option | Description | Default value |
|--------------------------|--------------------------------------------------------------------------|---------------|
| paths | You can enable CORS for 1 or multiple paths, eg. `['api/*'] ` | `[]` |
| allowed_origins | Matches the request origin. Wildcards can be used, eg. `*.mydomain.com` or `mydomain.com:*` | `['*']` |
| allowed_origins_patterns | Matches the request origin with `preg_match`. | `[]` |
| allowed_methods | Matches the request method. | `['*']` |
| allowed_headers | Sets the Access-Control-Allow-Headers response header. | `['*']` |
| exposed_headers | Sets the Access-Control-Expose-Headers response header. | `false` |
| max_age | Sets the Access-Control-Max-Age response header. | `0` |
| supports_credentials | Sets the Access-Control-Allow-Credentials header. | `[]` |
`allowed_origins`, `allowed_headers` and `allowed_methods` can be set to `['*']` to accept any value.
> **Note:** For `allowed_origins` you must include the scheme when not using a wildcard, eg. `['http://example.com', 'https://example.com']`. You must also take into account that the scheme will be present when using `allowed_origins_patterns`.
> **Note:** Try to be a specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!
> **Note:** Because of [http method overriding](http://symfony.com/doc/current/reference/configuration/framework.html#http-method-override) in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.
> **Note:** Sometimes it's necessary to specify the port _(when you're coding your app in a local environment for example)_. You can specify the port or using a wildcard here too, eg. `localhost:3000`, `localhost:*` or even using a FQDN `app.mydomain.com:8080`
### Lumen
On Lumen, just register the ServiceProvider manually in your `bootstrap/app.php` file:
```php
$app->register(Fruitcake\Cors\CorsServiceProvider::class);
```
Also copy the [cors.php](https://github.com/fruitcake/laravel-cors/blob/master/config/cors.php) config file to `config/cors.php` and put it into action:
```php
$app->configure('cors');
```
## Global usage for Lumen
To allow CORS for all your routes, add the `HandleCors` middleware to the global middleware and set the `paths` property in the config.
```php
$app->middleware([
// ...
Fruitcake\Cors\HandleCors::class,
]);
```
## Common problems
### Wrong config
Make sure the `path` option in the config is correct and actually matches the route you are using. Remember to clear the config cache as well.
### Error handling, Middleware order
Sometimes errors/middleware that return own responses can prevent the CORS Middleware from being run. Try changing the order of the Middleware and make sure it's the first entry in the global middleware, not a route group. Also check your logs for actual errors, because without CORS, the errors will be swallowed by the browser, only showing CORS errors. Also try running it without CORS to make sure it actually works.
### Authorization headers / Credentials
If your Request includes an Authorization header or uses Credentials mode, set the `supports_credentials` value in the config to true. This will set the [Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) Header to `true`.
### Echo/die
If you `echo()`, `dd()`, `die()`, `exit()`, `dump()` etc in your code, you will break the Middleware flow. When output is sent before headers, CORS cannot be added. When the scripts exits before the CORS middleware finished, CORS headers will not be added. Always return a proper response or throw an Exception.
### Disabling CSRF protection for your API
If possible, use a route group with CSRF protection disabled.
Otherwise you can disable CSRF for certain requests in `App\Http\Middleware\VerifyCsrfToken`:
```php
protected $except = [
'api/*',
'sub.domain.zone' => [
'prefix/*'
],
];
```
### Duplicate headers
The CORS Middleware should be the only place you add these headers. If you also add headers in .htaccess, nginx or your index.php file, you will get duplicate headers and unexpected results.
## License
Released under the MIT License, see [LICENSE](LICENSE).
[ico-version]: https://img.shields.io/packagist/v/fruitcake/laravel-cors.svg?style=flat-square
[ico-license]: https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square
[ico-actions]: https://github.com/fruitcake/laravel-cors/actions/workflows/run-tests.yml/badge.svg
[ico-scrutinizer]: https://img.shields.io/scrutinizer/coverage/g/fruitcake/laravel-cors.svg?style=flat-square
[ico-code-quality]: https://img.shields.io/scrutinizer/g/fruitcake/laravel-cors.svg?style=flat-square
[ico-downloads]: https://img.shields.io/packagist/dt/fruitcake/laravel-cors.svg?style=flat-square
[link-packagist]: https://packagist.org/packages/fruitcake/laravel-cors
[link-actions]: https://github.com/fruitcake/laravel-cors/actions
[link-scrutinizer]: https://scrutinizer-ci.com/g/fruitcake/laravel-cors/code-structure
[link-code-quality]: https://scrutinizer-ci.com/g/fruitcake/laravel-cors
[link-downloads]: https://packagist.org/packages/fruitcake/laravel-cors
[link-author]: https://github.com/fruitcake
[link-contributors]: ../../contributors

