From 4a182d015ac851b315dca68036effd754fe04e97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come@opensides.be>
Date: Tue, 26 Jun 2018 11:32:10 +0200
Subject: [PATCH] :sparkles: feat(core) Add header to forbid framing
Also added security headers in standAlonePage so that they are set on
recovery page as well
issue #5842
---
html/class_passwordRecovery.inc | 9 +++++++++
html/index.php | 1 +
html/main.php | 1 +
html/setup.php | 1 +
4 files changed, 12 insertions(+)
diff --git a/html/class_passwordRecovery.inc b/html/class_passwordRecovery.inc
index 1bc84b093..7b21ea0d0 100644
--- a/html/class_passwordRecovery.inc
+++ b/html/class_passwordRecovery.inc
@@ -104,6 +104,8 @@ class standAlonePage {
load_plist();
$ssl = $this->checkForSSL();
+
+ static::securityHeaders();
}
}
@@ -222,6 +224,13 @@ class standAlonePage {
return $params;
}
+ static function securityHeaders()
+ {
+ header('X-XSS-Protection: 1; mode=block');
+ header('X-Content-Type-Options: nosniff');
+ header('X-Frame-Options: deny');
+ }
+
static function generateRandomHash()
{
/* Generate a very long random value */
diff --git a/html/index.php b/html/index.php
index 468a9b83d..a8abca46a 100644
--- a/html/index.php
+++ b/html/index.php
@@ -29,6 +29,7 @@ require_once ("class_logging.inc");
header('Content-type: text/html; charset=UTF-8');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
/* Display the login page and exit() */
function displayLogin()
diff --git a/html/main.php b/html/main.php
index f1480f8e4..d762e01ab 100644
--- a/html/main.php
+++ b/html/main.php
@@ -31,6 +31,7 @@ require_once ("variables.inc");
header('Content-type: text/html; charset=UTF-8');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
/* Set the text domain as 'fusiondirectory' */
$domain = 'fusiondirectory';
diff --git a/html/setup.php b/html/setup.php
index 292e5f555..2319bcb7e 100644
--- a/html/setup.php
+++ b/html/setup.php
@@ -39,6 +39,7 @@ require_once("../setup/class_setupStepFinish.inc");
header('Content-type: text/html; charset=UTF-8');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
/* Set cookie lifetime to one day (The parameter is in seconds ) */
session_set_cookie_params(24 * 60 * 60);
--
GitLab