Merge "Use WebRequest instead of $_SERVER in ApiMain."

diff --combined includes/api/ApiMain.php
index 6b5d6d1,341df24..5e97293
--- 1/includes/api/ApiMain.php
--- 2/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@@ -65,7 -65,6 +65,7 @@@ class ApiMain extends ApiBase 
  
                // Write modules
                'purge' => 'ApiPurge',
 +              'setnotificationtimestamp' => 'ApiSetNotificationTimestamp',
                'rollback' => 'ApiRollback',
                'delete' => 'ApiDelete',
                'undelete' => 'ApiUndelete',
@@@ -423,15 -422,22 +423,22 @@@
         */
        protected function handleCORS() {
                global $wgCrossSiteAJAXdomains, $wgCrossSiteAJAXdomainExceptions;
-               $response = $this->getRequest()->response();
+ 
                $originParam = $this->getParameter( 'origin' ); // defaults to null
                if ( $originParam === null ) {
                        // No origin parameter, nothing to do
                        return true;
                }
+ 
+               $request = $this->getRequest();
+               $response = $request->response();
                // Origin: header is a space-separated list of origins, check all of them
-               $originHeader = isset( $_SERVER['HTTP_ORIGIN'] ) ? $_SERVER['HTTP_ORIGIN'] : '';
-               $origins = explode( ' ', $originHeader );
+               $originHeader = $request->getHeader( 'Origin' );
+               if ( $originHeader === false ) {
+                       $origins = array();
+               } else {
+                       $origins = explode( ' ', $originHeader );
+               }
                if ( !in_array( $originParam, $origins ) ) {
                        // origin parameter set but incorrect
                        // Send a 403 response