From 4d0dcd3c53a4c8c9944bc23d41de71593c3bd5d6 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Mon, 11 Jan 2016 21:20:42 +0100 Subject: Add X-Download-Options and X-Permitted-Cross-Domain-Policies Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders--- --- lib/private/response.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lib/private') diff --git a/lib/private/response.php b/lib/private/response.php index b0eb8adc4d5..44847466fa3 100644 --- a/lib/private/response.php +++ b/lib/private/response.php @@ -260,6 +260,8 @@ class OC_Response { header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag + header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx + header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html } } -- cgit v1.2.3