1
0

ApiController.php 3.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Bernhard Posselt <dev@bernhard-posselt.com>
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Morris Jobke <hey@morrisjobke.de>
  8. *
  9. * @license AGPL-3.0
  10. *
  11. * This code is free software: you can redistribute it and/or modify
  12. * it under the terms of the GNU Affero General Public License, version 3,
  13. * as published by the Free Software Foundation.
  14. *
  15. * This program is distributed in the hope that it will be useful,
  16. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. * GNU Affero General Public License for more details.
  19. *
  20. * You should have received a copy of the GNU Affero General Public License, version 3,
  21. * along with this program. If not, see <http://www.gnu.org/licenses/>
  22. *
  23. */
  24. namespace OCP\AppFramework;
  25. use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
  26. use OCP\AppFramework\Http\Attribute\PublicPage;
  27. use OCP\AppFramework\Http\Response;
  28. use OCP\IRequest;
  29. /**
  30. * Base class to inherit your controllers from that are used for RESTful APIs
  31. * @since 7.0.0
  32. */
  33. abstract class ApiController extends Controller {
  34. private $corsMethods;
  35. private $corsAllowedHeaders;
  36. private $corsMaxAge;
  37. /**
  38. * constructor of the controller
  39. * @param string $appName the name of the app
  40. * @param IRequest $request an instance of the request
  41. * @param string $corsMethods comma separated string of HTTP verbs which
  42. * should be allowed for websites or webapps when calling your API, defaults to
  43. * 'PUT, POST, GET, DELETE, PATCH'
  44. * @param string $corsAllowedHeaders comma separated string of HTTP headers
  45. * which should be allowed for websites or webapps when calling your API,
  46. * defaults to 'Authorization, Content-Type, Accept'
  47. * @param int $corsMaxAge number in seconds how long a preflighted OPTIONS
  48. * request should be cached, defaults to 1728000 seconds
  49. * @since 7.0.0
  50. */
  51. public function __construct($appName,
  52. IRequest $request,
  53. $corsMethods = 'PUT, POST, GET, DELETE, PATCH',
  54. $corsAllowedHeaders = 'Authorization, Content-Type, Accept',
  55. $corsMaxAge = 1728000) {
  56. parent::__construct($appName, $request);
  57. $this->corsMethods = $corsMethods;
  58. $this->corsAllowedHeaders = $corsAllowedHeaders;
  59. $this->corsMaxAge = $corsMaxAge;
  60. }
  61. /**
  62. * This method implements a preflighted cors response for you that you can
  63. * link to for the options request
  64. *
  65. * @NoAdminRequired
  66. * @NoCSRFRequired
  67. * @PublicPage
  68. * @since 7.0.0
  69. */
  70. #[NoCSRFRequired]
  71. #[PublicPage]
  72. public function preflightedCors() {
  73. if (isset($this->request->server['HTTP_ORIGIN'])) {
  74. $origin = $this->request->server['HTTP_ORIGIN'];
  75. } else {
  76. $origin = '*';
  77. }
  78. $response = new Response();
  79. $response->addHeader('Access-Control-Allow-Origin', $origin);
  80. $response->addHeader('Access-Control-Allow-Methods', $this->corsMethods);
  81. $response->addHeader('Access-Control-Max-Age', (string)$this->corsMaxAge);
  82. $response->addHeader('Access-Control-Allow-Headers', $this->corsAllowedHeaders);
  83. $response->addHeader('Access-Control-Allow-Credentials', 'false');
  84. return $response;
  85. }
  86. }