Index: inc/admin/lib.dc.page.php
===================================================================
--- inc/admin/lib.dc.page.php	(revision 2908)
+++ inc/admin/lib.dc.page.php	(revision 2911)
@@ -17,9 +17,10 @@
 {
 	private static $loaded_js = array();
+	private static $xframe_loaded = false;
 	private static $N_TYPES = array(
-		"success" => "success",
-		"warning" => "warning-msg",
-		"error" => "error",
-		"message" => "message",
+		"success" => "success", 
+		"warning" => "warning-msg", 
+		"error" => "error", 
+		"message" => "message", 
 		"static" => "static-msg");
 
@@ -92,8 +93,7 @@
 		// Prevents Clickjacking as far as possible
 		if (isset($options['x-frame-allow'])) {
-			$url = parse_url($options['x-frame-allow']);
-			header(sprintf('X-Frame-Options: %s', is_array($url)?($url['scheme'].'://'.$url['host']):'SAMEORIGIN'));
+			self::setXFrameOptions($options['x-frame-allow']);
 		} else {
-			header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+
+			self::setXFrameOptions();
 		}
 		echo
@@ -109,8 +109,8 @@
 
 		self::jsLoadIE7().
-		'  <link rel="stylesheet" href="style/default.css" type="text/css" media="screen" />'."\n";
+		'  	<link rel="stylesheet" href="style/default.css" type="text/css" media="screen" />'."\n";
 		if (l10n::getTextDirection($GLOBALS['_lang']) == 'rtl') {
 			echo
-			'  <link rel="stylesheet" href="style/default-rtl.css" type="text/css" media="screen" />'."\n";
+			'  	<link rel="stylesheet" href="style/default-rtl.css" type="text/css" media="screen" />'."\n";
 		}
 
@@ -118,8 +118,9 @@
 		$user_ui_hide_std_favicon = $core->auth->user_prefs->interface->hide_std_favicon;
 		if (!$user_ui_hide_std_favicon) {
-			echo
+			echo 
 			'<link rel="icon" type="image/png" href="images/favicon96-login.png" />'.
 			'<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon" />';
 		}
+
 		echo
 		self::jsCommon().
@@ -217,5 +218,5 @@
 			$notifications = array();
 		}
-
+		
 		$n = array_merge($options,array('class' => $class,'ts' => time(), 'text' => $message));
 		if ($type != "static") {
@@ -339,8 +340,8 @@
 
 		self::jsLoadIE7().
-		'	<link rel="stylesheet" href="style/default.css" type="text/css" media="screen" />'."\n";
+		'  	<link rel="stylesheet" href="style/default.css" type="text/css" media="screen" />'."\n";
 		if (l10n::getTextDirection($GLOBALS['_lang']) == 'rtl') {
 			echo
-			'	<link rel="stylesheet" href="style/default-rtl.css" type="text/css" media="screen" />'."\n";
+			'  	<link rel="stylesheet" href="style/default-rtl.css" type="text/css" media="screen" />'."\n";
 		}
 
@@ -580,5 +581,5 @@
 				"</script>\n";
 	}
-
+	
 	public static function jsCommon()
 	{
@@ -606,4 +607,5 @@
 		'jsToolBar = {}, jsToolBar.prototype = { elements : {} };'."\n".
 		self::jsVar('dotclear.nonce',$GLOBALS['core']->getNonce()).
+
 		self::jsVar('dotclear.img_plus_src','images/expand.png').
 		self::jsVar('dotclear.img_plus_alt',__('uncover')).
@@ -725,5 +727,5 @@
 		self::jsVar('dotclear.msg.module_tags',
 			__('Tags:')).
-			"\n//]]>\n".
+		"\n//]]>\n".
 		"</script>\n";
 	}
@@ -787,63 +789,63 @@
 	public static function jsModal()
 	{
-		return
-		'<link rel="stylesheet" type="text/css" href="style/modal/modal.css" />'."\n".
-		self::jsLoad('js/jquery/jquery.modal.js').
-		'<script type="text/javascript">'."\n".
-		"//<![CDATA[\n".
-		self::jsVar('$.modal.prototype.params.loader_img','style/modal/loader.gif').
-		self::jsVar('$.modal.prototype.params.close_img','style/modal/close.png').
-		"\n//]]>\n".
-		"</script>\n";
+	return
+	'<link rel="stylesheet" type="text/css" href="style/modal/modal.css" />'."\n".
+	self::jsLoad('js/jquery/jquery.modal.js').
+	'<script type="text/javascript">'."\n".
+	"//<![CDATA[\n".
+	self::jsVar('$.modal.prototype.params.loader_img','style/modal/loader.gif').
+	self::jsVar('$.modal.prototype.params.close_img','style/modal/close.png').
+	"\n//]]>\n".
+	"</script>\n";
 	}
 
