diff options
| -rw-r--r-- | Gemfile | 2 | ||||
| -rw-r--r-- | Gemfile.lock | 8 | ||||
| -rw-r--r-- | app/controllers/api_controller.rb | 8 | ||||
| -rw-r--r-- | config/application.rb | 13 |
4 files changed, 14 insertions, 17 deletions
diff --git a/Gemfile b/Gemfile index 7eab0a5bb..a3d5cdd45 100644 --- a/Gemfile +++ b/Gemfile @@ -4,7 +4,6 @@ gem 'rails', '5.0.0.1' gem 'sass-rails', '~> 5.0' gem 'uglifier', '>= 1.3.0' gem 'coffee-rails', '~> 4.1.0' -gem 'therubyracer', platforms: :ruby gem 'jquery-rails' gem 'jbuilder', '~> 2.0' gem 'sdoc', '~> 0.4.0', group: :doc @@ -39,6 +38,7 @@ gem 'htmlentities' gem 'simple_form' gem 'will_paginate' gem 'rack-attack' +gem 'rack-cors', require: 'rack/cors' gem 'sidekiq' gem 'ledermann-rails-settings' gem 'neography' diff --git a/Gemfile.lock b/Gemfile.lock index 38b3101df..56f9d34bc 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -157,7 +157,6 @@ GEM activerecord (>= 3.1) letter_opener (1.4.1) launchy (~> 2.2) - libv8 (3.16.14.15) link_header (0.0.8) lograge (0.4.1) actionpack (>= 4, < 5.1) @@ -219,6 +218,7 @@ GEM rack (2.0.1) rack-attack (5.0.1) rack + rack-cors (0.4.0) rack-protection (1.5.3) rack rack-test (0.6.3) @@ -281,7 +281,6 @@ GEM redis-store (~> 1.2.0) redis-store (1.2.0) redis (>= 2.2) - ref (2.0.0) responders (2.3.0) railties (>= 4.2.0, < 5.1) rspec (3.5.0) @@ -349,9 +348,6 @@ GEM activesupport (>= 4.0) sprockets (>= 3.0.0) temple (0.7.7) - therubyracer (0.12.2) - libv8 (~> 3.16.14.0) - ref thor (0.19.1) thread_safe (0.3.5) tilt (2.0.5) @@ -419,6 +415,7 @@ DEPENDENCIES puma rabl rack-attack + rack-cors rails (= 5.0.0.1) rails_12factor rails_autolink @@ -433,7 +430,6 @@ DEPENDENCIES sidekiq simple_form simplecov - therubyracer uglifier (>= 1.3.0) webmock will_paginate diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 5243f7d7b..ef453799b 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -7,7 +7,6 @@ class ApiController < ApplicationController skip_before_action :verify_authenticity_token before_action :set_rate_limit_headers - before_action :set_cors_headers rescue_from ActiveRecord::RecordInvalid do |e| render json: { error: e.to_s }, status: 422 @@ -50,13 +49,6 @@ class ApiController < ApplicationController response.headers['X-RateLimit-Reset'] = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s end - def set_cors_headers - response.headers['Access-Control-Allow-Origin'] = '*' - response.headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS' - response.headers['Access-Control-Request-Method'] = '*' - response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization' - end - def set_pagination_headers(next_path = nil, prev_path = nil) links = [] links << [next_path, [['rel', 'next']]] if next_path diff --git a/config/application.rb b/config/application.rb index 552f4ec11..dfe49b8ec 100644 --- a/config/application.rb +++ b/config/application.rb @@ -27,6 +27,15 @@ module Mastodon config.active_job.queue_adapter = :sidekiq + config.middleware.insert_before 0, Rack::Cors do + allow do + origins '*' + + resource '/api/*', :headers => :any, :methods => [:post, :put, :delete, :get, :options], credentials: false + resource '/oauth/token', :headers => :any, :methods => [:post], credentials: false + end + end + config.middleware.use Rack::Attack config.middleware.use Rack::Deflater @@ -38,9 +47,9 @@ module Mastodon end config.action_dispatch.default_headers = { - 'X-Frame-Options' => 'DENY', + 'X-Frame-Options' => 'DENY', 'X-Content-Type-Options' => 'nosniff', - 'X-XSS-Protection' => '1; mode=block' + 'X-XSS-Protection' => '1; mode=block' } end end |