X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Ft%2Fweb%2Fclickjacking-preventions.t;fp=rt%2Ft%2Fweb%2Fclickjacking-preventions.t;h=dde82952beed0aeb49571f82443bfd4492acf2c5;hb=6587f6ba7d047ddc1686c080090afe7d53365bd4;hp=0000000000000000000000000000000000000000;hpb=47153aae5c2fc00316654e7277fccd45f72ff611;p=freeside.git

diff --git a/rt/t/web/clickjacking-preventions.t b/rt/t/web/clickjacking-preventions.t
new file mode 100644
index 000000000..dde82952b
--- /dev/null
+++ b/rt/t/web/clickjacking-preventions.t
@@ -0,0 +1,30 @@
+#!/usr/bin/env perl
+use strict;
+use warnings;
+
+use RT::Test tests => 11;
+
+my ($url, $m);
+
+# Enabled by default
+{
+    ok(RT->Config->Get('Framebusting'), "Framebusting enabled by default");
+
+    ($url, $m) = RT::Test->started_ok;
+    $m->get_ok($url);
+    $m->content_contains('if (window.top !== window.self) {', "Found the framekiller javascript");
+    is $m->response->header('X-Frame-Options'), 'DENY', "X-Frame-Options is set to DENY";
+
+    RT::Test->stop_server;
+}
+
+# Disabled
+{
+    RT->Config->Set('Framebusting', 0);
+
+    ($url, $m) = RT::Test->started_ok;
+    $m->get_ok($url);
+    $m->content_lacks('if (window.top !== window.self) {', "Didn't find the framekiller javascript");
+    is $m->response->header('X-Frame-Options'), undef, "X-Frame-Options is not present";
+}
+