Specify response header X-Frame-Options SAMEORIGIN for generated pages

gitblit-org · Sep 5, 2014 · 71647a6 · 71647a6
1 parent fcfcd84
commit 71647a6
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/main/java/com/gitblit/wicket/pages/BasePage.java b/src/main/java/com/gitblit/wicket/pages/BasePage.java
@@ -166,6 +166,9 @@ protected void setHeaders(WebResponse response)	{
 			// use default Wicket caching behavior
 			super.setHeaders(response);
 		}
+
+		// XRF vulnerability. issue-500 / ticket-166
+		response.setHeader("X-Frame-Options", "SAMEORIGIN");
 	}
 
 	/**