update inbox list

vendor/fruitcake/laravel-cors/.github/FUNDING.yml

@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: barryvdh
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

vendor/fruitcake/laravel-cors/LICENSE

@@ -0,0 +1,21 @@
+Copyright (c) 2013-2016 Barry vd. Heuvel
+
+Copyright for portions of this project are held by [asm89 (Alexander)] as part of project asm89/stack-cors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished
+to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/fruitcake/laravel-cors/changelog.md

@@ -0,0 +1,32 @@
+# Change Log
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](http://keepachangelog.com/)
+and this project adheres to [Semantic Versioning](http://semver.org/).
+
+## v1.0 (2019-12-27)
+
+### Breaking changes
+ - Adding the middleware on Route groups is no longer supported. You can use the new `paths` option to match your routes
+ - The config file has been changed from `camelCase` to `snake_case`, please update your own config.
+ - The deprecated Lumen ServiceProvider has been removed.
+ - There is no need to manually configure the `cors` config in Lumen.
+ 
+### Added
+ - The `paths` option is added to match certain routes only, while still using global middleware. This allows for better error handling.
+
+## v0.11.0 (2017-12-xx)
+### Breaking changes
+ - The wildcard matcher is changed. You can use `allowedOriginPatterns` for your own patterns, 
+ or simple wildcards in the normal origins. Eg. `*.laravel.com` should still work.
+
+## v0.9.0 (2016-03-2017)
+### Breaking changes
+ - The `cors` alias is no longer added by default. Use the full class or add the alias yourself.
+ - The Lumen ServiceProvider has been removed. Both Laravel and Lumen should use `Barryvdh\Cors\ServiceProvider::class`.
+ - `Barryvdh\Cors\Stack\CorsService` moves to `\Barryvdh\Cors\CorsService` (namespace changed).
+ - `Barryvdh\Cors@addActualRequestHeaders` will automatically attached when Exception occured.
+ 
+### Added
+ - Better error-handling when exceptions occur.
+ - A lot of tests, also on older Laravel versions.

vendor/fruitcake/laravel-cors/composer.json

@@ -0,0 +1,58 @@
+{
+    "name": "fruitcake/laravel-cors",
+    "description": "Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application",
+    "keywords": ["laravel", "cors", "crossdomain", "api"],
+    "license": "MIT",
+    "authors": [
+        {
+            "name": "Fruitcake",
+            "homepage": "https://fruitcake.nl"
+        },
+        {
+            "name": "Barry vd. Heuvel",
+            "email": "barryvdh@gmail.com"
+        }
+    ],
+    "require": {
+        "php": ">=7",
+        "illuminate/support": "^5.5|^6.0|^7.0|^8.0",
+        "illuminate/contracts": "^5.5|^6.0|^7.0|^8.0",
+        "symfony/http-foundation": "^3.3|^4.0|^5.0",
+        "symfony/http-kernel": "^3.3|^4.0|^5.0",
+        "asm89/stack-cors": "^1.3"
+    },
+    "require-dev": {
+        "laravel/framework": "^5.5|^6.0|^7.0|^8.0",
+        "phpunit/phpunit": "^6.0|^7.0|^8.0",
+        "orchestra/testbench": "^3.5|^4.0|^5.0|^6.0",
+        "squizlabs/php_codesniffer": "^3.5",
+        "phpro/grumphp": "^0.16|^0.17"
+    },
+    "autoload": {
+        "psr-4": {
+            "Fruitcake\\Cors\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Fruitcake\\Cors\\Tests\\": "tests/"
+        }
+    },
+    "extra": {
+        "branch-alias": {
+            "dev-master": "1.0-dev"
+        },
+        "laravel": {
+            "providers": [
+              "Fruitcake\\Cors\\CorsServiceProvider"
+            ]
+        }
+    },
+    "scripts": {
+        "test": "phpunit",
+        "check-style": "phpcs -p --standard=psr12 src/",
+        "fix-style": "phpcbf -p --standard=psr12 src/"
+    },
+    "minimum-stability": "dev",
+    "prefer-stable": true
+}

