Allow cross-origin reads of all OPML files

includes/class-opml.php

@@ -601,6 +601,10 @@ public static function render() {
 			return;
 		}
 
+		// Every list is public, so apps on other sites may read it in the
+		// browser as well.
+		\header( 'Access-Control-Allow-Origin: *' );
+
 		if ( $following ) {
 			self::serve_following( $posts );
 		}
@@ -618,18 +622,15 @@ public static function render() {
 	 * Serve the following list the way FollowSpec readers expect it, and
 	 * exit.
 	 *
-	 * The OPML media type, open to other sites in the browser, and with
-	 * an ETag, so a reader that asks again with If-None-Match gets a 304
-	 * while nothing changed. Such a request from another site asks first
-	 * with OPTIONS.
+	 * The OPML media type and an ETag, so a reader that asks again with
+	 * If-None-Match gets a 304 while nothing changed. A browser on
+	 * another site asks with OPTIONS first before it sends that header.
 	 *
 	 * See https://followspec.org/
 	 *
 	 * @param \WP_Post[] $posts Blogroll posts.
 	 */
 	private static function serve_following( $posts ) {
-		\header( 'Access-Control-Allow-Origin: *' );
-
 		$method = \strtoupper( \sanitize_text_field( \wp_unslash( $_SERVER['REQUEST_METHOD'] ?? 'GET' ) ) );
 		if ( 'OPTIONS' === $method ) {
 			\status_header( 204 );

readme.md

@@ -139,6 +139,7 @@ Project and support maintained on github at [pfefferle/wordpress-blockroll](http
 
 * Apps that show who you follow can now find the feeds of your blogrolls at `/.well-known/following.opml`, as described in [FollowSpec](https://followspec.org/). If the SocialSpec plugin is active, the feeds are added to its list instead. See #47.
 * Without any blogroll, `/.well-known/recommendations.opml` now answers with an empty list instead of the home page.
+* Apps on other sites can now read every blogroll file in the browser, not only the list of followed feeds.
 
 ### 2.1.1