def cors(handler, registry):
    log.info('cors_tunneling enabled')

    allow_origins_setting = registry.settings.get(
        'cors.allow_origins', '').strip()

    allow_origins = [
        each.strip() for each in allow_origins_setting.split(',')]
    allow_credentials = registry.settings.get('cors.allow_credentials', None)

    def cors(request):
        origin = request.headers.get('Origin') or request.host_url
        response = handler(request)

        if origin in allow_origins or '*' in allow_origins:
            response.headerlist.append(('Access-Control-Allow-Origin', origin))

        if allow_credentials is not None:
            response.headerlist.append(
                ('Access-Control-Allow-Credentials', allow_credentials))

        return response

    if not allow_origins_setting:
        log.warning('cors.allow_origins is not set')
    else:
        log.info(allow_origins % 'Allow Origins = %s ')

    if allow_credentials is None:
        log.warning('cors.allow_credentials is not set')

    elif asbool(allow_credentials) and allow_origins_setting == '*':
        raise Exception('Not allowed Access-Control-Allow-Credentials '
                        'to set to TRUE if origin is *')
    else:
        log.info('Access-Control-Allow-Credentials = %s ' % allow_credentials)

    return cors
dataset/ETHPy150Open ramses-tech/nefertari/nefertari/tweens.py/cors/swapped operands of `%`