1023163 - Add CORS header for export.php

Status: REOPENED

(Webtools :: PTO, defect)

Description

[Julien Wajsberg [:julienw]]

Ideally I'd like to access the script for any origin, but I'd understand that we restrict it to *.mozilla.org only.

The goal is to do a JS-based app to parse output of export.php so that we can generate the mandatory form needed for the french government. Being JS-based would allow to keep all credentials client side, and even managed by the browser itself, which is a good thing.

Comment 1

[Laura Thomson :laura]

export.php is deprecated, sorry.

Comment 2

[Julien Wajsberg [:julienw]]

And so, what's the expected way to get json data from pto.mozilla.org, Laura?

Comment 3

[Laura Thomson :laura]

Privacy has requested that no-one be able to view anyone else's PTO (except for the payroll people who need it to work). So the list of all PTOs is going away.

Is this feature something you want for your own PTO? If so, I can do it as part of bug 506192.

Comment 4

[Julien Wajsberg [:julienw]]

In the application I am doing for french employees (where we need to fill in a form every month if we took a day off the month before), I'd need that this application can access the data. However this works well enough if one employee accesses its own data and that's all.

The current code uses a Firefox addon to overcome the same-origin protection. It loads data from export.php, using whatever authentication data the user is supplying in the normal Basic Auth form (so the application doesn't know this authentication data).

But it would be easier if it'd be a simple page on people.mozilla.org, that's why I asked for this CORS header.

Hope this clears things up :)

Comment 5

[Fred Wenzel [:wenzel]]

Seems doable if you build your people page so that it fetches the data via XHR (with CORS). Laura, I figure we can just make a view that spits out the same data as the "view your own PTO" page, except as raw JSON?

I'll reopen and make it dependent on Laura's feature. Either she adds it while she's on a roll, or I can add it thereafter ;) No problem.

Comment 6

[Julien Wajsberg [:julienw]]

Note that I'd still need an JSON export... in the mean time I'll try to parse the HTML output but clearly that's gross.

Comment 7

[Harris Jillani]

Kindly add this code on the top where you start the php 

 <?php
 header("Access-Control-Allow-Origin: *");

It will allow you to make the cross site request. Also you need to enable cross site when you will make the request.

Comment 8

[Harris Jillani]

Attachment: sol.php

Allow cross origin request