
__all__ = ['internal_origin_only']

from urllib.parse import urlparse
from functools import wraps
from werkzeug.exceptions import Forbidden

import flask
import re


def internal_origin_only(fn):
    @wraps(fn)
    def wrapper(*args, **kwargs):
        h = urlparse('http://' + flask.request.headers.get('Host', ''))
        host = '%s:%i' % (h.hostname, h.port or 80)

        if 'Origin' in flask.request.headers:
            o = urlparse(flask.request.headers.get('Origin'))
            origin = '%s:%i' % (o.hostname, o.port or 80)
        elif 'Referer' in flask.request.headers:
            r = urlparse(flask.request.headers.get('Referer'))
            origin = '%s:%i' % (r.hostname, r.port or 80)
        else:
            origin = host

        if host != origin:
            raise Forbidden('Cross-Site Request Forbidden')

        return fn(*args, **kwargs)
    return wrapper


# vim:set sw=4 ts=4 et:


__all__ = ['internal_origin_only']

from urllib.parse import urlparse
from functools import wraps
from werkzeug.exceptions import Forbidden

import flask
import re


def internal_origin_only(fn):
    @wraps(fn)
    def wrapper(*args, **kwargs):
        host = flask.request.headers.get('X-Forwarded-Host') or \
               flask.request.headers.get('Host', '')

        h = urlparse('http://' + host)

        origin = flask.request.headers.get('Origin') or \
                 flask.request.headers.get('Referer') or \
                 host
        o = urlparse(origin)

        if h.hostname != o.hostname:
            raise Forbidden('Cross-Site Request Forbidden')

        return fn(*args, **kwargs)
    return wrapper


# vim:set sw=4 ts=4 et:

Change cross-origin check to work behind proxies
Change cross-origin check to work behind proxies

Signed-off-by: Jan Dvořák <86df5a4870880bf501c926309e3bcfbe57789f3f@anilinux.org>

  
  __all__ = ['internal_origin_only']
  
  from urllib.parse import urlparse
  from functools import wraps
  from werkzeug.exceptions import Forbidden
  
  import flask
  import re
  
  
  def internal_origin_only(fn):
      @wraps(fn)
      def wrapper(*args, **kwargs):
-         h = urlparse('http://' + flask.request.headers.get('Host', ''))
-         host = '%s:%i' % (h.hostname, h.port or 80)
+         host = flask.request.headers.get('X-Forwarded-Host') or \
+                flask.request.headers.get('Host', '')
  
+         h = urlparse('http://' + host)
-         if 'Origin' in flask.request.headers:
-             o = urlparse(flask.request.headers.get('Origin'))
-             origin = '%s:%i' % (o.hostname, o.port or 80)
-         elif 'Referer' in flask.request.headers:
-             r = urlparse(flask.request.headers.get('Referer'))
-             origin = '%s:%i' % (r.hostname, r.port or 80)
-         else:
-             origin = host
  
-         if host != origin:
+         origin = flask.request.headers.get('Origin') or \
+                  flask.request.headers.get('Referer') or \
+                  host
+         o = urlparse(origin)
+ 
+         if h.hostname != o.hostname:
              raise Forbidden('Cross-Site Request Forbidden')
  
          return fn(*args, **kwargs)
      return wrapper
  
  
  # vim:set sw=4 ts=4 et:
  
Change cross-origin check to work behind proxies
## Code Before:

__all__ = ['internal_origin_only']

from urllib.parse import urlparse
from functools import wraps
from werkzeug.exceptions import Forbidden

import flask
import re


def internal_origin_only(fn):
    @wraps(fn)
    def wrapper(*args, **kwargs):
        h = urlparse('http://' + flask.request.headers.get('Host', ''))
        host = '%s:%i' % (h.hostname, h.port or 80)

        if 'Origin' in flask.request.headers:
            o = urlparse(flask.request.headers.get('Origin'))
            origin = '%s:%i' % (o.hostname, o.port or 80)
        elif 'Referer' in flask.request.headers:
            r = urlparse(flask.request.headers.get('Referer'))
            origin = '%s:%i' % (r.hostname, r.port or 80)
        else:
            origin = host

        if host != origin:
            raise Forbidden('Cross-Site Request Forbidden')

        return fn(*args, **kwargs)
    return wrapper


# vim:set sw=4 ts=4 et:

## Instruction:
Change cross-origin check to work behind proxies
## Code After:

__all__ = ['internal_origin_only']

from urllib.parse import urlparse
from functools import wraps
from werkzeug.exceptions import Forbidden

import flask
import re


def internal_origin_only(fn):
    @wraps(fn)
    def wrapper(*args, **kwargs):
        host = flask.request.headers.get('X-Forwarded-Host') or \
               flask.request.headers.get('Host', '')

        h = urlparse('http://' + host)

        origin = flask.request.headers.get('Origin') or \
                 flask.request.headers.get('Referer') or \
                 host
        o = urlparse(origin)

        if h.hostname != o.hostname:
            raise Forbidden('Cross-Site Request Forbidden')

        return fn(*args, **kwargs)
    return wrapper


# vim:set sw=4 ts=4 et:
