From: James Moger <james.moger@gitblit.com>
Date: Fri, 5 Sep 2014 19:32:04 +0000 (-0400)
Subject: Specify response header X-Frame-Options SAMEORIGIN for generated pages
X-Git-Tag: v1.6.1~47^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=71647a6587d4a1b365e382590e535a3915255cac;p=gitblit.git

Specify response header X-Frame-Options SAMEORIGIN for generated pages
---

diff --git a/src/main/java/com/gitblit/wicket/pages/BasePage.java b/src/main/java/com/gitblit/wicket/pages/BasePage.java
index 49710397..b454b7a8 100644
--- a/src/main/java/com/gitblit/wicket/pages/BasePage.java
+++ b/src/main/java/com/gitblit/wicket/pages/BasePage.java
@@ -166,6 +166,9 @@ public abstract class BasePage extends SessionPage {
 			// use default Wicket caching behavior
 			super.setHeaders(response);
 		}
+
+		// XRF vulnerability. issue-500 / ticket-166
+		response.setHeader("X-Frame-Options", "SAMEORIGIN");
 	}
 
 	/**