L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-28344 new option to prevent clickjacking via frame embedding

Browse Source
This commit is contained in:
Petr Skoda
2011-07-14 22:01:23 +02:00
parent b9b639b30e
commit 5c754932e7
3 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/settings/security.php
+1
View File
@@ -82,6 +82,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
$temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
$temp->add(new admin_setting_configcheckbox('cookiesecure', get_string('cookiesecure', 'admin'), get_string('configcookiesecure', 'admin'), 0));
$temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
$temp->add(new admin_setting_configcheckbox('allowframembedding', get_string('allowframembedding', 'admin'), get_string('allowframembedding_help', 'admin'), 0));
$ADMIN->add('security', $temp);
lang/en/admin.php
+2
View File
@@ -47,6 +47,8 @@ $string['allowcoursethemes'] = 'Allow course themes';
$string['allowdeletes'] = 'Allow deletes';
$string['allowediplist'] = 'Allowed IP list';
$string['allowemailaddresses'] = 'Allowed email domains';
$string['allowframembedding'] = 'Allow frame embedding';
$string['allowframembedding_help'] = 'Allow embedding of this site in frames on external sites. Enabling of this feature is not recommended for security reasons.';
$string['allowobjectembed'] = 'Allow EMBED and OBJECT tags';
$string['allowrenames'] = 'Allow renames';
$string['allowthemechangeonurl'] = 'Allow theme changes in the URL';
lib/weblib.php
+6
View File
@@ -1860,6 +1860,8 @@ function get_html_lang($dir = false) {
* @param $cacheable Can this page be cached on back?
*/
function send_headers($contenttype, $cacheable = true) {
global $CFG;
@header('Content-Type: ' . $contenttype);
@header('Content-Script-Type: text/javascript');
@header('Content-Style-Type: text/css');
@@ -1878,6 +1880,10 @@ function send_headers($contenttype, $cacheable = true) {
@header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
}
@header('Accept-Ranges: none');
if (empty($CFG->allowframembedding)) {
@header('X-Frame-Options: sameorigin');
}
}
/**