mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Sort headers 

Signed-off-by: J0WI <J0WI@users.noreply.github.com>
This commit is contained in:
J0WI 2019-07-01 18:41:04 +02:00 committed by Roeland Jago Douma
parent 76cbd7db6e
commit 3f2932c75a
No known key found for this signature in database
GPG Key ID: F941078878347C0C
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
.htaccess
View File

@ -11,13 +11,13 @@
<IfModule mod_env.c> <IfModule mod_env.c>
# Add security and privacy related headers # Add security and privacy related headers
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Header set X-Robots-Tag "none"
Header set X-Download-Options "noopen"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set Referrer-Policy "no-referrer" Header set Referrer-Policy "no-referrer"
Header set X-Content-Type-Options "nosniff"
Header set X-Download-Options "noopen"
Header set X-Frame-Options "SAMEORIGIN" Header set X-Frame-Options "SAMEORIGIN"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set X-Robots-Tag "none"
Header set X-XSS-Protection "1; mode=block"
SetEnv modHeadersAvailable true SetEnv modHeadersAvailable true
</IfModule> </IfModule>

10
lib/private/legacy/response.php
View File

@ -98,13 +98,13 @@ class OC_Response {
// Send fallback headers for installations that don't have the possibility to send // Send fallback headers for installations that don't have the possibility to send
// custom headers on the webserver side // custom headers on the webserver side
if(getenv('modHeadersAvailable') !== 'true') { if(getenv('modHeadersAvailable') !== 'true') {
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/ header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
} }
} }