 	public static function jsColorPicker()
 	{
-		return
-		'<link rel="stylesheet" type="text/css" href="style/farbtastic/farbtastic.css" />'."\n".
-		self::jsLoad('js/jquery/jquery.farbtastic.js').
-		self::jsLoad('js/color-picker.js');
+	return
+	'<link rel="stylesheet" type="text/css" href="style/farbtastic/farbtastic.css" />'."\n".
+	self::jsLoad('js/jquery/jquery.farbtastic.js').
+	self::jsLoad('js/color-picker.js');
 	}
 
 	public static function jsDatePicker()
 	{
-		return
-		'<link rel="stylesheet" type="text/css" href="style/date-picker.css" />'."\n".
-		self::jsLoad('js/date-picker.js').
-		'<script type="text/javascript">'."\n".
-		"//<![CDATA[\n".
-
-		"datePicker.prototype.months[0] = '".html::escapeJS(__('January'))."'; ".
-		"datePicker.prototype.months[1] = '".html::escapeJS(__('February'))."'; ".
-		"datePicker.prototype.months[2] = '".html::escapeJS(__('March'))."'; ".
-		"datePicker.prototype.months[3] = '".html::escapeJS(__('April'))."'; ".
-		"datePicker.prototype.months[4] = '".html::escapeJS(__('May'))."'; ".
-		"datePicker.prototype.months[5] = '".html::escapeJS(__('June'))."'; ".
-		"datePicker.prototype.months[6] = '".html::escapeJS(__('July'))."'; ".
-		"datePicker.prototype.months[7] = '".html::escapeJS(__('August'))."'; ".
-		"datePicker.prototype.months[8] = '".html::escapeJS(__('September'))."'; ".
-		"datePicker.prototype.months[9] = '".html::escapeJS(__('October'))."'; ".
-		"datePicker.prototype.months[10] = '".html::escapeJS(__('November'))."'; ".
-		"datePicker.prototype.months[11] = '".html::escapeJS(__('December'))."'; ".
-
-		"datePicker.prototype.days[0] = '".html::escapeJS(__('Monday'))."'; ".
-		"datePicker.prototype.days[1] = '".html::escapeJS(__('Tuesday'))."'; ".
-		"datePicker.prototype.days[2] = '".html::escapeJS(__('Wednesday'))."'; ".
-		"datePicker.prototype.days[3] = '".html::escapeJS(__('Thursday'))."'; ".
-		"datePicker.prototype.days[4] = '".html::escapeJS(__('Friday'))."'; ".
-		"datePicker.prototype.days[5] = '".html::escapeJS(__('Saturday'))."'; ".
-		"datePicker.prototype.days[6] = '".html::escapeJS(__('Sunday'))."'; ".
-
-		"datePicker.prototype.img_src = 'images/date-picker.png'; ".
+	return
+	'<link rel="stylesheet" type="text/css" href="style/date-picker.css" />'."\n".
+	self::jsLoad('js/date-picker.js').
+	'<script type="text/javascript">'."\n".
+	"//<![CDATA[\n".
+
+	"datePicker.prototype.months[0] = '".html::escapeJS(__('January'))."'; ".
+	"datePicker.prototype.months[1] = '".html::escapeJS(__('February'))."'; ".
+	"datePicker.prototype.months[2] = '".html::escapeJS(__('March'))."'; ".
+	"datePicker.prototype.months[3] = '".html::escapeJS(__('April'))."'; ".
+	"datePicker.prototype.months[4] = '".html::escapeJS(__('May'))."'; ".
+	"datePicker.prototype.months[5] = '".html::escapeJS(__('June'))."'; ".
+	"datePicker.prototype.months[6] = '".html::escapeJS(__('July'))."'; ".
+	"datePicker.prototype.months[7] = '".html::escapeJS(__('August'))."'; ".
+	"datePicker.prototype.months[8] = '".html::escapeJS(__('September'))."'; ".
+	"datePicker.prototype.months[9] = '".html::escapeJS(__('October'))."'; ".
+	"datePicker.prototype.months[10] = '".html::escapeJS(__('November'))."'; ".
+	"datePicker.prototype.months[11] = '".html::escapeJS(__('December'))."'; ".
+
+	"datePicker.prototype.days[0] = '".html::escapeJS(__('Monday'))."'; ".
+	"datePicker.prototype.days[1] = '".html::escapeJS(__('Tuesday'))."'; ".
+	"datePicker.prototype.days[2] = '".html::escapeJS(__('Wednesday'))."'; ".
+	"datePicker.prototype.days[3] = '".html::escapeJS(__('Thursday'))."'; ".
+	"datePicker.prototype.days[4] = '".html::escapeJS(__('Friday'))."'; ".
+	"datePicker.prototype.days[5] = '".html::escapeJS(__('Saturday'))."'; ".
+	"datePicker.prototype.days[6] = '".html::escapeJS(__('Sunday'))."'; ".
+
+	"datePicker.prototype.img_src = 'images/date-picker.png'; ".
 		"datePicker.prototype.img_alt = '".html::escapeJS(__('Choose date'))."'; ".
 
-		"datePicker.prototype.close_msg = '".html::escapeJS(__('close'))."'; ".
-		"datePicker.prototype.now_msg = '".html::escapeJS(__('now'))."'; ".
-
-		"\n//]]>\n".
-		"</script>\n";
-	}
-
-
+	"datePicker.prototype.close_msg = '".html::escapeJS(__('close'))."'; ".
+	"datePicker.prototype.now_msg = '".html::escapeJS(__('now'))."'; ".
+
+	"\n//]]>\n".
+	"</script>\n";
+	}
+
+	
 	public static function jsToolBar()
 	{
@@ -853,39 +855,39 @@
 	public static function jsUpload($params=array(),$base_url=null)
 	{
-		if (!$base_url) {
-			$base_url = path::clean(dirname(preg_replace('/(\?.*$)?/','',$_SERVER['REQUEST_URI']))).'/';
-		}
-
-		$params = array_merge($params,array(
-			'sess_id='.session_id(),
-			'sess_uid='.$_SESSION['sess_browser_uid'],
-			'xd_check='.$GLOBALS['core']->getNonce()
+	if (!$base_url) {
+		$base_url = path::clean(dirname(preg_replace('/(\?.*$)?/','',$_SERVER['REQUEST_URI']))).'/';
+	}
+
+	$params = array_merge($params,array(
+		'sess_id='.session_id(),
+		'sess_uid='.$_SESSION['sess_browser_uid'],
+		'xd_check='.$GLOBALS['core']->getNonce()
 		));
 
