Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-10 12:04:21 +08:00
Code Packages Activity Actions 1

FEATURE: Add CSP frame-ancestors support (#12404)

Browse source
This commit is contained in:
Rafael dos Santos Silva 2021-03-22 16:00:25 -03:00 • committed by GitHub
parent 706ea6692d
commit fb4486d5f1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 70 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/embed_controller.rb
View file

@ -12,7 +12,7 @@ class EmbedController < ApplicationController
layout 'embed'
rescue_from Discourse::InvalidAccess do
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
if current_user.try(:admin?)
@setup_url = "#{Discourse.base_url}/admin/customize/embedding"
@show_reason = true
@ -24,7 +24,7 @@ class EmbedController < ApplicationController
def topics
discourse_expires_in 1.minute
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
unless SiteSetting.embed_topics_list?
render 'embed_topics_error', status: 400
return
@ -157,7 +157,7 @@ class EmbedController < ApplicationController
end
end
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
rescue URI::Error
raise Discourse::InvalidAccess.new('invalid referer host')
end