Merge branch '5842-security-missing-security-headers' into '1.3-dev'

Resolve "Security: Missing Security Headers"

See merge request fusiondirectory/fd!303

html/class_passwordRecovery.inc

@@ -104,6 +104,8 @@ class standAlonePage {
       load_plist();
 
       $ssl = $this->checkForSSL();
+
+      static::securityHeaders();
     }
   }
 
@@ -222,6 +224,13 @@ class standAlonePage {
     return $params;
   }
 
+  static function securityHeaders()
+  {
+    header('X-XSS-Protection: 1; mode=block');
+    header('X-Content-Type-Options: nosniff');
+    header('X-Frame-Options: deny');
+  }
+
   static function generateRandomHash()
   {
     /* Generate a very long random value */

html/index.php

@@ -29,6 +29,7 @@ require_once ("class_logging.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Display the login page and exit() */
 function displayLogin()

html/main.php

@@ -31,6 +31,7 @@ require_once ("variables.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set the text domain as 'fusiondirectory' */
 $domain = 'fusiondirectory';

html/setup.php

@@ -39,6 +39,7 @@ require_once("../setup/class_setupStepFinish.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set cookie lifetime to one day (The parameter is in seconds ) */
 session_set_cookie_params(24 * 60 * 60);