Let users configure security headers in their Webserver

Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.

1 files changed, 0 insertions, 19 deletions

diff --git a/config/config.sample.php b/config/config.sample.php
index 1b3477417ff..16575cf82ed 100644
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -745,18 +745,6 @@ $CONFIG = array(
  */
 
 /**
- * Change this to ``true`` to require HTTPS for all connections, and to reject
- * HTTP requests.
- */
-'forcessl' => false,
-
-/**
- * Change this to ``true`` to require HTTPS connections also for all subdomains.
- * Works only together when `forcessl` is set to true.
- */
-'forceSSLforSubdomains' => false,
-
-/**
  * Extra SSL options to be used for configuration.
  */
 'openssl' => array(
@@ -787,13 +775,6 @@ $CONFIG = array(
 'theme' => '',
 
 /**
- * X-Frame-Restriction is a header which prevents browsers from showing the site
- * inside an iframe. This is be used to prevent clickjacking. It is risky to
- * disable this, so leave it set at ``true``.
- */
-'xframe_restriction' => true,
-
-/**
  * The default cipher for encrypting files. Currently AES-128-CFB and
  * AES-256-CFB are supported.
  */