From: Reed Loden <reed@reedloden.com>
Date: Sat, 18 Dec 2010 08:45:04 +0000 (-0800)
Subject: Bug 475894 - Send the 'X-Frame-Options: SAMEORIGIN' header to help protect against... 
X-Git-Tag: bugzilla-4.0rc2~36
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=905267ffc1af1a9f961bd58e32330a1ffdc7d899;p=thirdparty%2Fbugzilla.git

Bug 475894 - Send the 'X-Frame-Options: SAMEORIGIN' header to help protect against clickjacking.
[r=mkanat a=mkanat]
---

diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm
index c5cb0fa62e..bd948fc49a 100644
--- a/Bugzilla/CGI.pm
+++ b/Bugzilla/CGI.pm
@@ -299,6 +299,12 @@ sub header {
         unshift(@_, '-strict_transport_security' => $sts_opts);
     }
 
+    # Add X-Frame-Options header to prevent framing and subsequent
+    # possible clickjacking problems.
+    unless ($self->url_is_attachment_base) {
+        unshift(@_, '-x_frame_options' => 'SAMEORIGIN');
+    }
+
     return $self->SUPER::header(@_) || "";
 }