version bump

CHANGELOG

@@ -1,5 +1,6 @@
 owncloud-news (2.002)
 * Better check for news app dependencies
+* Security: Don't send CORS Allow-Credentials header to prevent CSRF
 
 owncloud-news (2.001)
 * Delete folders, feeds and articles if a user is deleted

appinfo/info.xml

@@ -5,6 +5,6 @@
 	<description>An RSS/Atom feed reader. Requires ownCloud backgroundjobs or an updater script to be enabled to update your feeds. See the README.rst in the apps top directory</description>
 	<licence>AGPL</licence>
 	<author>Alessandro Cosentino, Bernhard Posselt, Jan-Christoph Borchardt. Powered by SimplePie (Ryan Parman, Geoffrey Sneddon, Ryan McCue and contributors).</author>
-	<version>2.001</version>
+	<version>2.002</version>
 	<require>6.0.3</require>
 </info>

appinfo/version

@@ -1 +1 @@
-2.001
+2.002

controller/apicontroller.php

@@ -83,7 +83,7 @@ public function cors() {
 		$response->addHeader('Access-Control-Allow-Origin', $origin);
 		$response->addHeader('Access-Control-Allow-Methods', 
 			'PUT, POST, GET, DELETE');
-		$response->addHeader('Access-Control-Allow-Credentials', 'true');
+		$response->addHeader('Access-Control-Allow-Credentials', 'false');
 		$response->addHeader('Access-Control-Max-Age', '1728000');
 		$response->addHeader('Access-Control-Allow-Headers', 
 			'Authorization, Content-Type');