-		return
-		'<script type="text/javascript">'."\n".
-		"//<![CDATA[\n".
-		"dotclear.jsUpload = {};\n".
-		"dotclear.jsUpload.msg = {};\n".
-		self::jsVar('dotclear.msg.enhanced_uploader_activate',__('Temporarily activate enhanced uploader')).
-		self::jsVar('dotclear.msg.enhanced_uploader_disable',__('Temporarily disable enhanced uploader')).
-		self::jsVar('dotclear.jsUpload.msg.limit_exceeded',__('Limit exceeded.')).
-		self::jsVar('dotclear.jsUpload.msg.size_limit_exceeded',__('File size exceeds allowed limit.')).
-		self::jsVar('dotclear.jsUpload.msg.canceled',__('Canceled.')).
-		self::jsVar('dotclear.jsUpload.msg.http_error',__('HTTP Error:')).
-		self::jsVar('dotclear.jsUpload.msg.error',__('Error:')).
-		self::jsVar('dotclear.jsUpload.msg.choose_file',__('Choose file')).
-		self::jsVar('dotclear.jsUpload.msg.choose_files',__('Choose files')).
-		self::jsVar('dotclear.jsUpload.msg.cancel',__('Cancel')).
-		self::jsVar('dotclear.jsUpload.msg.clean',__('Clean')).
-		self::jsVar('dotclear.jsUpload.msg.upload',__('Upload')).
+	return
+	'<script type="text/javascript">'."\n".
+	"//<![CDATA[\n".
+	"dotclear.jsUpload = {};\n".
+	"dotclear.jsUpload.msg = {};\n".
+	self::jsVar('dotclear.msg.enhanced_uploader_activate',__('Temporarily activate enhanced uploader')).
+	self::jsVar('dotclear.msg.enhanced_uploader_disable',__('Temporarily disable enhanced uploader')).
+	self::jsVar('dotclear.jsUpload.msg.limit_exceeded',__('Limit exceeded.')).
+	self::jsVar('dotclear.jsUpload.msg.size_limit_exceeded',__('File size exceeds allowed limit.')).
+	self::jsVar('dotclear.jsUpload.msg.canceled',__('Canceled.')).
+	self::jsVar('dotclear.jsUpload.msg.http_error',__('HTTP Error:')).
+	self::jsVar('dotclear.jsUpload.msg.error',__('Error:')).
+	self::jsVar('dotclear.jsUpload.msg.choose_file',__('Choose file')).
+	self::jsVar('dotclear.jsUpload.msg.choose_files',__('Choose files')).
+	self::jsVar('dotclear.jsUpload.msg.cancel',__('Cancel')).
+	self::jsVar('dotclear.jsUpload.msg.clean',__('Clean')).
+	self::jsVar('dotclear.jsUpload.msg.upload',__('Upload')).
 		self::jsVar('dotclear.jsUpload.msg.send',__('Send')).
 		self::jsVar('dotclear.jsUpload.msg.file_successfully_uploaded',__('File successfully uploaded.')).
-		self::jsVar('dotclear.jsUpload.msg.no_file_in_queue',__('No file in queue.')).
-		self::jsVar('dotclear.jsUpload.msg.file_in_queue',__('1 file in queue.')).
-		self::jsVar('dotclear.jsUpload.msg.files_in_queue',__('%d files in queue.')).
-		self::jsVar('dotclear.jsUpload.msg.queue_error',__('Queue error:')).
-		self::jsVar('dotclear.jsUpload.base_url',$base_url).
-		"\n//]]>\n".
+	self::jsVar('dotclear.jsUpload.msg.no_file_in_queue',__('No file in queue.')).
+	self::jsVar('dotclear.jsUpload.msg.file_in_queue',__('1 file in queue.')).
+	self::jsVar('dotclear.jsUpload.msg.files_in_queue',__('%d files in queue.')).
+	self::jsVar('dotclear.jsUpload.msg.queue_error',__('Queue error:')).
+	self::jsVar('dotclear.jsUpload.base_url',$base_url).
+	"\n//]]>\n".
 		"</script>\n".
 
@@ -904,18 +906,18 @@
 	public static function jsToolMan()
 	{
-		return
-		'<script type="text/javascript" src="js/tool-man/core.js"></script>'.
-		'<script type="text/javascript" src="js/tool-man/events.js"></script>'.
-		'<script type="text/javascript" src="js/tool-man/css.js"></script>'.
-		'<script type="text/javascript" src="js/tool-man/coordinates.js"></script>'.
-		'<script type="text/javascript" src="js/tool-man/drag.js"></script>'.
-		'<script type="text/javascript" src="js/tool-man/dragsort.js"></script>'.
-		'<script type="text/javascript" src="js/dragsort-tablerows.js"></script>';
+	return
+	'<script type="text/javascript" src="js/tool-man/core.js"></script>'.
+	'<script type="text/javascript" src="js/tool-man/events.js"></script>'.
+	'<script type="text/javascript" src="js/tool-man/css.js"></script>'.
+	'<script type="text/javascript" src="js/tool-man/coordinates.js"></script>'.
+	'<script type="text/javascript" src="js/tool-man/drag.js"></script>'.
+	'<script type="text/javascript" src="js/tool-man/dragsort.js"></script>'.
+	'<script type="text/javascript" src="js/dragsort-tablerows.js"></script>';
 	}
 
 	public static function jsMetaEditor()
 	{
-		return
-		'<script type="text/javascript" src="js/meta-editor.js"></script>';
+	return
+	'<script type="text/javascript" src="js/meta-editor.js"></script>';
 	}
 
@@ -923,3 +925,17 @@
 		return $GLOBALS['core']->adminurl->get('load.plugin.file',array('pf' => $file));
 	}
+
+	public static function setXFrameOptions($origin=null) {
+		if (self::$xframe_loaded) {
+			return;
+		}
+		if ($origin !== null) {
+			$url = parse_url($origin);
+			header(sprintf('X-Frame-Options: %s', is_array($url)?($url['scheme'].'://'.$url['host']):'SAMEORIGIN'));
+		} else {
+			header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+
+		}
+		self::$xframe_loaded = true;
+
+	}
 }
