| … | … | @@ -77,7 +77,7 @@ export function registerPublicRoutes (router, server) { |
| 77 | 77 | <nav class="nav-bar"> |
| 78 | 78 | <a href="${server.pathPrefix}/${esc(provider.slug)}" style="text-decoration:none;color:inherit;">← ${esc(provider.displayName)}</a> |
| 79 | 79 | <div class="nav-right"> |
| 80 | <a href="${prefix}/dashboard" class="btn btn-secondary" id="dashboard-link" style="display:none">Dashboard</a> | |
| 80 | <a href="${server.pathPrefix}/dashboard" class="btn btn-secondary" id="dashboard-link" style="display:none">Dashboard</a> | |
| 81 | 81 | <button class="btn btn-secondary" id="sign-in-btn">Sign In</button> |
| 82 | 82 | </div> |
| 83 | 83 | </nav> |
| … | … | @@ -130,8 +130,14 @@ export class HyperBookingServer { |
| 130 | 130 | |
| 131 | 131 | isAllowedOrigin (origin) { |
| 132 | 132 | if (!origin) return true |
| 133 | const allowed = ['http://localhost', 'http://127.0.0.1', 'https://localhost'] | |
| 134 | return allowed.some(a => origin.startsWith(a)) | |
| 133 | // Allow localhost, LAN IPs, and any same-host origin | |
| 134 | if (origin.startsWith('http://localhost')) return true | |
| 135 | if (origin.startsWith('http://127.0.0.1')) return true | |
| 136 | if (origin.startsWith('https://localhost')) return true | |
| 137 | if (origin.match(/^https?:\/\/192\.168\./)) return true | |
| 138 | if (origin.match(/^https?:\/\/10\./)) return true | |
| 139 | if (origin.match(/^https?:\/\/172\.(1[6-9]|2\d|3[01])\./)) return true | |
| 140 | return false | |
| 135 | 141 | } |
| 136 | 142 | |
| 137 | 143 | // ---- Helpers for route handlers ---- |