tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Stop other sites from framing the pages.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent ed6f98e0ac
commit b6a1eff3e6
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/FrontPagesTest.php
+13
View File
@@ -36,6 +36,19 @@ class FrontPagesTest extends PageTestCase {
$this->assertStringContainsString("; $flag", $cookie);
}
// Another site cannot show a page in a hidden frame to trick an editor into a click
public function testNoPageCanBeFramed(): void {
$paths = array('/', '/article', '/about', '/publish', '/publish/login');
$this->loginAs();
$paths = array_merge($paths, array('/publish/edit', '/publish/addeditor'));
foreach ($paths as $path) {
$page = $this->get($path);
$this->assertSame('DENY', $this->header($page, 'X-Frame-Options'), $path);
$this->assertSame("frame-ancestors 'none'", $this->header($page, 'Content-Security-Policy'), $path);
}
$this->assertSame('DENY', $this->header($this->get('/', array('X-Test-Plain' => '1')), 'X-Frame-Options'));
}
public function testPlainHttpStartsNoSession(): void {
$page = $this->get('/', array('X-Test-Plain' => '1'));
$this->assertSame(200, $page['status']);