diff options
| author | coderkun <olli@coderkun.de> | 2017-05-13 20:54:08 +0200 |
|---|---|---|
| committer | coderkun <olli@coderkun.de> | 2017-05-14 13:16:36 +0200 |
| commit | b44c3dd198317c4685f43a957907b5894269f396 (patch) | |
| tree | 08a26a608ef9572ee8292957a8e96048975ebf7b /core/js | |
| parent | 6e3a914f4affde68c5cafa8fc7703efa3c3deaa6 (diff) | |
| download | nextcloud-server-b44c3dd198317c4685f43a957907b5894269f396.tar.gz nextcloud-server-b44c3dd198317c4685f43a957907b5894269f396.zip | |
Improve warning for X-Frame-Options header DENY (#3808)
Signed-off-by: Oliver Hanraths <olli@coderkun.de>
Diffstat (limited to 'core/js')
| -rw-r--r-- | core/js/setupchecks.js | 22 |
1 files changed, 13 insertions, 9 deletions
diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js index 499709c0696..d9bedfff302 100644 --- a/core/js/setupchecks.js +++ b/core/js/setupchecks.js @@ -248,18 +248,22 @@ if (xhr.status === 200) { var securityHeaders = { - 'X-XSS-Protection': '1; mode=block', - 'X-Content-Type-Options': 'nosniff', - 'X-Robots-Tag': 'none', - 'X-Frame-Options': 'SAMEORIGIN', - 'X-Download-Options': 'noopen', - 'X-Permitted-Cross-Domain-Policies': 'none', + 'X-XSS-Protection': ['1; mode=block'], + 'X-Content-Type-Options': ['nosniff'], + 'X-Robots-Tag': ['none'], + 'X-Frame-Options': ['SAMEORIGIN', 'DENY'], + 'X-Download-Options': ['noopen'], + 'X-Permitted-Cross-Domain-Policies': ['none'], }; - for (var header in securityHeaders) { - if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== securityHeaders[header].toLowerCase()) { + var option = securityHeaders[header][0]; + if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== option.toLowerCase()) { + var msg = t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header, expected: option}); + if(xhr.getResponseHeader(header) && securityHeaders[header].length > 1 && xhr.getResponseHeader(header).toLowerCase() === securityHeaders[header][1].toLowerCase()) { + msg = t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". Some features might not work correctly and we recommend adjusting this setting.', {header: header, expected: option}); + } messages.push({ - msg: t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header, expected: securityHeaders[header]}), + msg: msg, type: OC.SetupChecks.MESSAGE_TYPE_WARNING }); } |