mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix casing of same origin frame option 

Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2017-04-12 12:37:32 +02:00
parent af42ca2025
commit bd37021587
No known key found for this signature in database
GPG Key ID: E166FD8976B3BAC8
4 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
build/integration/features/carddav.feature
View File

@ -45,7 +45,7 @@ Feature: carddav
|Content-Security-Policy|default-src 'none';| |Content-Security-Policy|default-src 'none';|
|X-Content-Type-Options |nosniff| |X-Content-Type-Options |nosniff|
|X-Download-Options|noopen| |X-Download-Options|noopen|
|X-Frame-Options|Sameorigin| |X-Frame-Options|SAMEORIGIN|
|X-Permitted-Cross-Domain-Policies|none| |X-Permitted-Cross-Domain-Policies|none|
|X-Robots-Tag|none| |X-Robots-Tag|none|
|X-XSS-Protection|1; mode=block| |X-XSS-Protection|1; mode=block|
@ -60,7 +60,7 @@ Feature: carddav
|Content-Security-Policy|default-src 'none';| |Content-Security-Policy|default-src 'none';|
|X-Content-Type-Options |nosniff| |X-Content-Type-Options |nosniff|
|X-Download-Options|noopen| |X-Download-Options|noopen|
|X-Frame-Options|Sameorigin| |X-Frame-Options|SAMEORIGIN|
|X-Permitted-Cross-Domain-Policies|none| |X-Permitted-Cross-Domain-Policies|none|
|X-Robots-Tag|none| |X-Robots-Tag|none|
|X-XSS-Protection|1; mode=block| |X-XSS-Protection|1; mode=block|

2
build/integration/features/dav-v2.feature
View File

@ -26,7 +26,7 @@ Feature: dav-v2
|Content-Security-Policy|default-src 'none';| |Content-Security-Policy|default-src 'none';|
|X-Content-Type-Options |nosniff| |X-Content-Type-Options |nosniff|
|X-Download-Options|noopen| |X-Download-Options|noopen|
|X-Frame-Options|Sameorigin| |X-Frame-Options|SAMEORIGIN|
|X-Permitted-Cross-Domain-Policies|none| |X-Permitted-Cross-Domain-Policies|none|
|X-Robots-Tag|none| |X-Robots-Tag|none|
|X-XSS-Protection|1; mode=block| |X-XSS-Protection|1; mode=block|

2
build/integration/features/webdav-related.feature
View File

@ -243,7 +243,7 @@ Feature: webdav-related
|Content-Security-Policy|default-src 'none';| |Content-Security-Policy|default-src 'none';|
|X-Content-Type-Options |nosniff| |X-Content-Type-Options |nosniff|
|X-Download-Options|noopen| |X-Download-Options|noopen|
|X-Frame-Options|Sameorigin| |X-Frame-Options|SAMEORIGIN|
|X-Permitted-Cross-Domain-Policies|none| |X-Permitted-Cross-Domain-Policies|none|
|X-Robots-Tag|none| |X-Robots-Tag|none|
|X-XSS-Protection|1; mode=block| |X-XSS-Protection|1; mode=block|

2
lib/private/legacy/response.php
View File

@ -257,7 +257,7 @@ class OC_Response {
. 'object-src \'none\'; ' . 'object-src \'none\'; '
. 'base-uri \'self\'; '; . 'base-uri \'self\'; ';
header('Content-Security-Policy:' . $policy); header('Content-Security-Policy:' . $policy);
header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
// Send fallback headers for installations that don't have the possibility to send // Send fallback headers for installations that don't have the possibility to send
// custom headers on the webserver side // custom headers on the webserver side