Bugzilla – Attachment 44828 Details for
Bug 15111
Koha is vulnerable to Cross-Frame Scripting (XFS) attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 15111: Change X-Frame-Options with SAMEORIGIN
Bug-15111-Change-X-Frame-Options-with-SAMEORIGIN.patch (text/plain), 1.17 KB, created by
Jonathan Druart
on 2015-11-13 08:23:30 UTC
(
hide
)
Description:
Bug 15111: Change X-Frame-Options with SAMEORIGIN
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2015-11-13 08:23:30 UTC
Size:
1.17 KB
patch
obsolete
>From 69b1b0cf1ab25e681a53a3d689867f04d8480727 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 13 Nov 2015 08:19:57 +0000 >Subject: [PATCH] Bug 15111: Change X-Frame-Options with SAMEORIGIN > >There are some places where frames are used, the greybox JS plugin for >instance. > >We need either to allow them from Koha or replace this plugin. >The easier for now is to switch the value from DENY with SAMEORIGIN. > >Test plan: >- modify a record in a batch (tools/batch_record_modification.pl) >- click on preview marc >=> With only the previous patch you will get a blank page. >=> With this patch apply, it will work as expected. >--- > C4/Output.pm | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/C4/Output.pm b/C4/Output.pm >index 0527d654..0a0ae21 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -269,7 +269,7 @@ sub output_with_http_headers { > charset => 'UTF-8', > Pragma => 'no-cache', > 'Cache-Control' => $cache_policy, >- 'X-Frame-Options' => 'DENY', >+ 'X-Frame-Options' => 'SAMEORIGIN', > }; > $options->{expires} = 'now' if $extra_options->{force_no_caching}; > >-- >2.1.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 15111
:
44289
|
44339
|
44622
|
44828
|
45444
|
48265
|
48440
|
48441
|
48442
|
48646
|
48647
|
48648