Limit browser checks to libs only for CORS via @require (#1829)

* Enough testing on main .user.js... seems solid. Post #1826 Auto-merge
OpenUserJS · Jul 23, 2021 · dc662c1 · dc662c1
1 parent cab7e47
commit dc662c1
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/controllers/scriptStorage.js b/controllers/scriptStorage.js
@@ -687,7 +687,9 @@ exports.sendScript = function (aReq, aRes, aNext) {
           source = chunks.join(''); // NOTE: Watchpoint
 
           // Send the script
-          aRes.set('Access-Control-Allow-Origin', '*');
+          if (aScript.isLib) {
+            aRes.set('Access-Control-Allow-Origin', '*');
+          }
           aRes.set('Content-Type', 'text/javascript; charset=UTF-8');
           aStream.setEncoding('utf8');