Websocket CORS Support (#5667)

* Second attept at patching api/websocket.go for CORS support.

* Missing include

* Fixed whitespace formatting so that gofmt passes.

* Added tests for CORS filtering

1 files changed, 16 insertions, 1 deletions

diff --git a/api/websocket.go b/api/websocket.go
index 5c0858910..2de9abb0a 100644
--- a/api/websocket.go
+++ b/api/websocket.go
@@ -5,6 +5,7 @@ package api
 
 import (
 	"net/http"
+	"strings"
 
 	l4g "github.com/alecthomas/log4go"
 	"github.com/gorilla/websocket"
@@ -19,11 +20,25 @@ func InitWebSocket() {
 	app.HubStart()
 }
 
+type OriginCheckerProc func(*http.Request) bool
+
+func OriginChecker(r *http.Request) bool {
+	origin := r.Header.Get("Origin")
+	return *utils.Cfg.ServiceSettings.AllowCorsFrom == "*" || strings.Contains(origin, *utils.Cfg.ServiceSettings.AllowCorsFrom)
+}
+
 func connect(c *Context, w http.ResponseWriter, r *http.Request) {
+
+	var originChecker OriginCheckerProc = nil
+
+	if len(*utils.Cfg.ServiceSettings.AllowCorsFrom) > 0 {
+		originChecker = OriginChecker
+	}
+
 	upgrader := websocket.Upgrader{
 		ReadBufferSize:  model.SOCKET_MAX_MESSAGE_SIZE_KB,
 		WriteBufferSize: model.SOCKET_MAX_MESSAGE_SIZE_KB,
-		CheckOrigin:     nil,
+		CheckOrigin:     originChecker,
 	}
 
 	ws, err := upgrader.Upgrade(w, r, nil)