Merge pull request #43 from pterodactyl/impl/2194

Add the ability to define additional allowed origins

router/middleware.go

@@ -11,8 +11,22 @@ import (
 
 // Set the access request control headers on all of the requests.
 func SetAccessControlHeaders(c *gin.Context) {
-	c.Header("Access-Control-Allow-Origin", config.Get().PanelLocation)
 	c.Header("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")
+
+	o := c.GetHeader("Origin")
+	if o != config.Get().PanelLocation {
+		for _, origin := range config.Get().AllowedOrigins {
+			if o != origin {
+				continue
+			}
+
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Next()
+			return
+		}
+	}
+
+	c.Header("Access-Control-Allow-Origin", config.Get().PanelLocation)
 	c.Next()
 }
 

router/websocket/websocket.go

@@ -57,7 +57,20 @@ func GetHandler(s *server.Server, w http.ResponseWriter, r *http.Request) (*Hand
 		// Ensure that the websocket request is originating from the Panel itself,
 		// and not some other location.
 		CheckOrigin: func(r *http.Request) bool {
-			return r.Header.Get("Origin") == config.Get().PanelLocation
+			o := r.Header.Get("Origin")
+			if o == config.Get().PanelLocation {
+				return true
+			}
+
+			for _, origin := range config.Get().AllowedOrigins {
+				if o != origin {
+					continue
+				}
+
+				return true
+			}
+
+			return false
 		},
 	}