vendor/fruitcake/laravel-cors/config/cors.php

@@ -0,0 +1,60 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Laravel CORS Options
+    |--------------------------------------------------------------------------
+    |
+    | The allowed_methods and allowed_headers options are case-insensitive.
+    |
+    | You don't need to provide both allowed_origins and allowed_origins_patterns.
+    | If one of the strings passed matches, it is considered a valid origin.
+    |
+    | If array('*') is provided to allowed_methods, allowed_origins or allowed_headers
+    | all methods / origins / headers are allowed.
+    |
+    */
+
+    /*
+     * You can enable CORS for 1 or multiple paths.
+     * Example: ['api/*']
+     */
+    'paths' => [],
+
+    /*
+    * Matches the request method. `[*]` allows all methods.
+    */
+    'allowed_methods' => ['*'],
+
+    /*
+     * Matches the request origin. `[*]` allows all origins.
+     */
+    'allowed_origins' => ['*'],
+
+    /*
+     * Matches the request origin with, similar to `Request::is()`
+     */
+    'allowed_origins_patterns' => [],
+
+    /*
+     * Sets the Access-Control-Allow-Headers response header. `[*]` allows all headers.
+     */
+    'allowed_headers' => ['*'],
+
+    /*
+     * Sets the Access-Control-Expose-Headers response header with these headers.
+     */
+    'exposed_headers' => [],
+
+    /*
+     * Sets the Access-Control-Max-Age response header when > 0.
+     */
+    'max_age' => 0,
+
+    /*
+     * Sets the Access-Control-Allow-Credentials header.
+     */
+    'supports_credentials' => false,
+];

vendor/fruitcake/laravel-cors/readme.md

@@ -0,0 +1,165 @@
+# CORS Middleware for Laravel
+
+[![Software License][ico-license]](LICENSE.md)
+[![Build Status][ico-travis]][link-travis]
+[![Total Downloads][ico-downloads]][link-downloads]
+
+Based on https://github.com/asm89/stack-cors
+
+## About
+
+The `laravel-cors` package allows you to send [Cross-Origin Resource Sharing](http://enable-cors.org/)
+headers with Laravel middleware configuration.
+
+If you want to have a global overview of CORS workflow, you can  browse
+this [image](http://www.html5rocks.com/static/images/cors_server_flowchart.png).
+
+## Upgrading from 0.x
+When upgrading from 0.x versions, there are some breaking changes:
+ - The vendor name has changed (see installation/usage)
+ - Group middleware is no longer supported.
+ - A new 'paths' property is used to enable/disable CORS on certain routes. This is empty by default!
+ - The casing on the props in `cors.php` has changed from camelCase to snake_case, so if you already have a `cors.php` file you will need to update the props in there to match the new casing.
+
+## Features
+
+* Handles CORS pre-flight OPTIONS requests
+* Adds CORS headers to your responses
+* Match routes to only add CORS to certain Requests
+
+## Installation
+
+Require the `fruitcake/laravel-cors` package in your `composer.json` and update your dependencies:
+```sh
+composer require fruitcake/laravel-cors
+```
+
+## Global usage
+
+To allow CORS for all your routes, add the `HandleCors` middleware in the `$middleware` property of  `app/Http/Kernel.php` class:
+
+```php
+protected $middleware = [
+    // ...
+    \Fruitcake\Cors\HandleCors::class,
+];
+```
+
+Now update the config to define the paths you want to run the CORS service on, (see Configuration below):
+
+```php 
+'paths' => ['api/*'],
+```
+
+## Configuration
+
+The defaults are set in `config/cors.php`. Publish the config to copy the file to your own config:
+```sh
+php artisan vendor:publish --tag="cors"
+```
+> **Note:** When using custom headers, like `X-Auth-Token` or `X-Requested-With`, you must set the `allowed_headers` to include those headers. You can also set it to `['*']` to allow all custom headers.
+
+> **Note:** If you are explicitly whitelisting headers, you must include `Origin` or requests will fail to be recognized as CORS.
+
+    
+```php
+<?php
+
+return [
+
+    /*
+     * You can enable CORS for 1 or multiple paths.
+     * Example: ['api/*']
+     */
+    'paths' => [],
+
+    /*
+    * Matches the request method. `[*]` allows all methods.
+    */
+    'allowed_methods' => ['*'],
+
+    /*
+     * Matches the request origin. `[*]` allows all origins.
+     */
+    'allowed_origins' => ['*'],
+
+    /*
+     * Matches the request origin with, similar to `Request::is()`
+     */
+    'allowed_origins_patterns' => [],
+
+    /*
+     * Sets the Access-Control-Allow-Headers response header. `[*]` allows all headers.
+     */
+    'allowed_headers' => ['*'],
+
+    /*
+     * Sets the Access-Control-Expose-Headers response header.
+     */
+    'exposed_headers' => false,
+
+    /*
+     * Sets the Access-Control-Max-Age response header.
+     */
+    'max_age' => false,
+
+    /*
+     * Sets the Access-Control-Allow-Credentials header.
+     */
+    'supports_credentials' => false,
+];
+
+```
+
+`allowed_origins`, `allowed_headers` and `allowed_methods` can be set to `['*']` to accept any value.
+
+> **Note:** Try to be a specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!
+
+> **Note:** Because of [http method overriding](http://symfony.com/doc/current/reference/configuration/framework.html#http-method-override) in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.
+
+### Lumen
+
+On Laravel Lumen, just register the ServiceProvider manually:
+
+```php
+$app->register(\Fruitcake\Cors\CorsServiceProvider::class);
+```
+
+## Global usage for Lumen
+To allow CORS for all your routes, add the `HandleCors` middleware to the global middleware and set the `paths` property in the config.
+```php
+$app->middleware([
+    // ...
+    \Fruitcake\Cors\HandleCors::class,
+]);
+```
+
+### Disabling CSRF protection for your API
+
+If possible, use a different route group with CSRF protection enabled. 
+Otherwise you can disable CSRF for certain requests in `App\Http\Middleware\VerifyCsrfToken`:
+
+```php
+protected $except = [
+    'api/*'
+];
+```
+    
+## License
+
+Released under the MIT License, see [LICENSE](LICENSE).
+
+[ico-version]: https://img.shields.io/packagist/v/fruitcake/laravel-cors.svg?style=flat-square
+[ico-license]: https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square
+[ico-travis]: https://img.shields.io/travis/fruitcake/laravel-cors/master.svg?style=flat-square
+[ico-scrutinizer]: https://img.shields.io/scrutinizer/coverage/g/fruitcake/laravel-cors.svg?style=flat-square
+[ico-code-quality]: https://img.shields.io/scrutinizer/g/fruitcake/laravel-cors.svg?style=flat-square
+[ico-downloads]: https://img.shields.io/packagist/dt/fruitcake/laravel-cors.svg?style=flat-square
+
+[link-packagist]: https://packagist.org/packages/fruitcake/laravel-cors
+[link-travis]: https://travis-ci.org/fruitcake/laravel-cors
+[link-scrutinizer]: https://scrutinizer-ci.com/g/fruitcake/laravel-cors/code-structure
+[link-code-quality]: https://scrutinizer-ci.com/g/fruitcake/laravel-cors
+[link-downloads]: https://packagist.org/packages/fruitcake/laravel-cors
+[link-author]: https://github.com/fruitcake
+[link-contributors]: ../../contributors

