I'm curious. Why not get your CORS header in the PHP file correct, get the referrer in the PHP script and just do this?
+ System: On start of layout
-> AJAX: Request "http://www.zuzu.games/upload/our/get-content_NEW.php" (tag "partner")
+ AJAX: On "partner" completed
-> Text: Set text to AJAX.LastData
Seems like a lot of effort you're going through just to get a 1 or a 0 from a php file.
Oh, and to solve your JQuery issue, I cheat. I just use this plugin:
construct.net/en/make-games/addons/162/jquery-plugin
That way, I don't have to mess with converting $'s.
And here's an example I use for my CORS headers.
//This attempts to grab the URL of the requesting domain (origin) using different methods.
$http_origin = NULL;
if (array_key_exists('HTTP_ORIGIN', $_SERVER)) {
$http_origin = $_SERVER['HTTP_ORIGIN'];
}
else if (array_key_exists('HTTP_REFERER', $_SERVER)) {
$http_origin = $_SERVER['HTTP_REFERER'];
} else {
$http_origin = $_SERVER['REMOTE_ADDR'];
}
//This is for testing. If no origin is found it displays a dump of the $_SERVER var to help
//you figure out why. Once working correctly you can change the die() to provide a response showing
//that the origin is invalid.
if (!isset($http_origin)){
var_dump($_SERVER);
die("No Origin Server Error");
}
//This is also for testing purposes. It creates a small text file to list all of the incoming origins.
//Once you verify the origins are correct, you can delete these lines.
$myfile = fopen("origin.txt", "w") or die("Unable to open file!");
$txt = $http_origin;
fwrite($myfile, $txt);
fclose($myfile);
//And here's where I validate the origin against known good origins. In this case, the C3 preview
//domain and my personal domain. You could validate this like you do in your script by comparing
//the origin with a list from another URL. If the origin is correct, it sends the header saying
//the origin has permission to use this script and that it can POST.
if ($http_origin == "https://preview.construct.net" || $http_origin == "https://www.twistedvoid.com") {
header("Access-Control-Allow-Origin: $http_origin");
header('Access-Control-Allow-Methods: "POST"');
}
And thinking about it, you could just use this as your test of valid partners. If they are a partner, the Ajax request would send back no errors and the On "partner" completed request would succeed. If they aren't a partner, then you could test for the Ajax.OnError("partner") and it would be true.