Merge branch '5842-security-missing-security-headers' into '1.3-dev'

Resolve "Security: Missing Security Headers"

See merge request fusiondirectory/fd!303

(cherry picked from commit 7d9a58d9)

4a182d01  feat(core) Add header to forbid framing

html/class_passwordRecovery.inc

@@ -104,6 +104,8 @@ class standAlonePage {
       load_plist();
 
       $ssl = $this->checkForSSL();
+
+      static::securityHeaders();
     }
   }
 
@@ -221,6 +223,13 @@ class standAlonePage {
     return preg_replace('/^&/', '?', $params);
   }
 
+  static function securityHeaders()
+  {
+    header('X-XSS-Protection: 1; mode=block');
+    header('X-Content-Type-Options: nosniff');
+    header('X-Frame-Options: deny');
+  }
+
   static function generateRandomHash()
   {
     /* Generate a very long random value */

html/index.php

@@ -29,6 +29,7 @@ require_once ("class_logging.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /*****************************************************************************
  *                               M   A   I   N                               *

html/main.php

@@ -31,6 +31,7 @@ require_once ("variables.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set the text domain as 'fusiondirectory' */
 $domain = 'fusiondirectory';

html/setup.php

@@ -39,6 +39,7 @@ require_once("../setup/class_setupStepFinish.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set cookie lifetime to one day (The parameter is in seconds ) */
 session_set_cookie_params(24 * 60 * 60);