<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.11';
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

...

<div class="fb-like" data-href="#https://confluence.wildix.com/x/SwBuAQ" data-layout="button_count" data-action="recommend" data-size="large" data-show-faces="true" data-share="true"></div>

...

 <div class="lang-box-pdf">
	<div>
<div class="lang-switch">
			<span class="letters-form"><a title="English" href="#">EN</a>&nbsp;|&nbsp;<a title="Italian" href="#" >IT</a>&nbsp;|&nbsp;<a title="French" href="#" target="_blank">FR</a>&nbsp;|&nbsp;<a title="German" href="#">DE</a></span>
		</div>
		<div class="google-lang">
			<div id="google_translate_element">
			</div>
			<script type="text/javascript">
					function googleTranslateElementInit() {
						new google.translate.TranslateElement({pageLanguage: 'en', includedLanguages: 'de,es,fr,it,nl', autoDisplay: false}, 'google_translate_element');
						}
			</script>
			<script type="text/javascript" src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
		</div>
		
		<div class="pdf-button">
			<a href="#https://confluence.wildix.com/spaces/flyingpdf/pdfpageexport.action?pageId=23986251" alt="Convert to .pdf" title="Convert to .pdf"><img src="https://confluence.wildix.com/download/attachments/14549012/pdf-button-download-wildix-documentation.png"></a>
		</div>
	</div>
</div>

Introduction

To prevent cross site data interception, 'Origin' header whitelist has been implemented for API queries

Technical Details

Whitelist can be configured in WMS Settings > PBX > Security

Settings are stored in /rw2/etc/pbx/http-security.conf

Different domains are supported for configuration e.g.The main purpose of adding domains to a whitelist is to protect PBX from cross-site request forgery (CSRF) attacks.

How it works:
Generally, web requests are restricted to only the current domain, per the same-origin policy. The same-origin policy is a significant security standard implemented by web browsers to prevent requests against a different origin (e.g., different domain) than the one from which it was served. At the same time, the same-origin policy also prevents legitimate interactions between a server and clients of a known and trusted origin.

To allow such interactions, Cross-origin resource sharing (CORS) is used. It is a standard that allows cross-domain requests. The simplest way is to check that the request originates from a trusted site, using the Origin request header:

Access-Control-Allow-Origin

Configuration of Domain Whitelist

Whitelist is configured in WMS -> Settings -> PBX -> Security.

To configure a domain whitelist:

1. Enter IP address/ domain name and click + to add the value:
   
   

   Supported formats of IP address/ domain name:

   • http://<domain or

...

1. • IP address> / https://domain or

...

1. •  IP address> 
   • http://<domain or

...

1. • IP address>:port / https://<domain or

...

1. • IP address>:port

   Examples:

   • https://ucua.wildixin.com/
   • https://ucua.wildixin.com:4443/

   • http://ucua.wildixin.com/ 

     
     

   Note
   Note:

...

1. Wildix Portal

...

1. "https://pbx.wildix.com

...

1. /" and Wildix Chrome Extension "https:

...

1. //chrome-extension://lobgohpoobpijgfegnlhdnppegdbomkn

...

1. " are hardcoded in the whitelist, there is no need to add them.

   
   

   Note
   Note: IP range can't be specified in this case. You just need to

...

1. enter one IP address or domain name.

During feature implementation following changes were made:

...

• /collaboration/index.php
• /features/features_user.php

...

1. After you enter all the values, click Save:

   
   

   
   

To delete the value from the list, click X.

<div class="fb-like" data-href="#https://confluence.wildix.com/x/SwBuAQ" data-layout="button_count" data-action="recommend" data-size="large" data-show-faces="true" data-share="true"></div>

...