add X-Frame-Options to console headers

2012-05-13 13:05:17 +00:00
parent fc5e30e6ae
commit 3685bf04d0
14 changed files with 37 additions and 1 deletions
--- a/apps/routerconsole/jsp/css.jsi
+++ b/apps/routerconsole/jsp/css.jsi
@@ -29,6 +29,10 @@
 <jsp:useBean class="net.i2p.router.web.CSSHelper" id="intl" scope="request" />
 <jsp:setProperty name="intl" property="contextId" value="<%=(String)session.getAttribute(\"i2p.contextId\")%>" />
 <%
+   // clickjacking
+   if (intl.shouldSendXFrame())
+      response.setHeader("X-Frame-Options", "SAMEORIGIN");
+
   String conNonceParam = request.getParameter("consoleNonce");
   if (conNonceParam != null && conNonceParam.equals(System.getProperty("router.consoleNonce"))) {
       intl.setLang(request.getParameter("lang"));