From: Tom Hughes <tom@compton.nu>
Date: Tue, 29 Sep 2009 16:24:07 +0000 (+0000)
Subject: Revert r17851 and just give non-local flash clients access to
X-Git-Tag: live~6655
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/53c2f0dccc170bf9e30e39be6b43e3d4aa6023e9?hp=6eed92c0d6592baf5c7d8cab3767949ab4b3bff8

Revert r17851 and just give non-local flash clients access to
the X_HTTP_METHOD_OVERRIDE header.
---

diff --git a/public/api/crossdomain.xml b/public/api/crossdomain.xml
index 669cae37d..52e8397a3 100644
--- a/public/api/crossdomain.xml
+++ b/public/api/crossdomain.xml
@@ -3,5 +3,8 @@
 
 <cross-domain-policy>
 	<allow-access-from domain="*"/>
-	<allow-http-request-headers-from domain="*" headers="*"/>
+	<allow-http-request-headers-from domain="*" headers="Authorization,X_HTTP_METHOD_OVERRIDE"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.org" headers="*"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.net" headers="*"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.com" headers="*"/>
 </cross-domain-policy>
diff --git a/public/oauth/crossdomain.xml b/public/oauth/crossdomain.xml
index 669cae37d..52e8397a3 100644
--- a/public/oauth/crossdomain.xml
+++ b/public/oauth/crossdomain.xml
@@ -3,5 +3,8 @@
 
 <cross-domain-policy>
 	<allow-access-from domain="*"/>
-	<allow-http-request-headers-from domain="*" headers="*"/>
+	<allow-http-request-headers-from domain="*" headers="Authorization,X_HTTP_METHOD_OVERRIDE"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.org" headers="*"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.net" headers="*"/>
+	<allow-http-request-headers-from domain="*.openstreetmap.com" headers="*"/>
 </cross-domain-policy>