From 813ac5661996afc7d12bcb5856a728e5e73cabf9 Mon Sep 17 00:00:00 2001
From: Leo Feyer <github@contao.org>
Date: Tue, 18 Apr 2017 10:48:02 +0200
Subject: [PATCH] Do not add the CORS headers in the install tool (see #8681).

---
 system/docs/CHANGELOG.md                          | 3 +++
 system/modules/core/library/Contao/Controller.php | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/system/docs/CHANGELOG.md b/system/docs/CHANGELOG.md
index a25e11ef53..ed16e177b1 100644
--- a/system/docs/CHANGELOG.md
+++ b/system/docs/CHANGELOG.md
@@ -4,6 +4,9 @@ Contao Open Source CMS changelog
 Version 3.5.26 (2017-XX-XX)
 ---------------------------
 
+### Fixed
+Do not add the CORS headers in the install tool (see #8681).
+
 ### Fixed
 Correctly move folders with an "@" in their name (see #8674).
 
diff --git a/system/modules/core/library/Contao/Controller.php b/system/modules/core/library/Contao/Controller.php
index 04f699996e..b8d86c572c 100644
--- a/system/modules/core/library/Contao/Controller.php
+++ b/system/modules/core/library/Contao/Controller.php
@@ -1063,6 +1063,11 @@ public static function redirect($strLocation, $intStatus=303)
 	 */
 	public static function setCorsHeaders()
 	{
+		if (TL_SCRIPT == 'contao/install.php')
+		{
+			return;
+		}
+
 		$strOrigin = \Environment::get('httpOrigin');
 
 		// Not a CORS request