Wordpress 3.5

[autoinstalls/wordpress.git] / wp-includes / http.php

diff --git a/wp-includes/http.php b/wp-includes/http.php
index dd9df6e73f69480b688ac6bd950411412722d637..56e4f9ff20a7725c2fc6600da028ca14497011a4 100644 (file)
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -19,7 +19,7 @@
  *
  * @return WP_Http HTTP Transport object.
  */
  *
  * @return WP_Http HTTP Transport object.
  */

-function &_wp_http_get_object() {
+function _wp_http_get_object() {

        static $http;
 
        if ( is_null($http) )
        static $http;
 
        if ( is_null($http) )


@@ -284,6 +284,10 @@ function is_allowed_http_origin( $origin = null ) {
  * Send Access-Control-Allow-Origin and related headers if the current request
  * is from an allowed origin.
  *
  * Send Access-Control-Allow-Origin and related headers if the current request
  * is from an allowed origin.
  *

+ * If the request is an OPTIONS request, the script exits with either access
+ * control headers sent, or a 403 response if the origin is not allowed. For
+ * other request methods, you will receive a return value.
+ *

  * @since 3.4.0
  *
  * @return bool|string Returns the origin URL if headers are sent. Returns false
  * @since 3.4.0
  *
  * @return bool|string Returns the origin URL if headers are sent. Returns false


@@ -291,11 +295,19 @@ function is_allowed_http_origin( $origin = null ) {
  */
 function send_origin_headers() {
        $origin = get_http_origin();
  */
 function send_origin_headers() {
        $origin = get_http_origin();

-       if ( ! is_allowed_http_origin( $origin ) )
-               return false;

 
 

-       @header( 'Access-Control-Allow-Origin: ' .  $origin );
-       @header( 'Access-Control-Allow-Credentials: true' );
+       if ( is_allowed_http_origin( $origin ) ) {
+               @header( 'Access-Control-Allow-Origin: ' .  $origin );
+               @header( 'Access-Control-Allow-Credentials: true' );
+               if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
+                       exit;
+               return $origin;
+       }

 
 

-       return $origin;
-}
\ No newline at end of file
+       if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
+               status_header( 403 );
+               exit;
+       }
+
+       return false;
+}