Protect from Clickjacking by sending X-Frame-Options headers (#1487037)

git-svn-id: https://svn.roundcube.net/trunk@5164 208e9e7b-5314-0410-a742-e7e81cd9613c

1 files changed, 5 insertions, 0 deletions

diff --git a/roundcubemail/program/include/rcube_template.php b/roundcubemail/program/include/rcube_template.php
index c4dd73b23..1ec8e7dd3 100755
--- a/roundcubemail/program/include/rcube_template.php
+++ b/roundcubemail/program/include/rcube_template.php
@@ -356,6 +356,11 @@ class rcube_template extends rcube_html_page
         // make sure all <form> tags have a valid request token
         $template = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $template);
         $this->footer = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $this->footer);
+        
+        // send clickjacking protection headers
+        $iframe = $this->framed || !empty($_REQUEST['_framed']);
+        if (!headers_sent() && ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')))
+            header('X-Frame-Options: ' . ($iframe && $xframe == 'deny' ? 'sameorigin' : $xframe));
 
         // call super method
         parent::write($template, $this->config['skin_path']);