From b26fd600f07d347a2c6e5985171b05dbddd6f285 Mon Sep 17 00:00:00 2001
From: Shay Banon <kimchy@gmail.com>
Date: Thu, 6 Sep 2012 20:35:36 +0200
Subject: [PATCH] allow to configure cors on http Allow to configure cors on
 http, if its enabled or not, and what it should output

---
 .../http/netty/NettyHttpChannel.java             | 16 +++++++++-------
 .../http/netty/NettyHttpServerTransport.java     |  4 ++++
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/elasticsearch/http/netty/NettyHttpChannel.java b/src/main/java/org/elasticsearch/http/netty/NettyHttpChannel.java
index c7429884137..4257f46070e 100644
--- a/src/main/java/org/elasticsearch/http/netty/NettyHttpChannel.java
+++ b/src/main/java/org/elasticsearch/http/netty/NettyHttpChannel.java
@@ -73,13 +73,15 @@ public class NettyHttpChannel implements HttpChannel {
             resp = new DefaultHttpResponse(HttpVersion.HTTP_1_1, status);
         }
         if (RestUtils.isBrowser(request.getHeader(HttpHeaders.Names.USER_AGENT))) {
-            // Add support for cross-origin Ajax requests (CORS)
-            resp.addHeader("Access-Control-Allow-Origin", "*");
-            if (request.getMethod() == HttpMethod.OPTIONS) {
-                // Allow Ajax requests based on the CORS "preflight" request
-                resp.addHeader("Access-Control-Max-Age", 1728000);
-                resp.addHeader("Access-Control-Allow-Methods", "OPTIONS, HEAD, GET, POST, PUT, DELETE");
-                resp.addHeader("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, Content-Length");
+            if (transport.settings().getAsBoolean("http.cors.enabled", true)) {
+                // Add support for cross-origin Ajax requests (CORS)
+                resp.addHeader("Access-Control-Allow-Origin", transport.settings().get("http.cors.allow-origin", "*"));
+                if (request.getMethod() == HttpMethod.OPTIONS) {
+                    // Allow Ajax requests based on the CORS "preflight" request
+                    resp.addHeader("Access-Control-Max-Age", transport.settings().getAsInt("http.cors.max-age", 1728000));
+                    resp.addHeader("Access-Control-Allow-Methods", transport.settings().get("http.cors.allow-methods", "OPTIONS, HEAD, GET, POST, PUT, DELETE"));
+                    resp.addHeader("Access-Control-Allow-Headers", transport.settings().get("http.cors.allow-headers", "X-Requested-With, Content-Type, Content-Length"));
+                }
             }
         }
 
diff --git a/src/main/java/org/elasticsearch/http/netty/NettyHttpServerTransport.java b/src/main/java/org/elasticsearch/http/netty/NettyHttpServerTransport.java
index 7c4d814b183..fc93cc863e7 100644
--- a/src/main/java/org/elasticsearch/http/netty/NettyHttpServerTransport.java
+++ b/src/main/java/org/elasticsearch/http/netty/NettyHttpServerTransport.java
@@ -162,6 +162,10 @@ public class NettyHttpServerTransport extends AbstractLifecycleComponent<HttpSer
                 maxChunkSize, maxHeaderSize, maxInitialLineLength, this.maxContentLength, receivePredictorMin, receivePredictorMax);
     }
 
+    public Settings settings() {
+        return this.settings;
+    }
+
     public void httpServerAdapter(HttpServerAdapter httpServerAdapter) {
         this.httpServerAdapter = httpServerAdapter;
     }