115
vendor/fruitcake/laravel-cors/src/CorsServiceProvider.php vendored
View File

@@ -1,115 +0,0 @@
<?php
namespace Fruitcake\Cors;
use Asm89\Stack\CorsService;
use Illuminate\Foundation\Application as LaravelApplication;
use Illuminate\Support\ServiceProvider as BaseServiceProvider;
use Laravel\Lumen\Application as LumenApplication;
use Illuminate\Foundation\Http\Events\RequestHandled;
class CorsServiceProvider extends BaseServiceProvider
{
/**
* Register the service provider.
*
* @return void
*/
public function register()
{
$this->mergeConfigFrom($this->configPath(), 'cors');
$this->app->singleton(CorsService::class, function ($app) {
return new CorsService($this->corsOptions(), $app);
});
}
/**
* Register the config for publishing
*
*/
public function boot()
{
if ($this->app instanceof LaravelApplication && $this->app->runningInConsole()) {
$this->publishes([$this->configPath() => config_path('cors.php')], 'cors');
} elseif ($this->app instanceof LumenApplication) {
$this->app->configure('cors');
}
// Add the headers on the Request Handled event as fallback in case of exceptions
if (class_exists(RequestHandled::class) && $this->app->bound('events')) {
$this->app->make('events')->listen(RequestHandled::class, function (RequestHandled $event) {
$this->app->make(HandleCors::class)->onRequestHandled($event);
});
}
}
/**
* Set the config path
*
* @return string
*/
protected function configPath()
{
return __DIR__ . '/../config/cors.php';
}
/**
* Get options for CorsService
*
* @return array
*/
protected function corsOptions()
{
$config = $this->app['config']->get('cors');
if ($config['exposed_headers'] && !is_array($config['exposed_headers'])) {
throw new \RuntimeException('CORS config `exposed_headers` should be `false` or an array');
}
foreach (['allowed_origins', 'allowed_origins_patterns', 'allowed_headers', 'allowed_methods'] as $key) {
if (!is_array($config[$key])) {
throw new \RuntimeException('CORS config `' . $key . '` should be an array');
}
}
// Convert case to supported options
$options = [
'supportsCredentials' => $config['supports_credentials'],
'allowedOrigins' => $config['allowed_origins'],
'allowedOriginsPatterns' => $config['allowed_origins_patterns'],
'allowedHeaders' => $config['allowed_headers'],
'allowedMethods' => $config['allowed_methods'],
'exposedHeaders' => $config['exposed_headers'],
'maxAge' => $config['max_age'],
];
// Transform wildcard pattern
foreach ($options['allowedOrigins'] as $origin) {
if (strpos($origin, '*') !== false) {
$options['allowedOriginsPatterns'][] = $this->convertWildcardToPattern($origin);
}
}
return $options;
}
/**
* Create a pattern for a wildcard, based on Str::is() from Laravel
*
* @see https://github.com/laravel/framework/blob/5.5/src/Illuminate/Support/Str.php
* @param string $pattern
* @return string
*/
protected function convertWildcardToPattern($pattern)
{
$pattern = preg_quote($pattern, '#');
// Asterisks are translated into zero-or-more regular expression wildcards
// to make it convenient to check if the strings starts with the given
// pattern such as "library/*", making any string check convenient.
$pattern = str_replace('\*', '.*', $pattern);
return '#^' . $pattern . '\z#u';
}
}

