diff --git a/ajax/load-more-videos.php b/ajax/load-more-videos.php index 3bfc18b..e243645 100644 --- a/ajax/load-more-videos.php +++ b/ajax/load-more-videos.php @@ -1,4 +1,9 @@ - - + + diff --git a/includes/security.php b/includes/security.php index 216680a..e2b3980 100644 --- a/includes/security.php +++ b/includes/security.php @@ -289,19 +289,32 @@ function setSecurityHeaders() { /** * Valide l'origine de la requête pour les requêtes AJAX - * + * * @return bool True si l'origine est valide */ function validateAjaxOrigin() { - $origin = $_SERVER['HTTP_ORIGIN'] ?? ''; $host = $_SERVER['HTTP_HOST'] ?? ''; - - if (empty($origin) || empty($host)) { + + if (empty($host)) { return false; } - + $expectedOrigin = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http') . '://' . $host; - - return $origin === $expectedOrigin; + + // Vérifier l'en-tête Origin si présent + $origin = $_SERVER['HTTP_ORIGIN'] ?? ''; + if (!empty($origin)) { + return $origin === $expectedOrigin; + } + + // Si Origin est absent (requête same-origin), vérifier le Referer + $referer = $_SERVER['HTTP_REFERER'] ?? ''; + if (!empty($referer)) { + return strpos($referer, $expectedOrigin) === 0; + } + + // Accepter si ni Origin ni Referer (certains navigateurs/configs) + // La protection CSRF reste active via le token + return true; } ?> \ No newline at end of file diff --git a/index.php b/index.php index 41d622f..9046c1c 100644 --- a/index.php +++ b/index.php @@ -424,7 +424,7 @@ setSecurityHeaders();
-
+