From 940324551f322ec67911adc982a9ab89636696ad Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Sun, 29 Jan 2017 11:45:38 +0100
Subject: [PATCH] Strip https:// and http:// in CORS test

---
 scripts/pi-hole/php/auth.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php
index 9d83428f..41b1be16 100644
--- a/scripts/pi-hole/php/auth.php
+++ b/scripts/pi-hole/php/auth.php
@@ -64,8 +64,8 @@ function check_cors() {
         {
             $server_origin = parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST);
         }
-        // Remove "[" ... "]"
-        $server_origin = str_replace(array("[","]"), array("",""), $server_origin);
+        // Remove "[", "]","http://", and "https://"
+        $server_origin = str_replace(array("[","]","http://","https://"), array("","","",""), $server_origin);
 
         if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
             log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));