Stop other sites from framing the pages.

session.lib.php

@@ -5,6 +5,10 @@ require_once(__DIR__ . '/captcha.lib.php');
 
 $is_admin = FALSE;
 
+// No other site can show the pages in a frame, where a hidden page can take an editor's click
+header('X-Frame-Options: DENY');
+header("Content-Security-Policy: frame-ancestors 'none'");
+
 if (isset($_SERVER['HTTPS'])) {
   session_cache_limiter('private');
   session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));

tests/php/Pages/FrontPagesTest.php

@@ -36,6 +36,19 @@ class FrontPagesTest extends PageTestCase {
       $this->assertStringContainsString("; $flag", $cookie);
   }
 
+  // Another site cannot show a page in a hidden frame to trick an editor into a click
+  public function testNoPageCanBeFramed(): void {
+    $paths = array('/', '/article', '/about', '/publish', '/publish/login');
+    $this->loginAs();
+    $paths = array_merge($paths, array('/publish/edit', '/publish/addeditor'));
+    foreach ($paths as $path) {
+      $page = $this->get($path);
+      $this->assertSame('DENY', $this->header($page, 'X-Frame-Options'), $path);
+      $this->assertSame("frame-ancestors 'none'", $this->header($page, 'Content-Security-Policy'), $path);
+    }
+    $this->assertSame('DENY', $this->header($this->get('/', array('X-Test-Plain' => '1')), 'X-Frame-Options'));
+  }
+
   public function testPlainHttpStartsNoSession(): void {
     $page = $this->get('/', array('X-Test-Plain' => '1'));
     $this->assertSame(200, $page['status']);