tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-01 13:48:37 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #5810 from tractorcow/pulls/3/xframe-option

Browse Source 
API Allow X-Frame-Options to be configured
This commit is contained in:
Daniel Hensby 2016-07-15 09:13:05 +01:00 committed by GitHub
commit 6abce3a0b8
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
admin/code/LeftAndMain.php
View File

@ -164,6 +164,14 @@ class LeftAndMain extends Controller implements PermissionProvider {
*/
private static $session_keepalive_ping = true;
/**
* Value of X-Frame-Options header
*
* @config
* @var string
*/
private static $frame_options = 'SAMEORIGIN';
/**
* @var PjaxResponseNegotiator
*/
@ -470,7 +478,7 @@ class LeftAndMain extends Controller implements PermissionProvider {
// Prevent clickjacking, see https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
$originalResponse = $this->getResponse();
$originalResponse->addHeader('X-Frame-Options', 'SAMEORIGIN');
$originalResponse->addHeader('X-Frame-Options', $this->config()->frame_options);
$originalResponse->addHeader('Vary', 'X-Requested-With');
return $response;

10
security/Security.php
View File

@ -138,6 +138,14 @@ class Security extends Controller implements TemplateGlobalProvider {
*/
private static $lost_password_url = "Security/lostpassword";
/**
* Value of X-Frame-Options header
*
* @config
* @var string
*/
private static $frame_options = 'SAMEORIGIN';
/**
* Get location of word list file
*
@ -317,7 +325,7 @@ class Security extends Controller implements TemplateGlobalProvider {
parent::init();
// Prevent clickjacking, see https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
$this->getResponse()->addHeader('X-Frame-Options', 'SAMEORIGIN');
$this->getResponse()->addHeader('X-Frame-Options', $this->config()->frame_options);
}
public function index() {