145
vendor/fruitcake/laravel-cors/src/HandleCors.php vendored
View File

@@ -1,145 +0,0 @@
<?php
namespace Fruitcake\Cors;
use Closure;
use Asm89\Stack\CorsService;
use Illuminate\Contracts\Http\Kernel;
use Illuminate\Foundation\Http\Events\RequestHandled;
use Illuminate\Http\Request;
use Illuminate\Contracts\Container\Container;
use Symfony\Component\HttpFoundation\Response;
class HandleCors
{
/** @var CorsService $cors */
protected $cors;
/** @var \Illuminate\Contracts\Container\Container $container */
protected $container;
public function __construct(CorsService $cors, Container $container)
{
$this->cors = $cors;
$this->container = $container;
}
/**
* Handle an incoming request. Based on Asm89\Stack\Cors by asm89
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return Response
*/
public function handle($request, Closure $next)
{
// Check if we're dealing with CORS and if we should handle it
if (! $this->shouldRun($request)) {
return $next($request);
}
// For Preflight, return the Preflight response
if ($this->cors->isPreflightRequest($request)) {
$response = $this->cors->handlePreflightRequest($request);
$this->cors->varyHeader($response, 'Access-Control-Request-Method');
return $response;
}
// Handle the request
$response = $next($request);
if ($request->getMethod() === 'OPTIONS') {
$this->cors->varyHeader($response, 'Access-Control-Request-Method');
}
return $this->addHeaders($request, $response);
}
/**
* Add the headers to the Response, if they don't exist yet.
*
* @param Request $request
* @param Response $response
* @return Response
*/
protected function addHeaders(Request $request, Response $response): Response
{
if (! $response->headers->has('Access-Control-Allow-Origin')) {
// Add the CORS headers to the Response
$response = $this->cors->addActualRequestHeaders($response, $request);
}
return $response;
}
/**
* Add the headers to the Response, if they don't exist yet.
*
* @param RequestHandled $event
* @deprecated
*/
public function onRequestHandled(RequestHandled $event)
{
if ($this->shouldRun($event->request) && $this->container->make(Kernel::class)->hasMiddleware(static::class)) {
$this->addHeaders($event->request, $event->response);
}
}
/**
* Determine if the request has a URI that should pass through the CORS flow.
*
* @param \Illuminate\Http\Request $request
* @return bool
*/
protected function shouldRun(Request $request): bool
{
return $this->isMatchingPath($request);
}
/**
* The the path from the config, to see if the CORS Service should run
*
* @param \Illuminate\Http\Request $request
* @return bool
*/
protected function isMatchingPath(Request $request): bool
{
// Get the paths from the config or the middleware
$paths = $this->getPathsByHost($request->getHost());
foreach ($paths as $path) {
if ($path !== '/') {
$path = trim($path, '/');
}
if ($request->fullUrlIs($path) || $request->is($path)) {
return true;
}
}
return false;
}
/**
* Paths by given host or string values in config by default
*
* @param string $host
* @return array
*/
protected function getPathsByHost(string $host)
{
$paths = $this->container['config']->get('cors.paths', []);
// If where are paths by given host
if (isset($paths[$host])) {
return $paths[$host];
}
// Defaults
return array_filter($paths, function ($path) {
return is_string($path);
});
}
}

7
vendor/fruitcake/laravel-cors/LICENSE → vendor/fruitcake/php-cors/LICENSE vendored
View File

@@ -1,6 +1,5 @@
Copyright (c) 2013-2016 Barry vd. Heuvel
Copyright for portions of this project are held by [asm89 (Alexander)] as part of project asm89/stack-cors.
Copyright (c) 2013-2017 Alexander <iam.asm89@gmail.com>
Copyright (c) 2017-2022 Barryvdh <barryvdh@gmail.com>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +17,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
THE SOFTWARE.

