simon.suckut/Gitea
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Allow setting X-FRAME-OPTIONS (#16643)

Browse Source 
* Allow setting X-FRAME-OPTIONS

This PR provides a mechanism to set the X-FRAME-OPTIONS header.

Fix #7951

Signed-off-by: Andrew Thornton <[email protected]>

* Update docs/content/doc/advanced/config-cheat-sheet.en-us.md

Co-authored-by: John Olheiser <[email protected]>

Co-authored-by: John Olheiser <[email protected]>
This commit is contained in:
zeripath
2021-08-06 16:47:10 -04:00
committed by GitHub
co-authored by John Olheiser
parent 067d82b5a6
commit afd88a2418
7 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/context/api.go
+1 -1
View File
@@ -270,7 +270,7 @@ func APIContexter() func(http.Handler) http.Handler {
}
}
ctx.Resp.Header().Set(`X-Frame-Options`, `SAMEORIGIN`)
ctx.Resp.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
ctx.Data["CsrfToken"] = html.EscapeString(ctx.csrf.GetToken())
modules/context/context.go
+1 -1
View File
@@ -729,7 +729,7 @@ func Contexter() func(next http.Handler) http.Handler {
}
}
ctx.Resp.Header().Set(`X-Frame-Options`, `SAMEORIGIN`)
ctx.Resp.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
ctx.Data["CsrfToken"] = html.EscapeString(ctx.csrf.GetToken())
ctx.Data["CsrfTokenHtml"] = template.HTML(`<input type="hidden" name="_csrf" value="` + ctx.Data["CsrfToken"].(string) + `">`)