Stop other sites from framing the pages.

2026-09-26 15:27:51 +02:00
parent ed6f98e0ac
commit b6a1eff3e6
2 changed files with 17 additions and 0 deletions
@@ -5,6 +5,10 @@ require_once(__DIR__ . '/captcha.lib.php');

 $is_admin = FALSE;

+// No other site can show the pages in a frame, where a hidden page can take an editor's click
+header('X-Frame-Options: DENY');
+header("Content-Security-Policy: frame-ancestors 'none'");
+
 if (isset($_SERVER['HTTPS'])) {
  session_cache_limiter('private');
  session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));