#NEWLINE# def crossdomain( origin = None , methods = None , headers = None , max_age = 21600 , attach_to_all = True , automatic_options = True ) : #NEWLINE# #INDENT# '\n    origin: Optionally a list of additional URLs that might access resource.\n    methods: Optionally a list of methods allowed for this view. If not\n             provided it will allow all methods that are implemented.\n    headers: Optionally a list of headers allowed for this request.\n    max_age: The number of seconds as integer or timedelta object for which\n             the preflighted request is valid.\n    attach_to_all: True if decorator should add access control headers to all\n                   HTTP methods or False if it should only add them to OPTIONS\n                   responses.\n    automatic_options: If enabled the decorator will use the default Flask\n                       OPTIONS response and attach the headers there,\n                       otherwise the view function will be called to generate\n                       an appropriate response.\n    ' #NEWLINE# if ( methods is not None ) : #NEWLINE# #INDENT# methods = ', ' . join ( sorted ( ( x . upper ( ) for x in methods ) ) ) #NEWLINE# #UNINDENT# if ( ( headers is not None ) and ( not isinstance ( max_age , basestring ) ) ) : #NEWLINE# #INDENT# headers = ', ' . join ( ( x . upper ( ) for x in headers ) ) #NEWLINE# #UNINDENT# if isinstance ( max_age , timedelta ) : #NEWLINE# #INDENT# max_age = max_age . total_seconds ( ) #NEWLINE# #UNINDENT# def get_methods( ) : #NEWLINE# #INDENT# if ( methods is not None ) : #NEWLINE# #INDENT# return methods #NEWLINE# #UNINDENT# options_resp = current_app . make_default_options_response ( ) #NEWLINE# return options_resp . headers [ 'allow' ] #NEWLINE# #UNINDENT# def decorator( f ) : #NEWLINE# #INDENT# def wrapped_function( * args , **kwargs ) : #NEWLINE# #INDENT# if ( automatic_options and ( request . method == 'OPTIONS' ) ) : #NEWLINE# #INDENT# resp = current_app . make_default_options_response ( ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# resp = make_response ( f ( * args , ** kwargs ) ) #NEWLINE# #UNINDENT# if ( ( not attach_to_all ) and ( request . method != 'OPTIONS' ) ) : #NEWLINE# #INDENT# return resp #NEWLINE# #UNINDENT# h = resp . headers #NEWLINE# origin_allowed = None #NEWLINE# if ( request . headers . get ( 'Origin' ) is None ) : #NEWLINE# #INDENT# abort ( 400 ) #NEWLINE# #UNINDENT# if ( ( origin is None ) and any ( ( ( request . headers . get ( 'Origin' ) in o ) for o in current_app . config [ 'ORIGINS_ALLOWED' ] ) ) ) : #NEWLINE# #INDENT# origin_allowed = request . headers . get ( 'Origin' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( ( origin is not None ) and any ( ( ( request . headers . get ( 'Origin' ) in o ) for o in ( current_app . config [ 'ORIGINS_ALLOWED' ] + origin ) ) ) ) : #NEWLINE# #INDENT# origin_allowed = request . headers . get ( 'Origin' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# current_app . logger . warn ( ( 'The remote IP [%s] requested a forbidden resource=[%s]. Returning 403.' % ( request . remote_addr , request . url ) ) ) #NEWLINE# abort ( 403 ) #NEWLINE# #UNINDENT# #UNINDENT# h [ 'Access-Control-Allow-Credentials' ] = 'true' #NEWLINE# h [ 'Access-Control-Allow-Origin' ] = origin_allowed #NEWLINE# h [ 'Access-Control-Allow-Methods' ] = get_methods ( ) #NEWLINE# h [ 'Access-Control-Max-Age' ] = str ( max_age ) #NEWLINE# if ( headers is not None ) : #NEWLINE# #INDENT# h [ 'Access-Control-Allow-Headers' ] = headers #NEWLINE# #UNINDENT# return resp #NEWLINE# #UNINDENT# f . provide_automatic_options = False #NEWLINE# return update_wrapper ( wrapped_function , f ) #NEWLINE# #UNINDENT# return decorator