vendor/fruitcake/laravel-cors/src/CorsServiceProvider.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Fruitcake\Cors;
+
+use Asm89\Stack\CorsService;
+use Illuminate\Foundation\Application as LaravelApplication;
+use Illuminate\Support\ServiceProvider as BaseServiceProvider;
+use Laravel\Lumen\Application as LumenApplication;
+
+class CorsServiceProvider extends BaseServiceProvider
+{
+    /**
+     * Register the service provider.
+     *
+     * @return void
+     */
+    public function register()
+    {
+        $this->mergeConfigFrom($this->configPath(), 'cors');
+
+        $this->app->singleton(CorsService::class, function ($app) {
+            $config = $app['config']->get('cors');
+
+            if ($config['exposed_headers'] && !is_array($config['exposed_headers'])) {
+                throw new \RuntimeException('CORS config `exposed_headers` should be `false` or an array');
+            }
+
+            foreach (['allowed_origins', 'allowed_origins_patterns',  'allowed_headers', 'allowed_methods'] as $key) {
+                if (!is_array($config[$key])) {
+                    throw new \RuntimeException('CORS config `' . $key . '` should be an array');
+                }
+            }
+
+            // Convert case to supported options
+            $options = [
+                'supportsCredentials' => $config['supports_credentials'],
+                'allowedOrigins' => $config['allowed_origins'],
+                'allowedOriginsPatterns' => $config['allowed_origins_patterns'],
+                'allowedHeaders' => $config['allowed_headers'],
+                'allowedMethods' => $config['allowed_methods'],
+                'exposedHeaders' => $config['exposed_headers'],
+                'maxAge' => $config['max_age'],
+            ];
+
+            // Transform wildcard pattern
+            foreach ($options['allowedOrigins'] as $origin) {
+                if (strpos($origin, '*') !== false) {
+                    $options['allowedOriginsPatterns'][] = $this->convertWildcardToPattern($origin);
+                }
+            }
+
+            return new CorsService($options, $app);
+        });
+    }
+
+    /**
+     * Register the config for publishing
+     *
+     */
+    public function boot()
+    {
+        if ($this->app instanceof LaravelApplication && $this->app->runningInConsole()) {
+            $this->publishes([$this->configPath() => config_path('cors.php')], 'cors');
+        } elseif ($this->app instanceof LumenApplication) {
+            $this->app->configure('cors');
+        }
+    }
+
+    /**
+     * Set the config path
+     *
+     * @return string
+     */
+    protected function configPath()
+    {
+        return __DIR__ . '/../config/cors.php';
+    }
+
+    /**
+     * Create a pattern for a wildcard, based on Str::is() from Laravel
+     *
+     * @see https://github.com/laravel/framework/blob/5.5/src/Illuminate/Support/Str.php
+     * @param string $pattern
+     * @return string
+     */
+    protected function convertWildcardToPattern($pattern)
+    {
+        $pattern = preg_quote($pattern, '#');
+
+        // Asterisks are translated into zero-or-more regular expression wildcards
+        // to make it convenient to check if the strings starts with the given
+        // pattern such as "library/*", making any string check convenient.
+        $pattern = str_replace('\*', '.*', $pattern);
+
+        return '#^' . $pattern . '\z#u';
+    }
+}

