Skip to content

Commit d8a544e

Browse files
lildudelildude
committed
Prevent admin pages from being displayed in iframes. Also a bit of coding standards tidying up.
Hopefully this does not break anything within Habari. All my testing indicates nothing breaks with this change. If something does, blame me and I will look into it.
1 parent 04cd07a commit d8a544e

File tree

1 file changed

+29
-23
lines changed

1 file changed

+29
-23
lines changed

‎admin/header.php‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
<?php if ( !defined( 'HABARI_PATH' ) ) { die('No direct access'); } ?>
1+
<?php if ( !defined( 'HABARI_PATH' ) ) { die( 'No direct access' ); }
2+
header( 'X-Frame-Options: DENY' );
3+
?>
24
<!doctype html>
35
<html>
46
<head>
@@ -7,26 +9,30 @@
79
<script type="text/javascript">
810
var habari = {
911
url: {
10-
habari: '<?php Site::out_url('habari'); ?>',
11-
ajaxDashboard: '<?php echo URL::get('admin_ajax', array('context' => 'dashboard')); ?>',
12-
ajaxUpdatePosts: '<?php echo URL::get('admin_ajax', array('context' => 'update_posts')); ?>',
13-
ajaxLogDelete: '<?php echo URL::get('admin_ajax', array('context' => 'delete_logs')); ?>',
14-
ajaxUpdateUsers: '<?php echo URL::get('admin_ajax', array('context' => 'update_users')); ?>',
15-
ajaxUpdateGroups: '<?php echo URL::get('admin_ajax', array('context' => 'update_groups')); ?>',
16-
ajaxUpdateComment: '<?php echo URL::get('admin_ajax', array('context' => 'update_comment')); ?>',
17-
ajaxAddBlock: '<?php echo URL::get('admin_ajax', array('context' => 'add_block')); ?>',
18-
ajaxDeleteBlock: '<?php echo URL::get('admin_ajax', array('context' => 'delete_block')); ?>',
19-
ajaxSaveAreas: '<?php echo URL::get('admin_ajax', array('context' => 'save_areas')); ?>'
12+
habari: '<?php Site::out_url( 'habari' ); ?>',
13+
ajaxDashboard: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'dashboard' ) ); ?>',
14+
ajaxUpdatePosts: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'update_posts' ) ); ?>',
15+
ajaxLogDelete: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'delete_logs' ) ); ?>',
16+
ajaxUpdateUsers: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'update_users' ) ); ?>',
17+
ajaxUpdateGroups: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'update_groups' ) ); ?>',
18+
ajaxUpdateComment: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'update_comment' ) ); ?>',
19+
ajaxAddBlock: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'add_block' ) ); ?>',
20+
ajaxDeleteBlock: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'delete_block' ) ); ?>',
21+
ajaxSaveAreas: '<?php echo URL::get( 'admin_ajax', array( 'context' => 'save_areas' ) ); ?>'
2022
}
2123
};
24+
// An almost "catch all" for those old browsers that don't support the X-Frame-Options header. We don't bust out, we just don't show any content
25+
if ( top != self ) {
26+
self.location.replace( 'about:blank' );
27+
}
2228
</script>
2329
<?php
2430
Plugins::act( 'admin_header', $this );
25-
Stack::out( 'admin_header_javascript', array('Stack', 'scripts') );
26-
Stack::out( 'admin_stylesheet', array('Stack', 'styles') );
31+
Stack::out( 'admin_header_javascript', array( 'Stack', 'scripts' ) );
32+
Stack::out( 'admin_stylesheet', array( 'Stack', 'styles' ) );
2733
?>
2834
<!--[if IE 7]>
29-
<link rel="stylesheet" type="text/css" href="<?php Site::out_url('admin_theme'); ?>/css/ie.css" media="screen">
35+
<link rel="stylesheet" type="text/css" href="<?php Site::out_url( 'admin_theme' ); ?>/css/ie.css" media="screen">
3036
<![endif]-->
3137

