Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove legacy browsers Frame Breaking js code usage and deprecate it #11679

Closed
wants to merge 7 commits into from
Closed

Remove legacy browsers Frame Breaking js code usage and deprecate it #11679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e515811
remove legacy frame breaking js code
andrepereiradasilva Aug 20, 2016
bc1f3d3
add to the view file
andrepereiradasilva Aug 20, 2016
35b81de
remove behavior.noframes from template
andrepereiradasilva Aug 20, 2016
5b6126c
Remove behavior.noframes from hathor template
andrepereiradasilva Aug 20, 2016
2c9ba8d
restore noframes behaviour and deprecate it on 4.0
andrepereiradasilva Aug 20, 2016
7cea868
remove extra space
andrepereiradasilva Aug 20, 2016
b417a54
missing tab
andrepereiradasilva Aug 20, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions administrator/components/com_login/views/login/tmpl/default.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@

defined('_JEXEC') or die;

JHtml::_('behavior.noframes');

/**
* Get the login modules
* If you want to use a completely different login module change the value of name
Expand Down
22 changes: 22 additions & 0 deletions administrator/components/com_login/views/login/view.html.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,26 @@
*/
class LoginViewLogin extends JViewLegacy
{
/**
* Display the view.
*
* @param string $tpl The name of the template file to parse.
*
* @return void
*
* @since __DEPLOY_VERSION__
*/
public function display($tpl = null)
{
/**
* To prevent clickjacking, only allow the login form to be used inside a frame in the same origin.
* So send a X-Frame-Options HTTP Header with the SAMEORIGIN value.
*
* @see https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
* https://tools.ietf.org/html/rfc7034
*/
JFactory::getApplication()->setHeader('X-Frame-Options', 'SAMEORIGIN');

return parent::display($tpl);
}
}
2 changes: 0 additions & 2 deletions administrator/templates/hathor/login.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@
// jQuery needed by template.js
JHtml::_('jquery.framework');

JHtml::_('behavior.noframes');

// Load optional RTL Bootstrap CSS
JHtml::_('bootstrap.loadCss', false, $this->direction);

Expand Down
4 changes: 4 additions & 0 deletions libraries/cms/html/behavior.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -791,9 +791,13 @@ className: '" . $className . "',
* @return void
*
* @since 1.5
*
* @deprecated 4.0 Add a X-Frame-Options HTTP Header with the SAMEORIGIN value instead.
*/
public static function noframes()
{
JLog::add(__METHOD__ . ' is deprecated, add a X-Frame-Options HTTP Header with the SAMEORIGIN value instead.', JLog::WARNING, 'deprecated');

// Only load once
if (isset(static::$loaded[__METHOD__]))
{
Expand Down