[core] Adding toggle for CORS, GZIP in admin/cms configuration (#30)

This PR enables admins to disable/enable CORS and GZIP from within the admin CMS configuration page. Both are enabled by default.

Note: currently, the GZIP implementation is 100% on the fly, for every qualifying API endpoint request. This could add significant CPU usage, but dramatically decreases bandwidth. Will be considering other better implementations, but for now YMMV.

Possible optimizations:
- pooling gzip Writers vs. creating a new one for each response
- caching gzipped responses (in memory? on disk?) 
- enforcing size threshold (only gzip content larger than N bytes) 

4 files changed, 22 insertions, 6 deletions

diff --git a/system/admin/config/config.go b/system/admin/config/config.go
index 7b57dc0..0d55700 100644
--- a/system/admin/config/config.go
+++ b/system/admin/config/config.go
@@ -16,6 +16,8 @@ type Config struct {
 	AdminEmail      string   `json:"admin_email"`
 	ClientSecret    string   `json:"client_secret"`
 	Etag            string   `json:"etag"`
+	DisableCORS     bool     `json:"cors_disabled"`
+	DisableGZIP     bool     `json:"gzip_disabled"`
 	CacheInvalidate []string `json:"cache"`
 }
 
@@ -49,7 +51,7 @@ func (c *Config) MarshalEditor() ([]byte, error) {
 		},
 		editor.Field{
 			View: editor.Input("AdminEmail", c, map[string]string{
-				"label": "Adminstrator Email (will be notified of internal system information)",
+				"label": "Adminstrator Email (notified of internal system information)",
 			}),
 		},
 		editor.Field{
@@ -65,7 +67,7 @@ func (c *Config) MarshalEditor() ([]byte, error) {
 		},
 		editor.Field{
 			View: editor.Input("Etag", c, map[string]string{
-				"label":    "Etag Header (used for static asset cache)",
+				"label":    "Etag Header (used to cache resources)",
 				"disabled": "true",
 			}),
 		},
@@ -75,6 +77,20 @@ func (c *Config) MarshalEditor() ([]byte, error) {
 			}),
 		},
 		editor.Field{
+			View: editor.Checkbox("DisableCORS", c, map[string]string{
+				"label": "Disable CORS (so only " + c.Domain + " can fetch your data)",
+			}, map[string]string{
+				"true": "Disable CORS",
+			}),
+		},
+		editor.Field{
+			View: editor.Checkbox("DisableGZIP", c, map[string]string{
+				"label": "Disable GZIP (will increase server speed, but also bandwidth)",
+			}, map[string]string{
+				"true": "Disable GZIP",
+			}),
+		},
+		editor.Field{
 			View: editor.Checkbox("CacheInvalidate", c, map[string]string{
 				"label": "Invalidate cache on save",
 			}, map[string]string{
diff --git a/system/admin/handlers.go b/system/admin/handlers.go
index c39fee4..2bea356 100644
--- a/system/admin/handlers.go
+++ b/system/admin/handlers.go
@@ -92,7 +92,7 @@ func initHandler(res http.ResponseWriter, req *http.Request) {
 		}
 
 		// set HTTP port which should be previously added to config cache
-		port := db.ConfigCache("http_port")
+		port := db.ConfigCache("http_port").(string)
 		req.Form.Set("http_port", port)
 
 		// set initial user email as admin_email and make config
@@ -1533,7 +1533,7 @@ func editHandler(res http.ResponseWriter, req *http.Request) {
 
 		// create a timestamp if one was not set
 		if ts == "" {
-			ts := fmt.Sprintf("%d", time.Now().Unix()*1000)
+			ts = fmt.Sprintf("%d", int64(time.Nanosecond)*time.Now().UnixNano()/int64(time.Millisecond))
 			req.PostForm.Set("timestamp", ts)
 		}
 
diff --git a/system/admin/server.go b/system/admin/server.go
index f2bf244..11bfe6f 100644
--- a/system/admin/server.go
+++ b/system/admin/server.go
@@ -51,5 +51,5 @@ func Run() {
 	// even if the API server is not running. Otherwise, images/files uploaded
 	// through the editor will not load within the admin system.
 	uploadsDir := filepath.Join(pwd, "uploads")
-	http.Handle("/api/uploads/", api.Record(db.CacheControl(http.StripPrefix("/api/uploads/", http.FileServer(restrict(http.Dir(uploadsDir)))))))
+	http.Handle("/api/uploads/", api.Record(api.CORS(db.CacheControl(http.StripPrefix("/api/uploads/", http.FileServer(restrict(http.Dir(uploadsDir))))))))
 }
diff --git a/system/admin/upload/upload.go b/system/admin/upload/upload.go
index 486f55c..6b99dfc 100644
--- a/system/admin/upload/upload.go
+++ b/system/admin/upload/upload.go
@@ -20,7 +20,7 @@ func StoreFiles(req *http.Request) (map[string]string, error) {
 	ts := req.FormValue("timestamp") // timestamp in milliseconds since unix epoch
 
 	if ts == "" {
-		ts = fmt.Sprintf("%d", time.Now().Unix()*1000) // Unix() returns seconds since unix epoch
+		ts = fmt.Sprintf("%d", int64(time.Nanosecond)*time.Now().UnixNano()/int64(time.Millisecond)) // Unix() returns seconds since unix epoch
 	}
 
 	req.Form.Set("timestamp", ts)