Adminer plugin: Accept the login form posted from the listed websites

login-cross-origin.php

<?php

/** Accept the login form posted from the listed websites
* The form of another website doesn't have Adminer's CSRF token, e.g. <form action="https://example.com/adminer.php" method="post"> with the fields auth[driver], auth[server], auth[username], auth[password] and auth[db].
* Any page of the listed websites can log the visitor in to a server of its choice, so list only the websites you trust.
* Requires Adminer 6.1.0.
* @link https://www.adminer.org/plugins/#use
* @author Jakub Vrana, https://www.vrana.cz/
* @license https://www.apache.org/licenses/LICENSE-2.0 Apache License, Version 2.0
* @license https://www.gnu.org/licenses/gpl-2.0.html GNU General Public License, version 2 (one or other)
*/
class AdminerLoginCrossOrigin extends Adminer\Plugin {
	protected $origins;

	/** Set the allowed websites
	* @param list<string> $origins scheme, host and optional port, e.g. array("https://intranet.example.com")
	*/
	function __construct(array $origins) {
		$this->origins = $origins;
	}

	function verifyLoginToken() {
		// browsers send Origin with every cross-origin POST, an exact match doesn't let through a similar host
		if (in_array($_SERVER["HTTP_ORIGIN"], $this->origins, true)) {
			return false;
		}
	}

	protected $translations = array(
		'cs' => array('' => 'Přijme přihlašovací formulář odeslaný z uvedených webů'),
	);
}