diff options
| author | Bharat Mediratta <bharat@menalto.com> | 2012-11-06 11:51:44 -0800 |
|---|---|---|
| committer | Bharat Mediratta <bharat@menalto.com> | 2012-11-06 11:51:44 -0800 |
| commit | 50f5286ffbc6a675f97faf629893d2e248382396 (patch) | |
| tree | 1a4e0f5601d38fc5ab18d79e76bcc08fc4afedf0 | |
| parent | 7a53cebd29c00afbc53ab5c60f8980d8b6d204a0 (diff) | |
Elevate X-Frame-Options from all admin and user pages to all PHP
responses. Fixes #1922.
| -rw-r--r-- | index.php | 3 | ||||
| -rw-r--r-- | themes/admin_wind/views/admin.html.php | 1 | ||||
| -rw-r--r-- | themes/wind/views/page.html.php | 1 |
3 files changed, 3 insertions, 2 deletions
@@ -51,6 +51,9 @@ ini_set("display_errors", false); // Ajax code. ini_set("session.use_trans_sid", false); +// Restrict all response frames to the same origin for security +header("X-Frame-Options: SAMEORIGIN"); + define("EXT", ".php"); define("DOCROOT", getcwd() . "/"); define("KOHANA", "index.php"); diff --git a/themes/admin_wind/views/admin.html.php b/themes/admin_wind/views/admin.html.php index 0300f7af..9a149149 100644 --- a/themes/admin_wind/views/admin.html.php +++ b/themes/admin_wind/views/admin.html.php @@ -1,5 +1,4 @@ <?php defined("SYSPATH") or die("No direct script access.") ?> -<?php header("X-Frame-Options: SAMEORIGIN"); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" <?= $theme->html_attributes() ?> xml:lang="en" lang="en"> diff --git a/themes/wind/views/page.html.php b/themes/wind/views/page.html.php index 5bbbb509..23021e4d 100644 --- a/themes/wind/views/page.html.php +++ b/themes/wind/views/page.html.php @@ -1,5 +1,4 @@ <?php defined("SYSPATH") or die("No direct script access.") ?> -<?php header("X-Frame-Options: SAMEORIGIN"); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" <?= $theme->html_attributes() ?> xml:lang="en" lang="en"> |