Merge branch '1.0.x' of gitorious.org:statusnet/mainline into 1.0.x

actions/hostmeta.php

@@ -59,7 +59,13 @@ class HostMetaAction extends Action
             Event::handle('EndHostMetaLinks', array(&$xrd->links));
         }
 
+        // Output Cross-Origin Resource Sharing (CORS) header
+        if (common_config('discovery', 'cors')) {
+            header('Access-Control-Allow-Origin: *');
+        }
+
         header('Content-type: application/xrd+xml');
+
         print $xrd->toXML();
     }
 }

actions/userxrd.php

@@ -30,6 +30,7 @@ class UserxrdAction extends XrdAction
     function prepare($args)
     {
         parent::prepare($args);
+        global $config;
 
         $this->uri = $this->trimmed('uri');
         $this->uri = self::normalize($this->uri);

config.php.sample

@@ -41,6 +41,12 @@ $config['site']['path'] = 'statusnet';
 // Make the site invisible to  non-logged-in users
 // $config['site']['private'] = true;
 
+// Allow Cross-Origin Resource Sharing (CORS) for service discovery
+// (host-meta, XRD, etc.) Useful for AJAXy client applications. Should
+// probably NOT be on for private / intranet sites but OK for public sites.
+// Default is off.
+// $config['discovery']['cors'] = true;
+
 // If your web server supports X-Sendfile (Apache with mod_xsendfile,
 // lighttpd, nginx), you can enable X-Sendfile support for better
 // performance. Presently, only attachment serving when the site is

lib/default.php

@@ -349,4 +349,6 @@ $default =
               ),
         'router' =>
         array('cache' => true), // whether to cache the router object. Defaults to true, turn off for devel
+        'discovery' =>
+        array('cors' => false) // Allow Cross-Origin Resource Sharing for service discovery (host-meta, XRD, etc.)
     );

lib/xrdaction.php

@@ -117,7 +117,12 @@ class XrdAction extends Action
             Event::handle('EndXrdActionLinks', array(&$xrd, $this->user));
         }
 
+        if (common_config('discovery', 'cors')) {
+            header('Access-Control-Allow-Origin: *');
+        }
+
         header('Content-type: application/xrd+xml');
+
         print $xrd->toXML();
     }