diff options
Diffstat (limited to 'modules/context/context.go')
| -rw-r--r-- | modules/context/context.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/modules/context/context.go b/modules/context/context.go index 57a9195306..a77c1dc630 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -6,6 +6,7 @@ package context import ( "fmt" + "html" "html/template" "io" "net/http" @@ -186,8 +187,10 @@ func Contexter() macaron.Handler { } } - ctx.Data["CsrfToken"] = x.GetToken() - ctx.Data["CsrfTokenHtml"] = template.HTML(`<input type="hidden" name="_csrf" value="` + x.GetToken() + `">`) + ctx.Resp.Header().Set(`X-Frame-Options`, `SAMEORIGIN`) + + ctx.Data["CsrfToken"] = html.EscapeString(x.GetToken()) + ctx.Data["CsrfTokenHtml"] = template.HTML(`<input type="hidden" name="_csrf" value="` + ctx.Data["CsrfToken"].(string) + `">`) log.Debug("Session ID: %s", sess.ID()) log.Debug("CSRF Token: %v", ctx.Data["CsrfToken"]) |