Merge pull request #1207 from ArthurHoaro/feature/cors

Add CORS headers to REST API responses

diff --combined index.php
index eb717536c58f33d8b8a63b7933765c075d364b35,9c1e4999ed68ef717142b66b4511403918ed8eb6..0ef3363354e54f69a958092fafaf5d7ba619855f
--- 1/index.php
--- 2/index.php
+++ b/index.php
@@@ -1084,8 -1084,7 +1084,8 @@@ function renderPage($conf, $pluginManag
              die(t('Wrong token.'));
          }
  
 -        $alteredLinks = $LINKSDB->renameTag(escape($_POST['fromtag']), escape($_POST['totag']));
 +        $toTag = isset($_POST['totag']) ? escape($_POST['totag']) : null;
 +        $alteredLinks = $LINKSDB->renameTag(escape($_POST['fromtag']), $toTag);
          $LINKSDB->save($conf->get('resource.page_cache'));
          foreach ($alteredLinks as $link) {
              $history->updateLink($link);
@@@ -1237,10 -1236,10 +1237,10 @@@
              $id = (int) escape($id);
              $link = $LINKSDB[$id];
              $pluginManager->executeHooks('delete_link', $link);
 +            $history->deleteLink($link);
              unset($LINKSDB[$id]);
          }
          $LINKSDB->save($conf->get('resource.page_cache')); // save to disk
 -        $history->deleteLink($link);
  
          // If we are called from the bookmarklet, we must close the popup:
          if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) { echo '<script>self.close();</script>'; exit; }
@@@ -1859,6 -1858,7 +1859,7 @@@ $app->group('/api/v1', function() 
  })->add('\Shaarli\Api\ApiMiddleware');
  
  $response = $app->run(true);
+ 
  // Hack to make Slim and Shaarli router work together:
  // If a Slim route isn't found and NOT API call, we call renderPage().
  if ($response->getStatusCode() == 404 && strpos($_SERVER['REQUEST_URI'], '/api/v1') === false) {
@@@ -1866,5 -1866,12 +1867,12 @@@
      header('Content-Type: text/html; charset=utf-8');
      renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager, $loginManager);
  } else {
+     $response = $response
+         ->withHeader('Access-Control-Allow-Origin', '*')
+         ->withHeader(
+             'Access-Control-Allow-Headers',
+             'X-Requested-With, Content-Type, Accept, Origin, Authorization'
+         )
+         ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
      $app->respond($response);
  }