From f215a8cee1266cba2cd8ad3b3fa80b190c895e61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come@opensides.be>
Date: Tue, 5 Jun 2018 11:56:53 +0200
Subject: [PATCH] :sparkles: feat(core) Add security HTTP headers
issue #5842
---
html/index.php | 6 +++++-
html/main.php | 6 ++++--
html/setup.php | 6 ++++--
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/html/index.php b/html/index.php
index bfed93af4..468a9b83d 100644
--- a/html/index.php
+++ b/html/index.php
@@ -24,7 +24,11 @@ require_once ("../include/php_setup.inc");
require_once ("functions.inc");
require_once ("variables.inc");
require_once ("class_logging.inc");
-header("Content-type: text/html; charset=UTF-8");
+
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
/* Display the login page and exit() */
function displayLogin()
diff --git a/html/main.php b/html/main.php
index 78f6e0cdd..f1480f8e4 100644
--- a/html/main.php
+++ b/html/main.php
@@ -27,8 +27,10 @@ require_once ("../include/php_setup.inc");
require_once ("functions.inc");
require_once ("variables.inc");
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
/* Set the text domain as 'fusiondirectory' */
$domain = 'fusiondirectory';
diff --git a/html/setup.php b/html/setup.php
index 5a0e39c1f..292e5f555 100644
--- a/html/setup.php
+++ b/html/setup.php
@@ -35,8 +35,10 @@ require_once("../setup/class_setupStepMigrate.inc");
require_once("../setup/class_setupStepFinish.inc");
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
/* Set cookie lifetime to one day (The parameter is in seconds ) */
session_set_cookie_params(24 * 60 * 60);
--
GitLab