From e3cdb0c565272087d283d7211d6a669988b4831c Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 8 Apr 2016 10:04:20 +0100 Subject: [PATCH] Bug 16210: Set X-Frame-Options to SAMEORIGIN in 2 other places MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The login page should not be displayed if the page is displayed in a frame. Signed-off-by: Marc VĂ©ron --- C4/Auth.pm | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index bff7fcd..e3aecec 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -194,9 +194,11 @@ sub get_template_and_user { $template->param( loginprompt => 1 ); print $in->{query}->header( - -type => 'text/html', - -charset => 'utf-8', - -cookie => $cookie, + { type => 'text/html', + charset => 'utf-8', + cookie => $cookie, + 'X-Frame-Options' => 'SAMEORIGIN' + } ), $template->output; safe_exit; @@ -1307,9 +1309,11 @@ sub checkauth { # $cookie = $query->cookie(CGISESSID => $session->id # ); print $query->header( - -type => 'text/html', - -charset => 'utf-8', - -cookie => $cookie + { type => 'text/html', + charset => 'utf-8', + cookie => $cookie, + 'X-Frame-Options' => 'SAMEORIGIN' + } ), $template->output; safe_exit; -- 1.7.10.4