@@ -, +, @@ attacks --- C4/Output.pm | 11 ++++++----- koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc | 12 ++++++++++++ koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc | 12 ++++++++++++ 3 files changed, 30 insertions(+), 5 deletions(-) --- a/C4/Output.pm +++ a/C4/Output.pm @@ -264,11 +264,12 @@ sub output_with_http_headers { my $cache_policy = 'no-cache'; $cache_policy .= ', no-store, max-age=0' if $extra_options->{force_no_caching}; my $options = { - type => $content_type_map{$content_type}, - status => $status, - charset => 'UTF-8', - Pragma => 'no-cache', - 'Cache-Control' => $cache_policy, + type => $content_type_map{$content_type}, + status => $status, + charset => 'UTF-8', + Pragma => 'no-cache', + 'Cache-Control' => $cache_policy, + 'X-Frame-Options' => 'DENY', }; $options->{expires} = 'now' if $extra_options->{force_no_caching}; --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -2,6 +2,18 @@ [% USE AudioAlerts %] [% USE String %] + +[%# Prevent XFS attacks -%] + + + --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc +++ a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc @@ -1,6 +1,18 @@ + +[%# Prevent XFS attacks -%] + + + [% IF ( bidi ) %] --