From 69b1b0cf1ab25e681a53a3d689867f04d8480727 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 13 Nov 2015 08:19:57 +0000
Subject: [PATCH] Bug 15111: Change X-Frame-Options with SAMEORIGIN

There are some places where frames are used, the greybox JS plugin for
instance.

We need either to allow them from Koha or replace this plugin.
The easier for now is to switch the value from DENY with SAMEORIGIN.

Test plan:
- modify a record in a batch (tools/batch_record_modification.pl)
- click on preview marc
=> With only the previous patch you will get a blank page.
=> With this patch apply, it will work as expected.
---
 C4/Output.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/C4/Output.pm b/C4/Output.pm
index 0527d654..0a0ae21 100644
--- a/C4/Output.pm
+++ b/C4/Output.pm
@@ -269,7 +269,7 @@ sub output_with_http_headers {
         charset           => 'UTF-8',
         Pragma            => 'no-cache',
         'Cache-Control'   => $cache_policy,
-        'X-Frame-Options' => 'DENY',
+        'X-Frame-Options' => 'SAMEORIGIN',
     };
     $options->{expires} = 'now' if $extra_options->{force_no_caching};
 
-- 
2.1.0