Pass-through proxy for Wikipedia’s “nearby” API

nearby.php

<?php

// pass through proxy for wikipedia’s “nearby” api

function isValidOrigin() {
    $host = $_SERVER['HTTP_HOST'];
    $origin = $_SERVER['HTTP_ORIGIN'];
    $allowed_hosts = array(
        'segdeha.com',
    );
    $allowed_origins = array(
        'http://localhost:3000',
        'https://whats-near.me',
        'https://tcl-pilot-2020-05.netlify.app',
        'https://tcl-30-whats-near-me-d2e34.web.app/',
    );
    // order matters, return based on origin first, then host
    if (in_array($origin, $allowed_origins, true) === true) {
        return $origin;
    }
    if (in_array($host, $allowed_hosts, true) === true) {
        return 'https://' . $host;
    }
    return false;
}

if ($origin = isValidOrigin()) {
    header('Access-Control-Allow-Origin: ' . $origin);
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Allow-Methods: GET');
    header('Access-Control-Allow-Headers: Content-Type');
}
else {
    // not in the list of accepted origins
    header('HTTP/1.1 403 Forbidden');
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    exit; // OPTIONS request wants only the policy, we can stop here
}

extract($_GET);

if (isset($lat) && isset($lng)
    && is_numeric($lat) && is_numeric($lng)
    && $lat <= 90 && $lat >= -90
    && $lng <= 180 && $lng >= -180) {

    // get json from wikipedia
    $url = "https://en.m.wikipedia.org/w/api.php?action=query&format=json&formatversion=2&prop=coordinates%7Cpageprops%7Cpageprops%7Cpageimages%7Cdescription&colimit=max&generator=geosearch&ggsradius=10000&ggsnamespace=0&ggslimit=50&ggscoord=$lat%7C$lng&ppprop=displaytitle&piprop=thumbnail&pithumbsize=500&pilimit=50&codistancefrompoint=$lat%7C$lng";

    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
    $output = curl_exec($ch);
    curl_close($ch);

    header('Content-Type: application/json');
    echo $output;
}
// need both a valid latitude and longitude to continue
else {
    header('HTTP/1.0 400 Bad Request');
}

exit;