[Fixes #7813] X_FRAME_OPTIONS="ALLOW-FROM ALL" is not valid

GeoNode · Jul 16, 2021 · 1e3ce5d · 1e3ce5d
1 parent 6983533
commit 1e3ce5d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/.env b/.env
@@ -127,7 +127,7 @@ DEFAULT_FROM_EMAIL='GeoNode <no-reply@geonode.org>'
 # Session/Access Control
 LOCKDOWN_GEONODE=False
 CORS_ORIGIN_ALLOW_ALL=True
-X_FRAME_OPTIONS="ALLOW-FROM ALL"
+X_FRAME_OPTIONS="SAMEORIGIN"
 SESSION_EXPIRED_CONTROL_ENABLED=True
 DEFAULT_ANONYMOUS_VIEW_PERMISSION=True
 DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=True

diff --git a/.override_dev_env.sample b/.override_dev_env.sample
@@ -47,7 +47,7 @@ export DEFAULT_FROM_EMAIL="GeoNode <no-reply@geonode.org>"
 
 export LOCKDOWN_GEONODE=False
 export CORS_ORIGIN_ALLOW_ALL=True
-export X_FRAME_OPTIONS=ALLOW-FROM ALL
+export X_FRAME_OPTIONS=SAMEORIGIN
 export SESSION_EXPIRED_CONTROL_ENABLED=True
 export DEFAULT_ANONYMOUS_VIEW_PERMISSION=True
 export DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=True