Repository: jquery/jquery
File: test/data/mock.php (PHP)

Code before:
		file_put_contents( $this->cspFile, 'error' );
	}

	protected function cspClean( $req ) {
		file_put_contents( $this->cspFile, '' );
		unlink( $this->cspFile );
	}

	protected function errorWithScript( $req ) {
		header( 'HTTP/1.0 404 Not Found' );
		if ( isset( $req->query['withScriptContentType'] ) ) {
			header( 'Content-Type: application/javascript' );
		}
		if ( isset( $req->query['callback'] ) ) {
			$callback = $req->query['callback'];
			echo $callback . '( {"status": 404, "msg": "Not Found"} )';
		} else {
			echo 'QUnit.assert.ok( false, "Mock return erroneously executed" );';
		}
	}

	protected function cors($req) {
		if (isset($req->headers['ORIGIN'])) {
			$origin = $req->headers['ORIGIN'];
			header("Access-Control-Allow-Methods: GET");
			header("Access-Control-Allow-Origin: " . $origin);
			corsCallback(true);
		} else {
			corsCallback(false);
		}
	}

	public function __construct() {
		$this->cspFile = __DIR__ . '/support/csp.log';
	}

	public function respond( stdClass $req ) {
		if ( !isset( $req->query['action'] ) || !method_exists( $this, $req->query['action'] ) ) {
			header( "HTTP/1.0 400 Bad Request" );
			echo "Invalid action query.\n";
			return;
		}
		$this->{$req->query['action']}( $req );
	}
}

// Don't include PHP errors in http response
error_reporting( 0 );

// Collect headers
$headers = array();

Review comment (suggestion):
```suggestion
			header( "Access-Control-Allow-Origin: " . $origin );
```

Code after:
	protected function cspFrame( $req ) {
		header( "Content-Security-Policy: default-src 'self'; report-uri ./mock.php?action=cspLog" );
		header( 'Content-type: text/html' );
		echo file_get_contents( __DIR__ . '/csp.include.html' );
	}

	protected function cspNonce( $req ) {
		$test = $req->query['test'] ? '-' . $req->query['test'] : '';
		header( "Content-Security-Policy: script-src 'nonce-jquery+hardcoded+nonce'; report-uri ./mock.php?action=cspLog" );
		header( 'Content-type: text/html' );
		echo file_get_contents( __DIR__ . '/csp-nonce' . $test . '.html' );
	}

	protected function cspAjaxScript( $req ) {
		header( "Content-Security-Policy: script-src 'self'; report-uri /base/test/data/mock.php?action=cspLog" );
		header( 'Content-type: text/html' );
		echo file_get_contents( __DIR__ . '/csp-ajax-script.html' );
	}

	protected function cspLog( $req ) {
		file_put_contents( $this->cspFile, 'error' );
	}

	protected function cspClean( $req ) {
		file_put_contents( $this->cspFile, '' );
		unlink( $this->cspFile );
	}

	protected function errorWithScript( $req ) {
		header( 'HTTP/1.0 404 Not Found' );
		if ( isset( $req->query['withScriptContentType'] ) ) {
			header( 'Content-Type: application/javascript' );
		}
		if ( isset( $req->query['callback'] ) ) {
			$callback = $req->query['callback'];
			echo $callback . '( {"status": 404, "msg": "Not Found"} )';
		} else {
			echo 'QUnit.assert.ok( false, "Mock return erroneously executed" );';
		}
	}

	public function __construct() {
		$this->cspFile = __DIR__ . '/support/csp.log';
	}

	public function respond( stdClass $req ) {
		if ( !isset( $req->query['action'] ) || !method_exists( $this, $req->query['action'] ) ) {
			header( "HTTP/1.0 400 Bad Request" );
			echo "Invalid action query.\n";
			return;
		}