Merge pull request #16179 from J0WI/mv-frameoptions
Add X-Frame-Options header to .htaccess
This commit is contained in:
commit
9d6eb2daf7
13
.htaccess
13
.htaccess
|
@ -11,12 +11,13 @@
|
||||||
|
|
||||||
<IfModule mod_env.c>
|
<IfModule mod_env.c>
|
||||||
# Add security and privacy related headers
|
# Add security and privacy related headers
|
||||||
Header set X-Content-Type-Options "nosniff"
|
Header always set Referrer-Policy "no-referrer"
|
||||||
Header set X-XSS-Protection "1; mode=block"
|
Header always set X-Content-Type-Options "nosniff"
|
||||||
Header set X-Robots-Tag "none"
|
Header always set X-Download-Options "noopen"
|
||||||
Header set X-Download-Options "noopen"
|
Header always set X-Frame-Options "SAMEORIGIN"
|
||||||
Header set X-Permitted-Cross-Domain-Policies "none"
|
Header always set X-Permitted-Cross-Domain-Policies "none"
|
||||||
Header set Referrer-Policy "no-referrer"
|
Header always set X-Robots-Tag "none"
|
||||||
|
Header always set X-XSS-Protection "1; mode=block"
|
||||||
SetEnv modHeadersAvailable true
|
SetEnv modHeadersAvailable true
|
||||||
</IfModule>
|
</IfModule>
|
||||||
|
|
||||||
|
|
|
@ -94,17 +94,17 @@ class OC_Response {
|
||||||
. 'object-src \'none\'; '
|
. 'object-src \'none\'; '
|
||||||
. 'base-uri \'self\'; ';
|
. 'base-uri \'self\'; ';
|
||||||
header('Content-Security-Policy:' . $policy);
|
header('Content-Security-Policy:' . $policy);
|
||||||
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
|
|
||||||
|
|
||||||
// Send fallback headers for installations that don't have the possibility to send
|
// Send fallback headers for installations that don't have the possibility to send
|
||||||
// custom headers on the webserver side
|
// custom headers on the webserver side
|
||||||
if(getenv('modHeadersAvailable') !== 'true') {
|
if(getenv('modHeadersAvailable') !== 'true') {
|
||||||
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
|
|
||||||
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
|
|
||||||
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
|
|
||||||
header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
|
|
||||||
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
|
|
||||||
header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/
|
header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/
|
||||||
|
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
|
||||||
|
header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
|
||||||
|
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
|
||||||
|
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
|
||||||
|
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
|
||||||
|
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue