From b6a1eff3e60edad44a0d7bed165eca3e4e0cef2e Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Sat, 26 Sep 2026 14:19:19 +0200
Subject: [PATCH] Stop other sites from framing the pages.

---
 session.lib.php                    |  4 ++++
 tests/php/Pages/FrontPagesTest.php | 13 +++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/session.lib.php b/session.lib.php
index 2311bd2..745e12c 100644
--- a/session.lib.php
+++ b/session.lib.php
@@ -5,6 +5,10 @@ require_once(__DIR__ . '/captcha.lib.php');
 
 $is_admin = FALSE;
 
+// No other site can show the pages in a frame, where a hidden page can take an editor's click
+header('X-Frame-Options: DENY');
+header("Content-Security-Policy: frame-ancestors 'none'");
+
 if (isset($_SERVER['HTTPS'])) {
   session_cache_limiter('private');
   session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
diff --git a/tests/php/Pages/FrontPagesTest.php b/tests/php/Pages/FrontPagesTest.php
index f7744ef..796d69f 100644
--- a/tests/php/Pages/FrontPagesTest.php
+++ b/tests/php/Pages/FrontPagesTest.php
@@ -36,6 +36,19 @@ class FrontPagesTest extends PageTestCase {
       $this->assertStringContainsString("; $flag", $cookie);
   }
 
+  // Another site cannot show a page in a hidden frame to trick an editor into a click
+  public function testNoPageCanBeFramed(): void {
+    $paths = array('/', '/article', '/about', '/publish', '/publish/login');
+    $this->loginAs();
+    $paths = array_merge($paths, array('/publish/edit', '/publish/addeditor'));
+    foreach ($paths as $path) {
+      $page = $this->get($path);
+      $this->assertSame('DENY', $this->header($page, 'X-Frame-Options'), $path);
+      $this->assertSame("frame-ancestors 'none'", $this->header($page, 'Content-Security-Policy'), $path);
+    }
+    $this->assertSame('DENY', $this->header($this->get('/', array('X-Test-Plain' => '1')), 'X-Frame-Options'));
+  }
+
   public function testPlainHttpStartsNoSession(): void {
     $page = $this->get('/', array('X-Test-Plain' => '1'));
     $this->assertSame(200, $page['status']);