cors enable by default

limit cors only get, head, options

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: goreleaser
+on:
+  push:
+    # run only against tags
+    tags:
+      - '*'
+permissions:
+  contents: write
+  # packages: write
+  # issues: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Fetch all tags
+        run: git fetch --force --tags
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.18
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v2
+        with:
+          # either 'goreleaser' (default) or 'goreleaser-pro'
+          distribution: goreleaser
+          version: latest
+          args: release --rm-dist
+        env:
+          GITHUB_TOKEN: ${{ secrets.TOKEN }}

.gitignore

@@ -31,3 +31,4 @@ assets_vfsdata.go
 *.swp
 
 dist/
+.DS_Store

.travis.yml

@@ -1,25 +0,0 @@
-services:
-  - docker
-language: go
-go:
-  - "1.18"
-env:
-  - GO111MODULE=on
-script:
-  - go test -v
-addons:
-  apt:
-    packages:
-      - docker-ce
-deploy:
-  - provider: script
-    skip_cleanup: true
-    script: curl -sL https://git.io/goreleaser | bash
-    on:
-      tags: true
-      condition: $TRAVIS_OS_NAME = linux
-  #- provider: script
-  #  skip_cleanup: true
-  #  script: bash docker/push_images && bash docker/push_manifest
-  #  on:
-  #    branch: master

main.go

@@ -33,7 +33,6 @@ type Configure struct {
 	HTTPAuth        string   `yaml:"httpauth"`
 	Cert            string   `yaml:"cert"`
 	Key             string   `yaml:"key"`
-	Cors            bool     `yaml:"cors"`
 	Theme           string   `yaml:"theme"`
 	XHeaders        bool     `yaml:"xheaders"`
 	Upload          bool     `yaml:"upload"`
@@ -116,7 +115,6 @@ func parseFlags() error {
 	kingpin.Flag("upload", "enable upload support").BoolVar(&gcfg.Upload)
 	kingpin.Flag("delete", "enable delete support").BoolVar(&gcfg.Delete)
 	kingpin.Flag("xheaders", "used when behide nginx").BoolVar(&gcfg.XHeaders)
-	kingpin.Flag("cors", "enable cross-site HTTP request").BoolVar(&gcfg.Cors)
 	kingpin.Flag("debug", "enable debug mode").BoolVar(&gcfg.Debug)
 	kingpin.Flag("plistproxy", "plist proxy when server is not https").Short('p').StringVar(&gcfg.PlistProxy)
 	kingpin.Flag("title", "server title").StringVar(&gcfg.Title)
@@ -148,6 +146,19 @@ func fixPrefix(prefix string) string {
 	return prefix
 }
 
+func cors(next http.Handler) http.Handler {
+	// access control and CORS middleware
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "*")
+		w.Header().Set("Access-Control-Allow-Headers", "*")
+		if r.Method == "OPTIONS" {
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func main() {
 	if err := parseFlags(); err != nil {
 		log.Fatal(err)
@@ -206,9 +217,8 @@ func main() {
 	}
 
 	// CORS
-	if gcfg.Cors {
-		hdlr = handlers.CORS()(hdlr)
-	}
+	hdlr = cors(hdlr)
+
 	if gcfg.XHeaders {
 		hdlr = handlers.ProxyHeaders(hdlr)
 	}

testdata/filetypes/script.js

@@ -0,0 +1 @@
+document.write("Hello world!")