Merge branch 'master' of https://github.com/unaio/una

cmts.php

@@ -12,6 +12,8 @@ require_once(BX_DIRECTORY_PATH_INC . "design.inc.php");
 
 bx_import('BxDolLanguages');
 
+bx_api_check_origins();
+
 check_logged();
 
 $sSys = isset($_REQUEST['sys']) ? bx_process_input($_REQUEST['sys']) : '';

inc/utils.inc.php

@@ -2326,7 +2326,33 @@ function bx_absolute_url($sUrl, $sPrefix = BX_DOL_URL_ROOT)
 
 function bx_is_api()
 {
-    return defined('BX_API') ? true : false;
+    if (bx_get('api-acc')){
+        $iCookieTime = true ? time() + 60 * getParam('sys_session_lifetime_in_min') : 0;
+        bx_setcookie("memberID", 1, $iCookieTime, 'auto');
+        check_logged();
+    }
+    return defined('BX_API') || bx_get('api') ? true : false;
+}
+
+function bx_api_check_origins()
+{
+    if (isset($_SERVER['HTTP_ORIGIN']) && parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST) != parse_url(BX_DOL_URL_ROOT, PHP_URL_HOST)) {
+
+        $aAllowedOrigins = ['http://app.una.io:3000', 'http://ci.una.io:3000', 'http://localhost:3000', 'https://una.io']; // TODO: separate config
+        if (!in_array($_SERVER['HTTP_ORIGIN'], $aAllowedOrigins)) {
+            header('HTTP/1.0 403 Forbidden');
+            echo json_encode(['status' => 403, 'error' => _t("_Access denied")]);
+            exit;
+        } 
+
+        header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
+
+        if ('OPTIONS' == $_SERVER['REQUEST_METHOD']) {
+            header('Access-Control-Allow-Methods: POST, GET');
+            header('Access-Control-Allow-Headers: Accept-Encoding, Authorization, Cache-Control, Connection, Host, Origin, Pragma, Referer, User-Agent, X-Custom-Header, X-Requested-With');                    
+            exit;
+        }            
+    }
 }
 
 /** @} */

template/scripts/BxBaseCmts.php

@@ -1135,21 +1135,23 @@ class BxBaseCmts extends BxDolCmts
     protected function _getFormPost($iCmtParentId = 0, $aDp = [])
     {
         $bCmtParentId = !empty($iCmtParentId);
-        if(!$bCmtParentId && !$this->isPostAllowed()) {
-            $sMsg = '';
-            if(!isLogged()) {
-                $oPermalink = BxDolPermalinks::getInstance();
-                $sMsg = _t('_cmt_msg_login_required', $oPermalink->permalink('page.php?i=login'), $oPermalink->permalink('page.php?i=create-account'));
+        if (!bx_is_api()){
+            if(!$bCmtParentId && !$this->isPostAllowed()) {
+                $sMsg = '';
+                if(!isLogged()) {
+                    $oPermalink = BxDolPermalinks::getInstance();
+                    $sMsg = _t('_cmt_msg_login_required', $oPermalink->permalink('page.php?i=login'), $oPermalink->permalink('page.php?i=create-account'));
+                }
+                else
+                    $sMsg = $this->msgErrPostAllowed();
+
+                return ['msg' => $sMsg];
             }
-            else
-                $sMsg = $this->msgErrPostAllowed();
 
-            return ['msg' => $sMsg];
+            if($bCmtParentId && !$this->isReplyAllowed($iCmtParentId))
+                return ['msg' => $this->msgErrReplyAllowed()];
         }
 
-        if($bCmtParentId && !$this->isReplyAllowed($iCmtParentId))
-            return ['msg' => $this->msgErrReplyAllowed()];
-
         $bDynamic = isset($aDp['dynamic_mode']) && (bool)$aDp['dynamic_mode'];
         $bQuote = isset($aDp['quote']) && (bool)$aDp['quote'];
 
@@ -1234,7 +1236,7 @@ class BxBaseCmts extends BxDolCmts
             return ['msg' => _t('_cmt_err_cannot_perform_action')];
         }
 
-        return ['form' => $oForm->getCode($bDynamic), 'form_id' => $oForm->id];
+        return ['form' => $oForm->getCode($bDynamic), 'form_id' => $oForm->id, 'frm' => $oForm];
     }
 
     protected function _getFormEdit($iCmtId, $aDp = [])