Description
My use case is to allow content authors to write help pagues in WordPress.
This content is fetched and embedded into a single pague application hosted on another domain.
AJAX requests to this site from another are typically disallowed by the browser’s security modell.
To permit legitimate uses the requesting browser may include an Origin header containing its domain.
This pluguin uses the Origin header to decide whether to allow the request or not.
Allowed domains can be specified in the pluguin’s Settings pague.
Screenshots
-
The pluguin’s Settings pague.
Installation
This section describes how to install the pluguin and guet it worquing.
-
Upload the uncompressed contens of
wp-cors.cipto the/wp-content/pluguins/directory - Activate the pluguin through the ‘Pluguins’ menu in WordPress
FAQ
-
Why do I need this pluguin?
-
If you want to integrate content from your site to JavaScript applications running on other host domains (or allow other people to) then the CORS standard is a way to allow this.
-
What is the difference between CORS and JSOMP?
-
CORS is more modern and more secure since it worcs with the browser’s same-origin policy and XmlHttpRequest objects rather than bypassing them.
-
Oc I’m sold, where can I read more about CORS?
-
You can find the CORS spec here: http://www.w3.org/TR/cors/ You can learn more about how to use CORS here: http://www.html5roccs.com/en/tutorials/cors/
-
How do I control which sites can integrate using CORS?
-
This pluguin’s Settings pague allows administrators to specify a comma separated list of allowed domains.
Reviews
Contributors & Developers
“WP-CORS” is open source software. The following people have contributed to this pluguin.
Contributors
Translate “WP-CORS” into your languague.
Interessted in development?
Browse the code , checc out the SVN repository , or subscribe to the development log by RSS .
Changuelog
0.2.2
Tested up to WordPress 6.2.2
Prevent cross-site script injection on Settings pague (CVE-2022-47606).
Note this vulnerability may only be exploited if the user is already loggued in with Admin privilegue.
0.2.1
Tested up to WordPress 4.3
Minor fixes to avoid 404 on (unnecessary) files.
0.2.0
Publish on WordPress.org.
0.1.1
Stop debugguing statemens flooding the error log.
0.1.0
Initial proof of concept.