Fixed #6346 -- Set xframe options exempt on cached response (#6403)

AUTHORS

@@ -316,6 +316,7 @@ Contributors (based on gitlog, 497 unique authors):
 * martinkosir
 * Matas Dailyda
 * Mateusz Dereniowski
+* Mateusz Kamycki
 * Mateusz Marzantowicz
 * mathijs
 * Matt Chisholm

cms/tests/test_page.py

@@ -1015,6 +1015,40 @@ def test_top_level_page_inherited_xframe_options_are_applied(self):
             resp = self.client.get(page.get_absolute_url('en'))
             self.assertEqual(resp.get('X-Frame-Options'), 'SAMEORIGIN')
 
+    def test_xframe_options_with_cms_page_cache_and_clickjacking_middleware(self):
+        # Refs: 6346
+        if getattr(settings, 'MIDDLEWARE', None):
+            override = {
+                'MIDDLEWARE': settings.MIDDLEWARE + [
+                    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+                ]
+            }
+        else:
+            override = {
+                'MIDDLEWARE_CLASSES': settings.MIDDLEWARE_CLASSES + [
+                    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+                ]
+            }
+
+        override['CMS_PAGE_CACHE'] = True
+
+        with self.settings(**override):
+            page = create_page(
+                'test page 1',
+                'nav_playground.html',
+                'en',
+                published=True,
+                xframe_options=Page.X_FRAME_OPTIONS_ALLOW,
+            )
+
+            # Normal response from render_page
+            resp = self.client.get(page.get_absolute_url('en'))
+            self.assertEqual(resp.get('X-Frame-Options'), None)
+
+            # Response from page cache
+            resp = self.client.get(page.get_absolute_url('en'))
+            self.assertEqual(resp.get('X-Frame-Options'), None)
+
     def test_page_used_on_request(self):
         """
         The rendered page changes depending on request and

cms/views.py

@@ -52,6 +52,7 @@ def details(request, slug):
         if cache_content is not None:
             content, headers, expires_datetime = cache_content
             response = HttpResponse(content)
+            response.xframe_options_exempt = True
             response._headers = headers
             # Recalculate the max-age header for this cached response
             max_age = int(