diff options
| author | Andreas Gohr <andi@splitbrain.org> | 2025-03-15 10:50:27 +0100 |
|---|---|---|
| committer | Andreas Gohr <andi@splitbrain.org> | 2025-03-15 10:50:27 +0100 |
| commit | 5ed7bacec486014377d5973347d50fb7953c84ad (patch) | |
| tree | 9c723199e8294d57eb5320e4b4e7536521482243 | |
| parent | 999fe614933a32bd80b5e25f09685b6215d54998 (diff) | |
| download | dokuwiki-5ed7bacec486014377d5973347d50fb7953c84ad.tar.gz dokuwiki-5ed7bacec486014377d5973347d50fb7953c84ad.zip | |
set crossorigin header for manifest. fixes #4322
To summarize the issue:
1. the wiki is protected by Basic auth, outside of the wiki
2. chrome will not pass authentication credentials when accessing a
linked manifest
3. the webserver will deny access to the manifest
DokuWiki does not care about the auth credentials, because the manifest
returns public info only. The issue is really with the webserver
denying the request.
Using a crossorigin hint will work around the chrome behaviour. The only
potential downside would be that chrome now will send auth credentials
even when there is no web server based auth. Since DokuWiki doesn't care,
it's not really a downside.
| -rw-r--r-- | inc/template.php | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/inc/template.php b/inc/template.php index 7cf303aae..db524c986 100644 --- a/inc/template.php +++ b/inc/template.php @@ -269,7 +269,8 @@ function tpl_metaheaders($alt = true) if (actionOK('manifest')) { $head['link'][] = [ 'rel' => 'manifest', - 'href' => DOKU_BASE . 'lib/exe/manifest.php' + 'href' => DOKU_BASE . 'lib/exe/manifest.php', + 'crossorigin' => 'use-credentials' // See issue #4322 ]; } |