HTTPUpdateServer Allow external POSTS (CORS)

[hookedupjoe]

This update is to allow the ESP8266HTTPUpdateServer to receive a cross cors POST update from an external domain. This is needed for web based apps / mobile apps to flash using a standard AJAX post from an external device.

Code Used (in case anyone else wants to use Ajax to POST a flash update)
Note: Using XHR direct for blob, less code then jQuery, then jQuery for standard post. Just console the reply to keep it simple for reuse.

function doFlashUpdate(theFilePath, thePostURL){
  var dfd = jQuery.Deferred();
  
  try {
    var oReq = new XMLHttpRequest();
    oReq.open("GET", theFilePath + "?open&time=" + new Date().getTime(), true);
    oReq.responseType = "blob";

    oReq.onload = function(oEvent) {
      var blob = oReq.response;
      var fd = new FormData();
      fd.append('firmware', blob);
      $.ajax({
          type: 'POST',
          url: thePostURL,
          timeout: 20000,
          data: fd,
          processData: false,
          contentType: false
      }).fail(function(data) {
       //--- or fail depending on how you want to work it, but I read the reply for failure / success
          dfd.resolve("Timedout.  Check network connection and try again.");
      }).done(function(data) {
          dfd.resolve(data);
      });
    };
    oReq.send();
   
  } catch(ex) {
    dfd.resolve(false);
  }
  return dfd.promise();
}

Security Notes:

• Even without CORS headers set, anyone can update remotely using CURL or a program like PostMan. For that reason, allowing cross domain access in this way not going to open up security options for a real hacker that wouldn't be using a web browser to hack your device.

• If desired, this can be added as an optional feature, but due to the above note - didn't see a need as it doesn't really do anything. Using real security is the only way to really secure your system from hacker update (along with physical security of course).

  (open for comment / feedback on that assertion).

[devyte]

Codewise this looks ok to me. Need confirmation from 3rd party to merge.