github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 16:34:31 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: Add CSP frame-ancestors support (#12404)

Browse Source
This commit is contained in:
Rafael dos Santos Silva
2021-03-22 16:00:25 -03:00
committed by GitHub
parent 706ea6692d
commit fb4486d5f1
6 changed files with 70 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/controllers/embed_controller.rb
View File

@ -12,7 +12,7 @@ class EmbedController < ApplicationController
layout 'embed'
rescue_from Discourse::InvalidAccess do
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
if current_user.try(:admin?)
@setup_url = "#{Discourse.base_url}/admin/customize/embedding"
@show_reason = true
@ -24,7 +24,7 @@ class EmbedController < ApplicationController
def topics
discourse_expires_in 1.minute
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
unless SiteSetting.embed_topics_list?
render 'embed_topics_error', status: 400
return
@ -157,7 +157,7 @@ class EmbedController < ApplicationController
end
end
response.headers['X-Frame-Options'] = "ALLOWALL"
response.headers.delete('X-Frame-Options')
rescue URI::Error
raise Discourse::InvalidAccess.new('invalid referer host')
end