vendor/fruitcake/laravel-cors/src/HandleCors.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace Fruitcake\Cors;
+
+use Closure;
+use Asm89\Stack\CorsService;
+use Illuminate\Http\Request;
+use Illuminate\Contracts\Container\Container;
+use Illuminate\Foundation\Http\Events\RequestHandled;
+use Symfony\Component\HttpFoundation\Response;
+
+class HandleCors
+{
+    /** @var CorsService $cors */
+    protected $cors;
+
+    /** @var \Illuminate\Contracts\Container\Container $container */
+    protected $container;
+    
+    public function __construct(CorsService $cors, Container $container)
+    {
+        $this->cors = $cors;
+        $this->container = $container;
+    }
+
+    /**
+     * Handle an incoming request. Based on Asm89\Stack\Cors by asm89
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return Response
+     */
+    public function handle($request, Closure $next)
+    {
+        // Check if we're dealing with CORS and if we should handle it
+        if (! $this->shouldRun($request)) {
+            return $next($request);
+        }
+
+        // For Preflight, return the Preflight response
+        if ($this->cors->isPreflightRequest($request)) {
+            return $this->cors->handlePreflightRequest($request);
+        }
+
+        // If the request is not allowed, return 403
+        if (! $this->cors->isActualRequestAllowed($request)) {
+            return new Response('Not allowed in CORS policy.', 403);
+        }
+
+        // Add the headers on the Request Handled event as fallback in case of exceptions
+        if (class_exists(RequestHandled::class) && $this->container->bound('events')) {
+            $this->container->make('events')->listen(RequestHandled::class, function (RequestHandled $event) {
+                $this->addHeaders($event->request, $event->response);
+            });
+        }
+
+        // Handle the request
+        $response = $next($request);
+
+        // Add the CORS headers to the Response
+        return $this->addHeaders($request, $response);
+    }
+
+    /**
+     * Determine if the request has a URI that should pass through the CORS flow.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    protected function shouldRun(Request $request): bool
+    {
+        // Check if this is an actual CORS request
+        if (! $this->cors->isCorsRequest($request)) {
+            return false;
+        }
+
+        return $this->isMatchingPath($request);
+    }
+
+    /**
+     * The the path from the config, to see if the CORS Service should run
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    protected function isMatchingPath(Request $request): bool
+    {
+        // Get the paths from the config or the middleware
+        $paths = $this->container['config']->get('cors.paths', []);
+
+        foreach ($paths as $path) {
+            if ($path !== '/') {
+                $path = trim($path, '/');
+            }
+
+            if ($request->fullUrlIs($path) || $request->is($path)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Add the headers to the Response, if they don't exist yet.
+     *
+     * @param Request $request
+     * @param Response $response
+     * @return Response
+     */
+    protected function addHeaders(Request $request, Response $response): Response
+    {
+        if (! $response->headers->has('Access-Control-Allow-Origin')) {
+            $response = $this->cors->addActualRequestHeaders($response, $request);
+        }
+
+        return $response;
+    }
+}