CORS settings in webui (librenms#11912)

* Change CORS implementation
allows for upstream integration of Laravel 7

* migrate config

* skip implementing patterns for now

* Expose settings to the webui

* Make db settings apply

app/Http/Kernel.php

@@ -16,6 +16,7 @@ class Kernel extends HttpKernel
      */
     protected $middleware = [
         \App\Http\Middleware\TrustProxies::class,
+        \App\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\CheckForMaintenanceMode::class,
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,
@@ -54,7 +55,6 @@ class Kernel extends HttpKernel
         'api' => [
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
             'authenticate:token',
-            \Spatie\Cors\Cors::class,
         ],
     ];
 

app/Http/Middleware/HandleCors.php

@@ -0,0 +1,61 @@
+<?php
+/**
+ * HandleCors.php
+ *
+ * Check and load cors settings from db config at runtime
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @package    LibreNMS
+ * @link       http://librenms.org
+ * @copyright  2020 Tony Murray
+ * @author     Tony Murray <[email protected]>
+ */
+
+namespace App\Http\Middleware;
+
+use Asm89\Stack\CorsService;
+use Illuminate\Contracts\Container\Container;
+
+class HandleCors extends \Fruitcake\Cors\HandleCors
+{
+    private $map = [
+        'allowmethods' => 'allowed_methods',
+        'origin' => 'allowed_origins',
+        'allowheaders' => 'allowed_headers',
+        'exposeheaders' => 'exposed_headers',
+        'maxage' => 'max_age',
+        'allowcredentials' => 'supports_credentials',
+    ];
+
+    public function __construct(Container $container)
+    {
+        // load legacy config settings before booting the CorsService
+        if (\LibreNMS\Config::get('api.cors.enabled')) {
+            $laravel_config = $container['config']->get('cors');
+            $legacy = \LibreNMS\Config::get('api.cors');
+
+            $laravel_config['paths'][] = 'api/*';
+
+            foreach ($this->map as $config_key => $option_key) {
+                $laravel_config[$option_key] = $legacy[$config_key] ?? $laravel_config[$option_key];
+            }
+
+            $container['config']->set('cors', $laravel_config);
+        }
+
+        $cors = $container->make(CorsService::class);
+        parent::__construct($cors, $container);
+    }
+}

composer.json

@@ -39,6 +39,7 @@
         "ezyang/htmlpurifier": "^4.8",
         "fico7489/laravel-pivot": "^3.0",
         "fideloper/proxy": "^4.0",
+        "fruitcake/laravel-cors": "^2.0",
         "influxdb/influxdb-php": "^1.14",
         "laravel/framework": "^6.18",
         "laravel/tinker": "^2.0",
@@ -49,7 +50,6 @@
         "php-amqplib/php-amqplib": "^2.0",
         "phpmailer/phpmailer": "~6.0",
         "rmccue/requests": "^1.7",
-        "spatie/laravel-cors": "^1.6",
         "symfony/yaml": "^4.0",
         "tecnickcom/tcpdf": "~6.2.0",
         "tightenco/ziggy": "^0.8.0",