SECURITY: Fix CORS origin matching in the API

Bug: T77028
Change-Id: I68c1ee5b5a048af2aba4e710bc301b09748389bf

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 81353f6..c03e513 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -575,7 +575,7 @@ class ApiMain extends ApiBase {
                        $wildcard
                );
 
-               return "/https?:\/\/$wildcard/";
+               return "/^https?:\/\/$wildcard$/";
        }
 
        protected function sendCacheHeaders() {