Elevate X-Frame-Options from all admin and user pages to all PHP

responses.  Fixes #1922.

1 files changed, 3 insertions, 0 deletions

diff --git a/index.php b/index.php
index 9a6cc2ea..e6540791 100644
--- a/index.php
+++ b/index.php
@@ -51,6 +51,9 @@ ini_set("display_errors", false);
 // Ajax code.
 ini_set("session.use_trans_sid", false);
 
+// Restrict all response frames to the same origin for security
+header("X-Frame-Options: SAMEORIGIN");
+
 define("EXT", ".php");
 define("DOCROOT", getcwd() . "/");
 define("KOHANA",  "index.php");