Update app.py

app.py

@@ -200,13 +200,22 @@ def save_settings(settings_dict):
     print(f"curators: {curators_ser}")  
     print(f"call_api_key: {call_api_key}") 
     
-
 @app.route('/settings', methods=['GET'])
 def get_settings():
+    # Проверка заголовка Origin
+    origin = request.headers.get('Origin')
+    if origin != ALLOWED_ORIGIN:
+        return jsonify({"error": "Unauthorized access"}), 403
+
     return jsonify(settings)
 
 @app.route('/settings', methods=['POST'])
 def save_settings_route():
+    # Проверка заголовка Origin
+    origin = request.headers.get('Origin')
+    if origin != ALLOWED_ORIGIN:
+        return jsonify({"error": "Unauthorized access"}), 403
+
     data = request.json
     if data:
         for key, value in data.items():
@@ -217,6 +226,7 @@ def save_settings_route():
     else:
         return jsonify({'status': 'error', 'message': 'No data provided'}), 400
 
+
 @app.route('/set')
 def index_set():
     return render_template('settings.html')