From 85de55a120a615f8cf51a343a89789b802d776e2 Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Sat, 2 Feb 2013 20:32:13 +0200
Subject: [PATCH] Dont allow gitlab be loaded in iframe
---
app/controllers/application_controller.rb | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 74125e3308a..ca2a5623f42 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -4,6 +4,7 @@ class ApplicationController < ActionController::Base
before_filter :set_current_user_for_observers
before_filter :add_abilities
before_filter :dev_tools if Rails.env == 'development'
+ before_filter :default_headers
protect_from_forgery
@@ -148,4 +149,8 @@ class ApplicationController < ActionController::Base
Rack::MiniProfiler.authorize_request
end
+ def default_headers
+ headers['X-Frame-Options'] = 'DENY'
+ headers['X-XSS-Protection'] = '1; mode=block'
+ end
end
--
GitLab