78
vendor/fruitcake/php-cors/README.md vendored Normal file
View File

@@ -0,0 +1,78 @@
# CORS for PHP (using the Symfony HttpFoundation)
[![Unit Tests](https://github.com/fruitcake/php-cors/actions/workflows/run-tests.yml/badge.svg)](https://github.com/fruitcake/php-cors/actions)
[![PHPStan Level 9](https://img.shields.io/badge/PHPStan-Level%209-blue)](https://github.com/fruitcake/php-cors/actions)
[![Code Coverage](https://img.shields.io/badge/CodeCoverage-100%25-brightgreen)](https://github.com/fruitcake/php-cors/actions/workflows/run-coverage.yml)
[![Packagist License](https://poser.pugx.org/fruitcake/php-cors/license.png)](http://choosealicense.com/licenses/mit/)
[![Latest Stable Version](https://poser.pugx.org/fruitcake/php-cors/version.png)](https://packagist.org/packages/fruitcake/php-cors)
[![Total Downloads](https://poser.pugx.org/fruitcake/php-cors/d/total.png)](https://packagist.org/packages/fruitcake/php-cors)
[![Fruitcake](https://img.shields.io/badge/Powered%20By-Fruitcake-b2bc35.svg)](https://fruitcake.nl/)
Library and middleware enabling cross-origin resource sharing for your
http-{foundation,kernel} using application. It attempts to implement the
[W3C Recommendation] for cross-origin resource sharing.
[W3C Recommendation]: http://www.w3.org/TR/cors/
> Note: This is a standalone fork of https://github.com/asm89/stack-cors and is compatible with the options for CorsService.
## Installation
Require `fruitcake/php-cors` using composer.
## Usage
This package can be used as a library. You can use it in your framework using:
- [Stack middleware](http://stackphp.com/): https://github.com/asm89/stack-cors
- [Laravel](https://laravel.com): https://github.com/fruitcake/laravel-cors
### Options
| Option | Description | Default value |
|------------------------|------------------------------------------------------------|---------------|
| allowedMethods | Matches the request method. | `[]` |
| allowedOrigins | Matches the request origin. | `[]` |
| allowedOriginsPatterns | Matches the request origin with `preg_match`. | `[]` |
| allowedHeaders | Sets the Access-Control-Allow-Headers response header. | `[]` |
| exposedHeaders | Sets the Access-Control-Expose-Headers response header. | `[]` |
| maxAge | Sets the Access-Control-Max-Age response header. | `0` |
| supportsCredentials | Sets the Access-Control-Allow-Credentials header. | `false` |
The _allowedMethods_ and _allowedHeaders_ options are case-insensitive.
You don't need to provide both _allowedOrigins_ and _allowedOriginsPatterns_. If one of the strings passed matches, it is considered a valid origin. A wildcard in allowedOrigins will be converted to a pattern.
If `['*']` is provided to _allowedMethods_, _allowedOrigins_ or _allowedHeaders_ all methods / origins / headers are allowed.
> Note: Allowing a single static origin will improve cacheability.
### Example: using the library
```php
<?php
use Fruitcake\Cors\CorsService;
$cors = new CorsService([
'allowedHeaders' => ['x-allowed-header', 'x-other-allowed-header'],
'allowedMethods' => ['DELETE', 'GET', 'POST', 'PUT'],
'allowedOrigins' => ['http://localhost', 'https://*.example.com'],
'allowedOriginsPatterns' => ['/localhost:\d/'],
'exposedHeaders' => ['Content-Encoding'],
'maxAge' => false,
'supportsCredentials' => false,
]);
$cors->addActualRequestHeaders(Response $response, $origin);
$cors->handlePreflightRequest(Request $request);
$cors->isActualRequestAllowed(Request $request);
$cors->isCorsRequest(Request $request);
$cors->isPreflightRequest(Request $request);
```
## License
Released under the MIT License, see [LICENSE](LICENSE).
> This package is split-off from https://github.com/asm89/stack-cors and developed as stand-alone library since 2022

49
vendor/fruitcake/php-cors/composer.json vendored Normal file
View File

@@ -0,0 +1,49 @@
{
"name": "fruitcake/php-cors",
"description": "Cross-origin resource sharing library for the Symfony HttpFoundation",
"keywords": ["cors", "symfony", "laravel"],
"homepage": "https://github.com/fruitcake/php-cors",
"type": "library",
"license": "MIT",
"authors": [
{
"name": "Fruitcake",
"homepage": "https://fruitcake.nl"
},
{
"name": "Barryvdh",
"email": "barryvdh@gmail.com"
}
],
"require": {
"php": "^7.4|^8.0",
"symfony/http-foundation": "^4.4|^5.4|^6"
},
"require-dev": {
"phpunit/phpunit": "^9",
"squizlabs/php_codesniffer": "^3.5",
"phpstan/phpstan": "^1.4"
},
"autoload": {
"psr-4": {
"Fruitcake\\Cors\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"Fruitcake\\Cors\\Tests\\": "tests/"
}
},
"scripts": {
"actions": "composer test && composer analyse && composer check-style",
"test": "phpunit",
"analyse": "phpstan analyse src tests --level=9",
"check-style": "phpcs -p --standard=PSR12 --exclude=Generic.Files.LineLength --runtime-set ignore_errors_on_exit 1 --runtime-set ignore_warnings_on_exit 1 src tests",
"fix-style": "phpcbf -p --standard=PSR12 --exclude=Generic.Files.LineLength --runtime-set ignore_errors_on_exit 1 --runtime-set ignore_warnings_on_exit 1 src tests"
},
"extra": {
"branch-alias": {
"dev-main": "1.1-dev"
}
}
}

