diff options
| author | Ivan Kohler <ivan@freeside.biz> | 2016-01-05 09:09:11 -0800 |
|---|---|---|
| committer | Ivan Kohler <ivan@freeside.biz> | 2016-01-05 09:09:11 -0800 |
| commit | cc02a828a03aecd99780bd84a6cec3d375d3b279 (patch) | |
| tree | 8a1a4581c0489983731be442a560aee29a808569 | |
| parent | 66e82f51b41366104ae9acc37c5be149018ec085 (diff) | |
clickjacking protection: set X-Frame-Options SAMEORIGIN, RT#39607
| -rw-r--r-- | FS/FS/Mason/Request.pm | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/FS/FS/Mason/Request.pm b/FS/FS/Mason/Request.pm index 022ff8e8a..537ba2d78 100644 --- a/FS/FS/Mason/Request.pm +++ b/FS/FS/Mason/Request.pm @@ -65,6 +65,10 @@ sub freeside_setup { if fileno(STDOUT) != 1; } + FS::Trace->log(' adding headers'); + #frame-ancestors not supported by all the major browsers yet + $HTML::Mason::Commands::r->header_out( 'X-Frame-Options', 'SAMEORIGIN' ); + if ( $filename =~ qr(/REST/\d+\.\d+/NoAuth/) ) { FS::Trace->log(' handling RT REST/NoAuth file'); |