From d37fdb81d90a551ea9ec7f6a9d4595bb21a0947b Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 8 Apr 2016 10:03:24 +0100 Subject: [PATCH] [PASSED QA] Bug 16210: Revert OPAC changes from Bug 15111 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch reverts the changes made at the OPAC from the following patches: Do not include the antiClickjack legacy browser trick for greybox" Revert "Bug 15111: Do not include the antiClickjack legacy browser trick for greybox" This reverts commit fc640d2a86f395ad392f84314bce22e8b4dab1fe. Revert "Bug 15111: Change X-Frame-Options with SAMEORIGIN" This reverts commit fb167c0e4b897bf9a93b4fd6176b15e2d4dbd4df. Revert "Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks" This reverts commit dc03bca76cf5b7cb48d98d1ce245fc65b98be929. Setting X-Frame-Options to SAMEORIGIN is enough for mordern browsers: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options The antiClickjack trick should be removed at the OPAC as we want to keep the OPAC usable even if the user has disabled JS. That means the OPAC will be vulnerable to XFS if a user is navigating with a prehistoric browser: Firefox 3.6.9 September 2010 IE 8 March 2008 Opera 10.5 March 2010 Safari 4 February 2009 Chrome 4.1.… somewhen 2010 Test plan: Confirm that there are no regression of bug 15111 with modern browsers Signed-off-by: Marc Véron Signed-off-by: Katrin Fischer --- .../opac-tmpl/bootstrap/en/includes/doc-head-close.inc | 14 -------------- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt | 2 +- 2 files changed, 1 insertion(+), 15 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc index 54cf6c7..e346689 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc @@ -1,20 +1,6 @@ - -[%# Prevent XFS attacks -%] -[% UNLESS popup %] - - -[% END %] - [% IF ( bidi ) %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt index fdb1d72..4db0d1a 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt @@ -1,7 +1,7 @@ [% INCLUDE 'doc-head-open.inc' %] [% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Your search IDREF for ppn [% unimarc3 %] -[% INCLUDE 'doc-head-close.inc' popup => 1 %] +[% INCLUDE 'doc-head-close.inc' %] [% BLOCK cssinclude %]