From d269e47d4fb748b6367f03e8962b04dc4ab86ef5 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 26 Aug 2019 13:40:51 +0200
Subject: [PATCH] Rebuild config file with cors-allowed-origin directive

---
 config | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 53 insertions(+), 3 deletions(-)

diff --git a/config b/config
index e3740b78..11f00bb5 100644
--- a/config
+++ b/config
@@ -1,6 +1,6 @@
-#        Sample Configuration File for Privoxy 3.0.28
+#        Sample Configuration File for Privoxy 3.0.29
 #
-# Copyright (C) 2001-2018 Privoxy Developers https://www.privoxy.org/
+# Copyright (C) 2001-2019 Privoxy Developers https://www.privoxy.org/
 #
 #####################################################################
 #                                                                   #
@@ -1206,6 +1206,9 @@ enable-proxy-authentication-forwarding 0
 #      requests aren't rejected. Requests are accepted if the
 #      specified trusted-cgi-refer is the prefix of the Referer.
 #
+#      If the trusted source is supposed to access the CGI pages via
+#      JavaScript the cors-allowed-origin option can be used.
+#
 #      +-----------------------------------------------------+
 #      |                       Warning                       |
 #      |-----------------------------------------------------|
@@ -1215,8 +1218,54 @@ enable-proxy-authentication-forwarding 0
 #      |the user's knowledge.                                |
 #      +-----------------------------------------------------+
 #
-#trusted-cgi-referer http://www.example.org/
+#trusted-cgi-referer http://www.example.org/local-privoxy-control-page
+#
+#  4.11. cors-allowed-origin
+#  ==========================
+#
+#  Specifies:
+#
+#      A trusted website which can access Privoxy's CGI pages through
+#      JavaScript.
+#
+#  Type of value:
+#
+#      URL
+#
+#  Default value:
+#
+#      Unset
+#
+#  Effect if unset:
+#
+#      No external sites get access via cross-origin resource
+#      sharing.
+#
+#  Notes:
+#
+#      Modern browsers by default prevent cross-origin requests made
+#      via JavaScript to Privoxy's CGI interface even if Privoxy
+#      would trust the referer because it's white listed via the
+#      trusted-cgi-referer directive.
+#
+#      Cross-origin resource sharing (CORS) is a mechanism to allow
+#      cross-origin requests.
+#
+#      The "cors-allowed-origin" option can be used to specify a
+#      domain that is allowed to make requests to Privoxy CGI
+#      interface via JavaScript. It is used in combination with the
+#      trusted-cgi-referer directive.
+#
+#      +-----------------------------------------------------+
+#      |                       Warning                       |
+#      |-----------------------------------------------------|
+#      |Declaring domains the admin doesn't control          |
+#      |trustworthy may allow malicious third parties to     |
+#      |modify Privoxy's internal state against the user's   |
+#      |wishes and without the user's knowledge.             |
+#      +-----------------------------------------------------+
 #
+#cors-allowed-origin http://www.example.org/
 #
 #  5. FORWARDING
 #  ==============
@@ -2159,6 +2208,7 @@ socket-timeout 300
 #      affected by this directive.
 #
 #client-header-order Host \
+#   User-Agent \
 #   Accept \
 #   Accept-Language \
 #   Accept-Encoding \
-- 
2.39.2