From 294e65737cd2c4f0159a207bca0b755d4e34632b Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Sat, 16 Jan 2016 11:48:22 -0500
Subject: [PATCH] Send X-Frame-Options headers with every HTTP response
---
program/include/rcmail_output_html.php | 6 +++---
program/lib/Roundcube/rcube_output.php | 5 +++++
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
index f602010..8dda8c3 100644
--- a/program/include/rcmail_output_html.php
+++ b/program/include/rcmail_output_html.php
@@ -516,10 +516,10 @@
// write all javascript commands
$this->add_script($commands, 'head_top');
- // send clickjacking protection headers
+ // allow (legal) iframe content to be loaded
$iframe = $this->framed || $this->env['framed'];
- if (!headers_sent() && ($xframe = $this->app->config->get('x_frame_options', 'sameorigin'))) {
- header('X-Frame-Options: ' . ($iframe && $xframe == 'deny' ? 'sameorigin' : $xframe));
+ if (!headers_sent() && $iframe && $this->app->config->get('x_frame_options', 'sameorigin') === 'deny') {
+ header('X-Frame-Options: sameorigin', true);
}
// call super method
diff --git a/program/lib/Roundcube/rcube_output.php b/program/lib/Roundcube/rcube_output.php
index 5df6721..03ff4c1 100644
--- a/program/lib/Roundcube/rcube_output.php
+++ b/program/lib/Roundcube/rcube_output.php
@@ -190,6 +190,11 @@
// Request browser to disable DNS prefetching (CVE-2010-0464)
header("X-DNS-Prefetch-Control: off");
+
+ // send CSRF and clickjacking protection headers
+ if ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')) {
+ header('X-Frame-Options: ' . $xframe);
+ }
}
/**
--
Gitblit v1.9.1