预检响应 TinyMCE 图像上传时出现 CORS 500 错误

Question

我正在使用 TinyMCE 并尝试上传图像。我的 HTML 页面由 Django 提供服务。请看下面我的图片上传处理程序（由 TinyMCE 提供）

images_upload_handler: function (blobInfo, success, failure, progress) {

            var xhr, formData;

            xhr = new XMLHttpRequest();

            //xhr.withCredentials = true;

            xhr.open('POST', 'http://localhost/tiny_upload.php');

            xhr.setRequestHeader('x-requested-with', 'XMLHttpRequest')

            xhr.upload.onprogress = function (e) {

                progress(e.loaded / e.total * 100);

            };

            xhr.onload = function () {

                var json;

                if (xhr.status < 200 || xhr.status >= 300) {

                    failure('HTTP Error: ' + xhr.status);

                    return;

                }

                json = JSON.parse(xhr.responseText);

                if (!json || typeof json.location != 'string') {

                    failure('Invalid JSON: ' + xhr.responseText);

                    return;

                }

                success(json.location);

            };

            xhr.onerror = function () {

                failure('Image upload failed due to a XHR Transport error. Code: ' + xhr.status +

                    ' Message:' + xhr.responseText);

            };

            formData = new FormData();

            formData.append('file', blobInfo.blob(), blobInfo.filename());

            xhr.send(formData);

        }

Answer 1

我将 php 文件内容更改为以下内容<?phperror_reporting(E_ERROR | E_WARNING | E_PARSE);/***************************************************&nbsp;* Only these origins are allowed to upload images *&nbsp;***************************************************/$accepted_origins = array("http://localhost", "http://192.168.1.1", "http://127.0.0.1:8000", "http://127.0.0.1");/*********************************************&nbsp;* Change this line to set the upload folder *&nbsp;*********************************************/$method = $_SERVER['REQUEST_METHOD'];if ($method == 'OPTIONS') {&nbsp; &nbsp; if (isset($_SERVER['HTTP_ORIGIN'])) {&nbsp; &nbsp; &nbsp; &nbsp; if (in_array($_SERVER['HTTP_ORIGIN'], $accepted_origins)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 200 OK");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;&nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 403 Origin Denied");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }} elseif ($method == 'POST') {&nbsp; &nbsp; $imageFolder = "images/";&nbsp; &nbsp; reset($_FILES);&nbsp; &nbsp; $temp = current($_FILES);&nbsp; &nbsp; if (is_uploaded_file($temp['tmp_name'])) {&nbsp; &nbsp; &nbsp; &nbsp; header('CUS_MSG1: hello');&nbsp; &nbsp; &nbsp; &nbsp; if (isset($_SERVER['HTTP_ORIGIN'])) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // same-origin requests won't set an origin. If the origin is set, it must be valid.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (in_array($_SERVER['HTTP_ORIGIN'], $accepted_origins)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 403 Origin Denied");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; /*&nbsp; &nbsp; If your script needs to receive cookies, set images_upload_credentials : true in&nbsp; &nbsp; the configuration and enable the following two headers.&nbsp; &nbsp; &nbsp;*/&nbsp; &nbsp; &nbsp; &nbsp; // header('Access-Control-Allow-Credentials: true');&nbsp; &nbsp; &nbsp; &nbsp; // header('P3P: CP="There is no P3P policy."');&nbsp; &nbsp; &nbsp; &nbsp; // Sanitize input&nbsp; &nbsp; &nbsp; &nbsp; if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $temp['name'])) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 400 Invalid file name.");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; // Verify extension&nbsp; &nbsp; &nbsp; &nbsp; if (!in_array(strtolower(pathinfo($temp['name'], PATHINFO_EXTENSION)), array("gif", "jpg", "png"))) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 400 Invalid extension.");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; // Accept upload if there was no origin, or if it is an accepted origin&nbsp; &nbsp; &nbsp; &nbsp; $filetowrite = $imageFolder . $temp['name'];&nbsp; &nbsp; &nbsp; &nbsp; move_uploaded_file($temp['tmp_name'], $filetowrite);&nbsp; &nbsp; &nbsp; &nbsp; // Respond to the successful upload with JSON.&nbsp; &nbsp; &nbsp; &nbsp; // Use a location key to specify the path to the saved image resource.&nbsp; &nbsp; &nbsp; &nbsp; // { location : '/your/uploaded/image/file'}&nbsp; &nbsp; &nbsp; &nbsp; echo json_encode(array('location' => 'http://' . $_SERVER['SERVER_NAME'] . '/' . $filetowrite));&nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; // Notify editor that the upload failed&nbsp; &nbsp; &nbsp; &nbsp; header("HTTP/1.1 500 Server Error");&nbsp; &nbsp; }} else {&nbsp; &nbsp; // Notify editor that the upload failed&nbsp; &nbsp; header("HTTP/1.1 500 Server Error");}?>并xhr.setRequestHeader('x-requested-with', 'XMLHttpRequest')从 JS 文件中删除