285
vendor/fruitcake/php-cors/src/CorsService.php vendored Normal file
View File

@@ -0,0 +1,285 @@
<?php
/*
* This file is part of fruitcake/php-cors and was originally part of asm89/stack-cors
*
* (c) Alexander <iam.asm89@gmail.com>
* (c) Barryvdh <barryvdh@gmail.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Fruitcake\Cors;
use Fruitcake\Cors\Exceptions\InvalidOptionException;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
/**
* @phpstan-type CorsInputOptions array{
* 'allowedOrigins'?: string[],
* 'allowedOriginsPatterns'?: string[],
* 'supportsCredentials'?: bool,
* 'allowedHeaders'?: string[],
* 'allowedMethods'?: string[],
* 'exposedHeaders'?: string[]|false,
* 'maxAge'?: int|bool|null,
* 'allowed_origins'?: string[],
* 'allowed_origins_patterns'?: string[],
* 'supports_credentials'?: bool,
* 'allowed_headers'?: string[],
* 'allowed_methods'?: string[],
* 'exposed_headers'?: string[]|false,
* 'max_age'?: int|bool|null
* }
*
*/
class CorsService
{
/** @var string[] */
private array $allowedOrigins = [];
/** @var string[] */
private array $allowedOriginsPatterns = [];
/** @var string[] */
private array $allowedMethods = [];
/** @var string[] */
private array $allowedHeaders = [];
/** @var string[] */
private array $exposedHeaders = [];
private bool $supportsCredentials = false;
private ?int $maxAge = 0;
private bool $allowAllOrigins = false;
private bool $allowAllMethods = false;
private bool $allowAllHeaders = false;
/**
* @param CorsInputOptions $options
*/
public function __construct(array $options = [])
{
if ($options) {
$this->setOptions($options);
}
}
/**
* @param CorsInputOptions $options
*/
public function setOptions(array $options): void
{
$this->allowedOrigins = $options['allowedOrigins'] ?? $options['allowed_origins'] ?? $this->allowedOrigins;
$this->allowedOriginsPatterns =
$options['allowedOriginsPatterns'] ?? $options['allowed_origins_patterns'] ?? $this->allowedOriginsPatterns;
$this->allowedMethods = $options['allowedMethods'] ?? $options['allowed_methods'] ?? $this->allowedMethods;
$this->allowedHeaders = $options['allowedHeaders'] ?? $options['allowed_headers'] ?? $this->allowedHeaders;
$this->supportsCredentials =
$options['supportsCredentials'] ?? $options['supports_credentials'] ?? $this->supportsCredentials;
$maxAge = $this->maxAge;
if (array_key_exists('maxAge', $options)) {
$maxAge = $options['maxAge'];
} elseif (array_key_exists('max_age', $options)) {
$maxAge = $options['max_age'];
}
$this->maxAge = $maxAge === null ? null : (int)$maxAge;
$exposedHeaders = $options['exposedHeaders'] ?? $options['exposed_headers'] ?? $this->exposedHeaders;
$this->exposedHeaders = $exposedHeaders === false ? [] : $exposedHeaders;
$this->normalizeOptions();
}
private function normalizeOptions(): void
{
// Normalize case
$this->allowedHeaders = array_map('strtolower', $this->allowedHeaders);
$this->allowedMethods = array_map('strtoupper', $this->allowedMethods);
// Normalize ['*'] to true
$this->allowAllOrigins = in_array('*', $this->allowedOrigins);
$this->allowAllHeaders = in_array('*', $this->allowedHeaders);
$this->allowAllMethods = in_array('*', $this->allowedMethods);
// Transform wildcard pattern
if (!$this->allowAllOrigins) {
foreach ($this->allowedOrigins as $origin) {
if (strpos($origin, '*') !== false) {
$this->allowedOriginsPatterns[] = $this->convertWildcardToPattern($origin);
}
}
}
}
/**
* Create a pattern for a wildcard, based on Str::is() from Laravel
*
* @see https://github.com/laravel/framework/blob/5.5/src/Illuminate/Support/Str.php
* @param string $pattern
* @return string
*/
private function convertWildcardToPattern($pattern)
{
$pattern = preg_quote($pattern, '#');
// Asterisks are translated into zero-or-more regular expression wildcards
// to make it convenient to check if the strings starts with the given
// pattern such as "*.example.com", making any string check convenient.
$pattern = str_replace('\*', '.*', $pattern);
return '#^' . $pattern . '\z#u';
}
public function isCorsRequest(Request $request): bool
{
return $request->headers->has('Origin');
}
public function isPreflightRequest(Request $request): bool
{
return $request->getMethod() === 'OPTIONS' && $request->headers->has('Access-Control-Request-Method');
}
public function handlePreflightRequest(Request $request): Response
{
