Bug 1839897: Allow mobile app to access certain landing pages

By adjusting the CORS restrictions

behatnotneeded

Change-Id: I6cbdf260e3c0b290cbc0fabfea4969aaeda74db4
(cherry picked from commit 9089a4c2)

htdocs/module/mobileapi/download.php

@@ -35,6 +35,7 @@ require_once($CFG->docroot . '/webservice/lib.php');
 
 // Allow CORS requests.
 header('Access-Control-Allow-Origin: *');
+header('Access-Control-Allow-Credentials: false');
 
 /**
  * A "deconstructed" webserver class to handle only the parts of the

htdocs/module/mobileapi/json/info.php

@@ -40,6 +40,11 @@ $response['maharaversion'] = get_config('series');
 $response['wwwroot'] = get_config('wwwroot');
 $response['sitename'] = get_config('sitename');
 
+// Allow CORS requests.
+header('Access-Control-Allow-Origin: *');
+header('Access-Control-Allow-Credentials: false');
+
+
 if (!$CFG->webservice_provider_enabled) {
     $response['wsenabled'] = false;
     echo json_encode((object)$response);

htdocs/module/mobileapi/json/token.php

@@ -59,6 +59,7 @@ if (!PluginModuleMobileapi::is_service_ready()) {
 
 // Allow CORS requests.
 header('Access-Control-Allow-Origin: *');
+header('Access-Control-Allow-Credentials: false');
 
 $username = param_variable('username');
 $password = param_variable('password');

htdocs/webservice/rest/locallib.php

@@ -309,6 +309,9 @@ class webservice_rest_server extends webservice_base_server {
         header('Expires: '. gmdate('D, d M Y H:i:s', 0) . ' GMT');
         header('Pragma: no-cache');
         header('Accept-Ranges: none');
+         // Allow CORS requests.
+        header('Access-Control-Allow-Origin: *');
+        header('Access-Control-Allow-Credentials: false');
     }
 
     /**

htdocs/webservice/xmlrpc/locallib.php

@@ -444,6 +444,7 @@ class webservice_xmlrpc_server extends webservice_base_server {
         // Allow cross-origin requests only for Web Services.
         // This allow to receive requests done by Web Workers or webapps in different domains.
         header('Access-Control-Allow-Origin: *');
+        header('Access-Control-Allow-Credentials: false');
     }
     /**
      * Generate the XML-RPC fault response.