From 70e1f85971020206dd2db756d2dc0b4a2487998d Mon Sep 17 00:00:00 2001
From: Subhodip Ghosh <suvodip@siliconpin.com>
Date: Tue, 27 Jan 2026 12:56:41 +0530
Subject: [PATCH] add CORS

---
 .hta_config/conf.php                 | 15 +++++++++++--
 .hta_slug/dns-tools-get-a-record.php | 32 +++++++++++++++++++++++-----
 2 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/.hta_config/conf.php b/.hta_config/conf.php
index fdad10f..b78d9ce 100644
--- a/.hta_config/conf.php
+++ b/.hta_config/conf.php
@@ -6,7 +6,7 @@
 $API_HEADERS = [
     'Content-Type: application/json; charset=utf-8',
     'Access-Control-Allow-Origin: *',
-    'Access-Control-Allow-Methods: GET, POST, OPTIONS',
+    'Access-Control-Allow-Methods: POST, OPTIONS',
     'Access-Control-Allow-Headers: Content-Type, Authorization',
     'X-Powered-By: SiliconPin Tools'
 ];
@@ -14,9 +14,20 @@ $API_HEADERS = [
 /**
  * Apply headers helper
  */
-function applyApiHeaders(array $headers)
+function applyApiHeaders(array $headers): void
 {
     foreach ($headers as $header) {
         header($header);
     }
 }
+
+/**
+ * Handle CORS preflight globally
+ */
+function handleCorsPreflight(): void
+{
+    if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+        http_response_code(200);
+        exit;
+    }
+}
diff --git a/.hta_slug/dns-tools-get-a-record.php b/.hta_slug/dns-tools-get-a-record.php
index d34838e..02b4863 100644
--- a/.hta_slug/dns-tools-get-a-record.php
+++ b/.hta_slug/dns-tools-get-a-record.php
@@ -1,6 +1,12 @@
 <?php
-    require_once __DIR__ . '/../../hta_config/conf.php';
-    applyApiHeaders($API_HEADERS);
+require_once __DIR__ . '/../../hta_config/conf.php';
+
+// -------------------------------
+// Apply headers + CORS
+// -------------------------------
+applyApiHeaders($API_HEADERS);
+handleCorsPreflight();
+
 // -------------------------------
 // Allow only POST
 // -------------------------------
@@ -19,7 +25,23 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 $rawInput = file_get_contents('php://input');
 $data = json_decode($rawInput, true);
 
-$domain = $data['domain'] ?? '';
+if (!is_array($data)) {
+    http_response_code(400);
+    echo json_encode([
+        'success' => false,
+        'message' => 'Invalid JSON payload'
+    ]);
+    exit;
+}
+
+// -------------------------------
+// Extract + normalize domain
+// -------------------------------
+$domain = trim($data['domain'] ?? '');
+
+// Remove protocol if user sends URL
+$domain = preg_replace('#^https?://#', '', $domain);
+$domain = preg_replace('#/.*$#', '', $domain);
 
 // -------------------------------
 // Domain validation
@@ -42,7 +64,7 @@ if (!$domain || !validateDomain($domain)) {
 }
 
 // -------------------------------
-// DNS lookup (NO shell_exec)
+// DNS A record lookup
 // -------------------------------
 $records = dns_get_record($domain, DNS_A);
 $ips = [];
@@ -71,5 +93,5 @@ if (empty($ips)) {
 echo json_encode([
     'success' => true,
     'domain'  => $domain,
-    'ips'     => $ips
+    'ips'     => array_values(array_unique($ips))
 ]);