@easy-cms/core 0.37.1 → 0.37.2

package/dist/index.js

@@ -7626,7 +7626,7 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.37.1" : "0.0.0-dev";
+var VERSION = true ? "0.37.2" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8584,12 +8584,22 @@ function readCookie(request, name) {
   }
   return void 0;
 }
+function sameHost(origin, request) {
+  let host;
+  try {
+    host = new URL(origin).host;
+  } catch {
+    return false;
+  }
+  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  return host === (forwarded || request.headers.get("host"));
+}
 function checkCsrf(cms, ctx) {
   const origin = ctx.request.headers.get("origin");
   const fetchSite = ctx.request.headers.get("sec-fetch-site");
   const cookie2 = ctx.via === "cookie" && ctx.token !== void 0;
   const { cors } = cms.config;
-  const trusted = origin !== null && (origin === ctx.url.origin || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
+  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
   if (origin !== null && !trusted) throw new ForbiddenError("CSRF check failed: untrusted origin");
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.37.1",
+  "version": "0.37.2",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",