og/Pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CORS头冲突修复 — 删除方法级重复header，统一由构造函数处理

Browse Source 
根因：构造函数设 Access-Control-Allow-Origin: 具体域名 + Credentials: true，
但每个方法又覆盖成 Origin: *，导致 Credentials+通配符冲突，浏览器拒绝请求。
删除全部41处方法级CORS头，只保留构造函数的白名单机制。
This commit is contained in:
fengshao1227
2026-05-28 14:29:43 +08:00
parent 24c71fa7a0
commit 0f952a36a5
1 changed files with 0 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/onlinechip/controller/Pcapi.php
-125
View File
@@ -50,9 +50,6 @@ class Pcapi extends Controller{
}
public function get_version(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
return json(config('app_version'));
}
public function get_system_info(){
@@ -66,9 +63,6 @@ class Pcapi extends Controller{
}
//试玩登录
public function demologin(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -121,9 +115,6 @@ class Pcapi extends Controller{
//保持在线--心跳
public function keepOnline(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -147,9 +138,6 @@ class Pcapi extends Controller{
}
//登录optimum
public function login(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -255,9 +243,6 @@ class Pcapi extends Controller{
}
// 获取用户信息
public function get_user_info(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -324,9 +309,6 @@ class Pcapi extends Controller{
}
//用户钱
public function user_money(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -350,9 +332,6 @@ class Pcapi extends Controller{
}
//修改密码
public function update_password(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -390,9 +369,6 @@ class Pcapi extends Controller{
}
//打赏
public function to_tip(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -436,9 +412,6 @@ class Pcapi extends Controller{
}
//好路
public function good_road(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -474,9 +447,6 @@ class Pcapi extends Controller{
}
//返回全部桌子
public function all_table(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -1219,9 +1189,6 @@ class Pcapi extends Controller{
}
//返回单张桌子
public function singletable(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
// $json_arr = Request::instance()->post();
@@ -1770,9 +1737,6 @@ class Pcapi extends Controller{
}
//今日最佳
public function optimum(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -1798,9 +1762,6 @@ class Pcapi extends Controller{
}
//游戏记录
public function get_user_bets(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2318,9 +2279,6 @@ class Pcapi extends Controller{
}
//上下分记录
public function recharge_record(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2387,9 +2345,6 @@ class Pcapi extends Controller{
}
//上下分记录
public function tip_record(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2449,9 +2404,6 @@ class Pcapi extends Controller{
}
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_baccarat(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2608,9 +2560,6 @@ class Pcapi extends Controller{
}
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_dt(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2699,9 +2648,6 @@ class Pcapi extends Controller{
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_nn(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2734,9 +2680,6 @@ class Pcapi extends Controller{
}
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_tc(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2769,9 +2712,6 @@ class Pcapi extends Controller{
}
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_toning(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2803,9 +2743,6 @@ class Pcapi extends Controller{
}
//开结果后获取会员的下注信息及计算其输赢数目
public function user_bet_dice(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2836,9 +2773,6 @@ class Pcapi extends Controller{
}
}
public function user_bet_roulette(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2870,9 +2804,6 @@ class Pcapi extends Controller{
}
//快速提现
public function show_withdrawal(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2900,9 +2831,6 @@ class Pcapi extends Controller{
}
//确认提现
public function withdrawal(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -2983,9 +2911,6 @@ class Pcapi extends Controller{
}
//充值信息
public function show_recharge(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -3022,9 +2947,6 @@ class Pcapi extends Controller{
}
//确认充值
public function recharge(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -3081,9 +3003,6 @@ class Pcapi extends Controller{
}
//游戏记录
public function get_rob_bet(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -3299,9 +3218,6 @@ class Pcapi extends Controller{
//电话呼入
public function online_call(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
$phone = Request::instance()->post('phone');
if($phone){
$table_info = Db::name('table')->where('phone',$phone)->find();
@@ -3331,9 +3247,6 @@ class Pcapi extends Controller{
* DateTime: 2019/12/12 12:53
*/
public function doRegister(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST');
if($data = Request::instance()->post()){
$data = decrypt_data($data);
$username = isset($data['username'])?$data['username']:'';
@@ -3687,9 +3600,6 @@ class Pcapi extends Controller{
//登录
public function lineLogin(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -3762,9 +3672,6 @@ class Pcapi extends Controller{
}
public function app_entrance(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$entrance = array();
$entrance['HallUrl'] = HallUrl;
@@ -3780,9 +3687,6 @@ class Pcapi extends Controller{
}
//api用户通过接口获取铺信息
public function api_get_info(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$appId = intval(Request::instance()->post("appId"));
$nonceStr = trim(Request::instance()->post("nonceStr"));
@@ -3831,9 +3735,6 @@ class Pcapi extends Controller{
// 用户充值记录
public function user_recharge()
{
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()) {
$json_arr = decrypt_data(Request::instance()->post());
if ($json_arr) {
@@ -3869,9 +3770,6 @@ class Pcapi extends Controller{
// 用户提现记录
public function user_withdraw()
{
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()) {
$json_arr = decrypt_data(Request::instance()->post());
if ($json_arr) {
@@ -3907,9 +3805,6 @@ class Pcapi extends Controller{
//申请提现
public function apply_withdraw(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -3983,9 +3878,6 @@ class Pcapi extends Controller{
// 申请银行卡提现（越南AlinPay）
public function apply_withdraw_bank(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr){
@@ -4079,9 +3971,6 @@ class Pcapi extends Controller{
// 获取越南银行列表
public function get_bank_list_vn(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
$banks = \pay\AlinPay::getBankCodes();
$list = [];
@@ -4099,9 +3988,6 @@ class Pcapi extends Controller{
// 取消提现
public function cancel_withdraw(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr) {
@@ -4157,9 +4043,6 @@ class Pcapi extends Controller{
*/
public function deposit()
{
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr) {
@@ -4221,9 +4104,6 @@ class Pcapi extends Controller{
*/
public function get_free_seat(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE');
if(Request::instance()->isPost()){
$json_arr = decrypt_data(Request::instance()->post());
if($json_arr) {
@@ -4265,11 +4145,6 @@ class Pcapi extends Controller{
* 无需鉴权，游客可访问
*/
public function get_lobby_data(){
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization");
header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE,OPTIONS');
header('Access-Control-Max-Age: 86400');
// 处理 OPTIONS 预检请求
if(Request::instance()->isOptions()){
return response('', 200);