3238
<?php
@@ -43,15 +49,15 @@
4349

4450
<div id="menulist" class="dropbuttonlist">
4551
<ul>
46-
<?php foreach($mainmenu as $menu_id => $menu): ?>
47-
<li id="link-<?php echo $menu_id ?>" class="<?php if ($menu['selected'] == true) { echo 'selected'; } ?><?php if (isset($menu['submenu'])): ?> submenu<?php endif; ?>" title="<?php echo $menu['title']; ?>"><a class="top" href="<?php echo $menu['url']; ?>"><?php echo $menu['text']; ?>
48-
<?php if ( isset($menu['hotkey']) && $menu['hotkey'] != '' ): ?><span class="hotkey"><?php echo $menu['hotkey']; ?></span><?php endif; ?>
52+
<?php foreach ( $mainmenu as $menu_id => $menu ): ?>
53+
<li id="link-<?php echo $menu_id ?>" class="<?php if ( $menu['selected'] == true ) { echo 'selected'; } ?><?php if ( isset( $menu['submenu'] ) ): ?> submenu<?php endif; ?>" title="<?php echo $menu['title']; ?>"><a class="top" href="<?php echo $menu['url']; ?>"><?php echo $menu['text']; ?>
54+
<?php if ( isset( $menu['hotkey'] ) && $menu['hotkey'] != '' ): ?><span class="hotkey"><?php echo $menu['hotkey']; ?></span><?php endif; ?>
4955
</a>
50-
<?php if ( isset($menu['submenu']) ): ?>
56+
<?php if ( isset( $menu['submenu'] ) ): ?>
5157
<ul class="submenu">
52-
<?php foreach($menu['submenu'] as $submenu_id => $submenu_item): ?>
53-
<li id="link-<?php echo $submenu_id ?>" title="<?php echo $submenu_item['title']; ?>" class="sub<?php if (isset($submenu_item['hotkey']) && $submenu_item['hotkey'] != ''): ?> hotkey-<?php echo $submenu_item['hotkey']; ?><?php endif; ?>"><a href="<?php echo $submenu_item['url']; ?>"><?php echo $submenu_item['text']; ?>
54-
<?php if ( isset($submenu_item['hotkey']) && $submenu_item['hotkey'] != '' ): ?><span class="hotkey"><?php echo $submenu_item['hotkey']; ?></span><?php endif; ?>
58+
<?php foreach ( $menu['submenu'] as $submenu_id => $submenu_item ): ?>
59+
<li id="link-<?php echo $submenu_id ?>" title="<?php echo $submenu_item['title']; ?>" class="sub<?php if ( isset($submenu_item['hotkey'] ) && $submenu_item['hotkey'] != '' ): ?> hotkey-<?php echo $submenu_item['hotkey']; ?><?php endif; ?>"><a href="<?php echo $submenu_item['url']; ?>"><?php echo $submenu_item['text']; ?>
60+
<?php if ( isset( $submenu_item['hotkey'] ) && $submenu_item['hotkey'] != '' ): ?><span class="hotkey"><?php echo $submenu_item['hotkey']; ?></span><?php endif; ?>
5561
</a></li>
5662
<?php endforeach; ?>
5763
</ul>
@@ -62,12 +68,12 @@
6268
</div>
6369
</div>
6470

65-
<a href="<?php Site::out_url('habari'); ?>" id="site" title="<?php _e('Go to Site'); ?>"><?php Options::out('title'); ?></a>
71+
<a href="<?php Site::out_url( 'habari' ); ?>" id="site" title="<?php _e( 'Go to Site' ); ?>"><?php Options::out( 'title' ); ?></a>
6672

6773
</div>
6874

6975
<div id="spinner"></div>
7076

7177
<div id="page">
7278

73-
<?php Plugins::act('admin_info', $theme, $page); ?>
79+
<?php Plugins::act( 'admin_info', $theme, $page ); ?>

0 commit comments

Comments
 (0)