Fixed: OTRS does not protect against clickjacking (bug#10374).

Conflicts: CHANGES.md Kernel/Output/HTML/Standard/CustomerHeader.dtl Kernel/Output/HTML/Standard/CustomerHeaderSmall.dtl Kernel/Output/HTML/Standard/Header.dtl Kernel/Output/HTML/Standard/HeaderSmall.dtl Kernel/Output/HTML/Standard/Login.dtl Kernel/Output/HTML/Standard/PrintHeader.dtl Conflicts: CHANGES.md Kernel/Output/HTML/Standard/CustomerHeaderSmall.dtl Kernel/Output/HTML/Standard/Login.dtl
OTRS · Mar 18, 2014 · aa6a0a3 · aa6a0a3
1 parent 3b8409d
commit aa6a0a3
Show file tree

Hide file tree

Showing 7 changed files with 7 additions and 0 deletions.
diff --git a/CHANGES b/CHANGES
@@ -10,6 +10,7 @@
 # --
 
 3.1.21 2014-??-??
+ - 2014-03-18 Fixed bug#10374 - OTRS does not protect against clickjacking.
  - 2014-03-13 Fixed bug#10361 - Incorrect handling of special characters in DynamicFields.
  - 2014-02-27 Fixed bug#10309 - mails with an empty return-path header must not trigger auto responses in OTRS.
 

diff --git a/Kernel/Output/HTML/Layout.pm b/Kernel/Output/HTML/Layout.pm
@@ -2467,6 +2467,7 @@ sub Attachment {
         $Output .= "Pragma: no-cache\n";
     }
     $Output .= "Content-Length: $Param{Size}\n";
+    $Output .= "X-Frame-Options: SAMEORIGIN\n";
 
     if ( $Param{Charset} ) {
         $Output .= "Content-Type: $Param{ContentType}; charset=$Param{Charset};\n\n";

diff --git a/Kernel/Output/HTML/Standard/CustomerHeader.dtl b/Kernel/Output/HTML/Standard/CustomerHeader.dtl
@@ -12,6 +12,7 @@
 # http headers
 Content-Type: text/html; charset=$Env{"UserCharset"};
 X-Powered-By: $Config{"Product"} $Config{"Version"} - Open Ticket Request System (http://otrs.org/)
+X-Frame-Options: SAMEORIGIN
 Expires: Tue, 1 Jan 1980 12:00:00 GMT
 Cache-Control: no-cache
 Pragma: no-cache

diff --git a/Kernel/Output/HTML/Standard/Header.dtl b/Kernel/Output/HTML/Standard/Header.dtl
@@ -13,6 +13,7 @@
 Content-Type: text/html; charset=$Env{"UserCharset"};
 Content-Disposition: $Data{"ContentDisposition"}
 X-Powered-By: $Config{"Product"} $Config{"Version"} - Open Ticket Request System (http://otrs.org/)
+X-Frame-Options: SAMEORIGIN
 Expires: Tue, 1 Jan 1980 12:00:00 GMT
 Cache-Control: no-cache
 Pragma: no-cache

diff --git a/Kernel/Output/HTML/Standard/HeaderSmall.dtl b/Kernel/Output/HTML/Standard/HeaderSmall.dtl
@@ -12,6 +12,7 @@
 # http headers
 Content-Type: text/html; charset=$Env{"UserCharset"};
 X-Powered-By: $Config{"Product"} $Config{"Version"} - Open Ticket Request System (http://otrs.org/)
+X-Frame-Options: SAMEORIGIN
 Expires: Tue, 1 Jan 1980 12:00:00 GMT
 Cache-Control: no-cache
 Pragma: no-cache

diff --git a/Kernel/Output/HTML/Standard/Login.dtl b/Kernel/Output/HTML/Standard/Login.dtl
@@ -12,6 +12,7 @@
 # http headers
 Content-Type: text/html; charset=$Env{"UserCharset"};
 X-Powered-By: $Config{"Product"} $Config{"Version"} - Open Ticket Request System (http://otrs.org)
+X-Frame-Options: SAMEORIGIN
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

diff --git a/Kernel/Output/HTML/Standard/PrintHeader.dtl b/Kernel/Output/HTML/Standard/PrintHeader.dtl
@@ -14,6 +14,7 @@ Content-Type: text/html; charset=$Env{"UserCharset"};
 Content-Disposition: $Data{"ContentDisposition"}
 X-Powered-By: $Config{"Product"} $Config{"Version"} - Open Ticket Request System (http://otrs.org)
 Expires: Tue, 1 Jan 1980 12:00:00 GMT
+X-Frame-Options: SAMEORIGIN
 Cache-Control: no-cache
 Pragma: no-cache