From: Dave Lawrence <dlawrence@mozilla.com>
Date: Mon, 15 Jul 2013 03:46:19 +0000 (-0400)
Subject: Bug 787328 - xmlrpc.cgi doesn't send any security-related headers
X-Git-Tag: bugzilla-4.4.1~53
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06bc332b7f82f79dc6bc63ad81692a3f8dc9c9fa;p=thirdparty%2Fbugzilla.git

Bug 787328 - xmlrpc.cgi doesn't send any security-related headers
r=glob,a=justdave
---

diff --git a/Bugzilla/WebService/Server/XMLRPC.pm b/Bugzilla/WebService/Server/XMLRPC.pm
index e8fb5de997..40cc6ec548 100644
--- a/Bugzilla/WebService/Server/XMLRPC.pm
+++ b/Bugzilla/WebService/Server/XMLRPC.pm
@@ -48,8 +48,16 @@ sub make_response {
 
     # XMLRPC::Transport::HTTP::CGI doesn't know about Bugzilla carrying around
     # its cookies in Bugzilla::CGI, so we need to copy them over.
-    foreach (@{Bugzilla->cgi->{'Bugzilla_cookie_list'}}) {
-        $self->response->headers->push_header('Set-Cookie', $_);
+    foreach my $cookie (@{Bugzilla->cgi->{'Bugzilla_cookie_list'}}) {
+        $self->response->headers->push_header('Set-Cookie', $cookie);
+    }
+
+    # Copy across security related headers from Bugzilla::CGI
+    foreach my $header (split(/[\r\n]+/, Bugzilla->cgi->header)) {
+        my ($name, $value) = $header =~ /^([^:]+): (.*)/;
+        if (!$self->response->headers->header($name)) {
+           $self->response->headers->header($name => $value);
+        }
     }
 }