Merged #166 "Fix XRF vulnerability"

gitblit-org · Sep 5, 2014 · 30dc4e4 · 30dc4e4
2 parents fcfcd84 + 71647a6
commit 30dc4e4
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/main/java/com/gitblit/wicket/pages/BasePage.java b/src/main/java/com/gitblit/wicket/pages/BasePage.java
@@ -166,6 +166,9 @@ protected void setHeaders(WebResponse response)	{
 			// use default Wicket caching behavior
 			super.setHeaders(response);
 		}
+
+		// XRF vulnerability. issue-500 / ticket-166
+		response.setHeader("X-Frame-Options", "SAMEORIGIN");
 	}
 
 	/**