Bug 19569 - X-Frame-Options=SAMEORIGIN is not set from opac-showmarc.pl
Summary: X-Frame-Options=SAMEORIGIN is not set from opac-showmarc.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 19552
  Show dependency treegraph
 
Reported: 2017-11-02 19:59 UTC by Jonathan Druart
Modified: 2019-10-14 19:56 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok (1.16 KB, patch)
2017-11-02 20:07 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok (1.21 KB, patch)
2017-11-06 14:51 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok (1.26 KB, patch)
2017-11-06 16:26 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok (1.34 KB, patch)
2017-12-08 18:01 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2017-11-02 19:59:34 UTC

    
Comment 1 Jonathan Druart 2017-11-02 20:00:46 UTC
150124 Clickjacking - Framable Page
Comment 2 Jonathan Druart 2017-11-02 20:07:24 UTC
Created attachment 68900 [details] [review]
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok

Before and after:
wget 'http://catalogue.kohadev.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html'
must be the same
Comment 3 Mark Tompsett 2017-11-06 14:51:10 UTC
Created attachment 68980 [details] [review]
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok

Before and after:
wget 'http://catalogue.kohadev.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html'
must be the same

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 4 Mark Tompsett 2017-11-06 14:52:49 UTC
As I had no data to worry about, I did a reset_all between steps. Worked fine.

 wget 'http://kohadev.mydnsname.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html' -O ~/before.html
git bz apply
reset_all
 wget 'http://kohadev.mydnsname.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html' -O ~/after.html
diff ~/before.html ~/after.html
Comment 5 Nick Clemens (kidclamp) 2017-11-06 16:26:29 UTC
Created attachment 68983 [details] [review]
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok

Before and after:
wget 'http://catalogue.kohadev.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html'
must be the same

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 6 Jonathan Druart 2017-12-08 18:01:47 UTC
Created attachment 69653 [details] [review]
Bug 19569: Set X-Frame-Options=SAMEORIGIN - opac-showmarc.ok

Before and after:
wget 'http://catalogue.kohadev.org/cgi-bin/koha/opac-showmarc.pl?id=1&viewas=html'
must be the same

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Chris Cormack 2017-12-20 23:59:34 UTC
Pushed to 16.11.x will be in 16.11.15
Comment 8 Nick Clemens (kidclamp) 2017-12-22 10:57:20 UTC
Pushed to stable for 17.11.01
Comment 9 Fridolin Somers 2018-01-04 09:14:53 UTC
Pushed to 17.05.x for 17.05.07
Comment 10 Jonathan Druart 2018-01-09 20:30:37 UTC
Pushed to master for 18.05, thanks to everybody involved!