X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fpage_header.php;h=f3fc1e68199275df4e51ef05a11c3009f4f88164;hp=42adba64508060320e2a5e27767a11f6438753d1;hb=adc3ea746a7853859d1e17cf60550992ccba011a;hpb=ae5dddc065f9501f267c4edaf68a066835da915f diff --git a/functions/page_header.php b/functions/page_header.php index 42adba64..f3fc1e68 100644 --- a/functions/page_header.php +++ b/functions/page_header.php @@ -5,7 +5,7 @@ * * Prints the page header (duh) * - * @copyright 1999-2011 The SquirrelMail Project Team + * @copyright 1999-2020 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -37,7 +37,8 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE } global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, - $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default; + $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default, + $head_tag_extra; // add no cache headers here // @@ -56,12 +57,41 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE); $oTemplate->header('X-Powered-By: SquirrelMail', FALSE); + // prevent clickjack attempts +// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain + $oTemplate->header('X-Frame-Options: SAMEORIGIN'); + + // prevent clickjack attempts using JavaScript for browsers that + // don't support the X-Frame-Options header... + // we check to see if we are *not* the top page, and if not, check + // whether or not the top page is in the same domain as we are... + // if not, log out immediately -- this is an attempt to do the same + // thing that the X-Frame-Options does using JavaScript (never a good + // idea to rely on JavaScript-based solutions, though) +//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user? + $header_tags = '\n"; + $oTemplate->assign('frames', $frames); $oTemplate->assign('lang', $squirrelmail_language); - $header_tags = ''; + $header_tags .= "\n" - $header_tags .= "\n"; + // For adding a favicon or anything else that should be inserted in *ALL*
for *ALL* documents, + // define $head_tag_extra in config/config_local.php + // The string "###SM BASEURI###" will be replaced with the base URI for this SquirrelMail installation. + // When not defined, a default is provided that displays the default favicon.ico. + // If you override this and still want to use the default favicon.ico, you'll have to include the following + // following in your $head_tag_extra string: + // $head_tag_extra = '...