svn commit: r1813276 - in /ofbiz/ofbiz-framework/trunk/framework/webapp: dtd/site-conf.xsd src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java

[mbrohl]

Author: mbrohl
Date: Wed Oct 25 12:56:01 2017
New Revision: 1813276

URL: http://svn.apache.org/viewvc?rev=1813276&view=rev
Log:
Fixed: X-Frame-Options configuration is not working
(OFBIZ-9891)

This fixes a bug where the configuration attribute in the view-map
differs from what is read in the configuration handler.

Aditionally,
a new option "none" is introduced. If it is set, no X-Frame-Options
header will be set.

Modified:
    ofbiz/ofbiz-framework/trunk/framework/webapp/dtd/site-conf.xsd
    ofbiz/ofbiz-framework/trunk/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java

Modified: ofbiz/ofbiz-framework/trunk/framework/webapp/dtd/site-conf.xsd
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/webapp/dtd/site-conf.xsd?rev=1813276&r1=1813275&r2=1813276&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/webapp/dtd/site-conf.xsd (original)
+++ ofbiz/ofbiz-framework/trunk/framework/webapp/dtd/site-conf.xsd Wed Oct 25 12:56:01 2017
@@ -782,7 +782,7 @@ under the License.
                 </xs:restriction>
             </xs:simpleType>
         </xs:attribute>
-        <xs:attribute name="x-frame-option" default="sameorigin">
+        <xs:attribute name="x-frame-options" default="sameorigin">
             <xs:annotation>
                 <xs:documentation>
                     Provides clickjacking protection by instructing browsers that this page should not be placed within a frame.
@@ -799,6 +799,7 @@ under the License.
                     <xs:enumeration value="deny"/>
                     <xs:enumeration value="sameorigin"/>
                     <xs:enumeration value="allow-from"/>
+                    <xs:enumeration value="none"/>
                 </xs:restriction>
             </xs:simpleType>
         </xs:attribute>

Modified: ofbiz/ofbiz-framework/trunk/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java?rev=1813276&r1=1813275&r2=1813276&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java Wed Oct 25 12:56:01 2017
@@ -952,7 +952,9 @@ public class RequestHandler {
         String xFrameOption = viewMap.xFrameOption;
         // default to sameorigin
         if (UtilValidate.isNotEmpty(xFrameOption)) {
-            resp.addHeader("x-frame-options", xFrameOption);
+            if(!"none".equals(xFrameOption)) {
+                resp.addHeader("x-frame-options", xFrameOption);
+            }
         } else {
             resp.addHeader("x-frame-options", "sameorigin");
         }