$response = new Response();
$response->setStatusCode(204);
return $this->addPreflightRequestHeaders($response, $request);
}
public function addPreflightRequestHeaders(Response $response, Request $request): Response
{
$this->configureAllowedOrigin($response, $request);
if ($response->headers->has('Access-Control-Allow-Origin')) {
$this->configureAllowCredentials($response, $request);
$this->configureAllowedMethods($response, $request);
$this->configureAllowedHeaders($response, $request);
$this->configureMaxAge($response, $request);
}
return $response;
}
public function isOriginAllowed(Request $request): bool
{
if ($this->allowAllOrigins === true) {
return true;
}
$origin = (string) $request->headers->get('Origin');
if (in_array($origin, $this->allowedOrigins)) {
return true;
}
foreach ($this->allowedOriginsPatterns as $pattern) {
if (preg_match($pattern, $origin)) {
return true;
}
}
return false;
}
public function addActualRequestHeaders(Response $response, Request $request): Response
{
$this->configureAllowedOrigin($response, $request);
if ($response->headers->has('Access-Control-Allow-Origin')) {
$this->configureAllowCredentials($response, $request);
$this->configureExposedHeaders($response, $request);
}
return $response;
}
private function configureAllowedOrigin(Response $response, Request $request): void
{
if ($this->allowAllOrigins === true && !$this->supportsCredentials) {
// Safe+cacheable, allow everything
$response->headers->set('Access-Control-Allow-Origin', '*');
} elseif ($this->isSingleOriginAllowed()) {
// Single origins can be safely set
$response->headers->set('Access-Control-Allow-Origin', array_values($this->allowedOrigins)[0]);
} else {
// For dynamic headers, set the requested Origin header when set and allowed
if ($this->isCorsRequest($request) && $this->isOriginAllowed($request)) {
$response->headers->set('Access-Control-Allow-Origin', (string) $request->headers->get('Origin'));
}
$this->varyHeader($response, 'Origin');
}
}
private function isSingleOriginAllowed(): bool
{
if ($this->allowAllOrigins === true || count($this->allowedOriginsPatterns) > 0) {
return false;
}
return count($this->allowedOrigins) === 1;
}
private function configureAllowedMethods(Response $response, Request $request): void
{
if ($this->allowAllMethods === true) {
$allowMethods = strtoupper((string) $request->headers->get('Access-Control-Request-Method'));
$this->varyHeader($response, 'Access-Control-Request-Method');
} else {
$allowMethods = implode(', ', $this->allowedMethods);
}
$response->headers->set('Access-Control-Allow-Methods', $allowMethods);
}
private function configureAllowedHeaders(Response $response, Request $request): void
{
if ($this->allowAllHeaders === true) {
$allowHeaders = (string) $request->headers->get('Access-Control-Request-Headers');
$this->varyHeader($response, 'Access-Control-Request-Headers');
} else {
$allowHeaders = implode(', ', $this->allowedHeaders);
}
$response->headers->set('Access-Control-Allow-Headers', $allowHeaders);
}
private function configureAllowCredentials(Response $response, Request $request): void
{
if ($this->supportsCredentials) {
$response->headers->set('Access-Control-Allow-Credentials', 'true');
}
}
private function configureExposedHeaders(Response $response, Request $request): void
{
if ($this->exposedHeaders) {
$response->headers->set('Access-Control-Expose-Headers', implode(', ', $this->exposedHeaders));
}
}
private function configureMaxAge(Response $response, Request $request): void
{
if ($this->maxAge !== null) {
$response->headers->set('Access-Control-Max-Age', (string) $this->maxAge);
}
}
public function varyHeader(Response $response, string $header): Response
{
if (!$response->headers->has('Vary')) {
$response->headers->set('Vary', $header);
} elseif (!in_array($header, explode(', ', (string) $response->headers->get('Vary')))) {
$response->headers->set('Vary', ((string) $response->headers->get('Vary')) . ', ' . $header);
}
return $response;
}
}

16
vendor/fruitcake/php-cors/src/Exceptions/InvalidOptionException.php vendored Normal file
View File

@@ -0,0 +1,16 @@
<?php
/*
* This file is part of fruitcake/php-cors
*
* (c) Barryvdh <barryvdh@gmail.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Fruitcake\Cors\Exceptions;
class InvalidOptionException extends \RuntimeException
{
}