From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/lib/Roundcube/rcube_output.php | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/program/lib/Roundcube/rcube_output.php b/program/lib/Roundcube/rcube_output.php
index 55a38b2..03ff4c1 100644
--- a/program/lib/Roundcube/rcube_output.php
+++ b/program/lib/Roundcube/rcube_output.php
@@ -1,6 +1,6 @@
<?php
-/*
+/**
+-----------------------------------------------------------------------+
| This file is part of the Roundcube PHP suite |
| Copyright (C) 2005-2014 The Roundcube Dev Team |
@@ -190,6 +190,11 @@
// Request browser to disable DNS prefetching (CVE-2010-0464)
header("X-DNS-Prefetch-Control: off");
+
+ // send CSRF and clickjacking protection headers
+ if ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')) {
+ header('X-Frame-Options: ' . $xframe);
+ }
}
/**
--
Gitblit v1.9.1