Version 4.7.23

applications/core/modules/admin/system/login.php

@@ -10,6 +10,9 @@
 
 namespace IPS\core\modules\admin\system;
 
+use IPS\Http\Url;
+use IPS\Output;
+
 /* To prevent PHP errors (extending class does not exist) revealing path */
 if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
@@ -303,7 +306,10 @@ class _login extends \IPS\Dispatcher\Controller
 	public function getCsrfKey()
 	{
 		/* Don't cache the CSRF key */
-		\IPS\Output::i()->pageCaching = FALSE;
+		\IPS\Output::setCacheTime( false );
+
+		/* Restrict endpoint to our origin JS */
+		Output::i()->httpHeaders['Access-Control-Allow-Origin'] = Url::baseUrl()->data[ Url::COMPONENT_SCHEME ] . '://' . Url::baseUrl()->data[ Url::COMPONENT_HOST ];
 
 		\IPS\Output::i()->json( [ 'key' => \IPS\Session::i()->csrfKey ] );
 	}