OF-997 Deny framing to avoid clickjacking

2b6920ef · Dave Cridland · 1a3bf443 · 2b6920ef
Commit 2b6920ef authored Dec 10, 2015 by Dave Cridland
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

PluginServlet.java ...va/org/jivesoftware/openfire/container/PluginServlet.java +2 -0

No files found.
--- a/src/java/org/jivesoftware/openfire/container/PluginServlet.java
+++ b/src/java/org/jivesoftware/openfire/container/PluginServlet.java
@@ -114,6 +114,8 @@ public class PluginServlet extends HttpServlet {
                else {
                    handleOtherRequest(pathInfo, response);
                }
+                // Do not allow framing; OF-997
+                response.addHeader("X-Frame-Options", "deny");
            }
            catch (Exception e) {
                Log.error(e.getMessage(), e);