Dotclear

Changeset 2907:d5da0414c363


Ignore:
Timestamp:
01/06/15 19:38:51 (11 years ago)
Author:
Dsls
Branch:
2.7
Message:

added x-frame-options customizable for dcPage::open, fixes #2049

Files:
2 edited

Legend:

Unmodified
Added
Removed

  • admin/post.php

    r2858 r2907  
    411411               ($post_id ? $page_title_edit : $page_title) => '' 
    412412          )) 
     413     , array( 
     414          'x-frame-allow' => $core->blog->url 
     415     ) 
    413416); 
    414417 

  • inc/admin/lib.dc.page.php

    r2871 r2907  
    5454 
    5555     # Top of admin page 
    56      public static function open($title='',$head='',$breadcrumb='') 
     56     public static function open($title='',$head='',$breadcrumb='',$options=array()) 
    5757     { 
    5858          global $core; 
    … …  
    9191 
    9292          // Prevents Clickjacking as far as possible 
    93           header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+ 
    94  
     93          if (isset($options['x-frame-allow'])) { 
     94               $host = parse_url($options['x-frame-allow'], PHP_URL_HOST); 
     95               $scheme = parse_url($options['x-frame-allow'], PHP_URL_SCHEME); 
     96               header(sprintf('X-Frame-Options: %s', ($host !== null)?($scheme.'://'.$host):'SAMEORIGIN')); 
     97          } else { 
     98               header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+ 
     99          } 
    95100          echo 
    96101          '<!DOCTYPE html>'. 
Note: See TracChangeset for help on using the changeset viewer.

Sites map