From c170bfc92f48dea0dc009916251acf730b1d885f Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Mon, 05 Sep 2011 04:39:52 -0400
Subject: [PATCH] Protect from Clickjacking by sending X-Frame-Options headers (#1487037)

---
 config/main.inc.php.dist |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/config/main.inc.php.dist b/config/main.inc.php.dist
index 822c6e6..30268e0 100644
--- a/config/main.inc.php.dist
+++ b/config/main.inc.php.dist
@@ -237,6 +237,10 @@
 // check referer of incoming requests
 $rcmail_config['referer_check'] = false;
 
+// X-Frame-Options HTTP header value sent to prevent from Clickjacking.
+// Possible values: sameorigin|deny. Set to false in order to disable sending them
+$rcmail_confoig['x_frame_options'] = 'sameorigin';
+
 // this key is used to encrypt the users imap password which is stored
 // in the session record (and the client cookie if remember password is enabled).
 // please provide a string of exactly 24 chars.

--
Gitblit v1.9.1