tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

API Allow X-Frame-Options to be configured

Browse Source 
Fixes #2970
This commit is contained in:
Damian Mooyman 2016-07-15 14:06:05 +12:00
parent b7fc0a2752
commit d08ab6ac81
No known key found for this signature in database
GPG Key ID: 78B823A10DE27D1A
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
admin/code/LeftAndMain.php
View File

@ -164,6 +164,14 @@ class LeftAndMain extends Controller implements PermissionProvider {
*/
private static $session_keepalive_ping = true;
/**
* Value of X-Frame-Options header
*
* @config
* @var string
*/
private static $frame_options = 'SAMEORIGIN';
/**
* @var PjaxResponseNegotiator
*/
@ -470,7 +478,7 @@ class LeftAndMain extends Controller implements PermissionProvider {
// Prevent clickjacking, see https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
$originalResponse = $this->getResponse();
$originalResponse->addHeader('X-Frame-Options', 'SAMEORIGIN');
$originalResponse->addHeader('X-Frame-Options', $this->config()->frame_options);
$originalResponse->addHeader('Vary', 'X-Requested-With');
return $response;

10
security/Security.php
View File

@ -138,6 +138,14 @@ class Security extends Controller implements TemplateGlobalProvider {
*/
private static $lost_password_url = "Security/lostpassword";
/**
* Value of X-Frame-Options header
*
* @config
* @var string
*/
private static $frame_options = 'SAMEORIGIN';
/**
* Get location of word list file
*
@ -317,7 +325,7 @@ class Security extends Controller implements TemplateGlobalProvider {
parent::init();
// Prevent clickjacking, see https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
$this->getResponse()->addHeader('X-Frame-Options', 'SAMEORIGIN');
$this->getResponse()->addHeader('X-Frame-Options', $this->config()->frame_options);
}
public function index() {