Deployed to the cluser.

@Mglaser, this should get added to the next release.

For reproduction / testing, you can add/set en.wikipedia.org in $wgCrossSiteAJAXdomains,

$wgCrossSiteAJAXdomains = array( 'en.wikipedia.org', 'en.wikibooks.org' );

Then run,

curl -ik -H 'Origin: http://en.wikipedia.org.somethingevil.com' 'https://localhost/wiki/api.php?origin=http://en.wikipedia.org.somethingevil.com&action=query&list=allpages&format=json' | grep "Access-Control-Allow-Origin:"

The allow-origin heading will be returned for the somethingevil.com domain before the patch, but not after.

The patch applies to REL1_24 and 1_23. With a slight modification (removal of a blank line) it also applies to REL1_22. It seems, though, that REL1_19 does not check the origin at all, so there will be no backport for 1_19.

In T77028#850877, @Mglaser wrote:

It seems, though, that REL1_19 does not check the origin at all, so there will be no backport for 1_19.

Yes, CORS support was added in 1.20.

Early access for Wikia and Gamepedia