]> git.joonet.de Git - adminer.git/commitdiff
projects / adminer.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 415253b)
Always send security headers in customization
authorJakub Vrana <jakub@vrana.cz>
Tue, 9 Jan 2018 12:48:51 +0000 (13:48 +0100)
committerJakub Vrana <jakub@vrana.cz>
Thu, 11 Jan 2018 17:39:49 +0000 (18:39 +0100)
adminer/include/adminer.inc.php patch | blob | history
adminer/include/design.inc.php patch | blob | history
changes.txt patch | blob | history
editor/include/adminer.inc.php patch | blob | history
plugins/frames.php patch | blob | history

diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php
index dde21082c5a0da2b1e6dd1ff21415b1523e1c3f0..c25a8e0a4ef87b78a131908b74262caeff3fe76e 100644 (file)
--- a/adminer/include/adminer.inc.php
+++ b/adminer/include/adminer.inc.php
@@ -65,10 +65,9 @@ class Adminer {
        }
 
        /** Headers to send before HTML output
-       * @return bool true to send security headers
+       * @return null
        */
        function headers() {
-               return true;
        }
 
        /** Print HTML code inside <head>
diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 83d34d615a7f2382332eaca9c332b7613ccfc563..cd0563e5516cc50d9f5ce74bf979824915b29a0d 100644 (file)
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -87,12 +87,11 @@ function page_headers() {
        global $adminer;
        header("Content-Type: text/html; charset=utf-8");
        header("Cache-Control: no-cache");
-       if ($adminer->headers()) {
-               header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox 3.6.9
-               header("X-XSS-Protection: 0"); // prevents introducing XSS in IE8 by removing safe parts of the page
-               header("X-Content-Type-Options: nosniff");
-               header("Referrer-Policy: origin-when-cross-origin");
-       }
+       header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox 3.6.9
+       header("X-XSS-Protection: 0"); // prevents introducing XSS in IE8 by removing safe parts of the page
+       header("X-Content-Type-Options: nosniff");
+       header("Referrer-Policy: origin-when-cross-origin");
+       $adminer->headers();
 }
 
 /** Print flash and error messages
diff --git a/changes.txt b/changes.txt
index 2a33e236594ab3b303fbdf4ecfef66551e97a49d..5ca548e8fc079c48d502c13e70828e90d785e8e5 100644 (file)
--- a/changes.txt
+++ b/changes.txt
@@ -6,6 +6,7 @@ PostgreSQL: Sort table names (regression from 4.3.1)
 Editor: Don't set time zone from PHP, fixes DST
 Editor: Display field comment's text inside [] only in edit form
 Editor: Fix doubleclick on database page
+Customization: Always send security headers
 Hebrew translation
 
 Adminer 4.3.1 (released 2017-04-14):
diff --git a/editor/include/adminer.inc.php b/editor/include/adminer.inc.php
index 1aa786466ca1e3560ccf7e94eead8fac8f5dbda3..4c55d937c57798bc8633307ba544833ab3774d69 100644 (file)
--- a/editor/include/adminer.inc.php
+++ b/editor/include/adminer.inc.php
@@ -45,7 +45,6 @@ class Adminer {
        }
 
        function headers() {
-               return true;
        }
 
        function head() {
diff --git a/plugins/frames.php b/plugins/frames.php
index 32e521bc67fa17c4d1af66d5a423c9fc948fb06a..c09e630ad1d1c6f22c3d243efaa6b485c77b1611 100644 (file)
--- a/plugins/frames.php
+++ b/plugins/frames.php
@@ -20,11 +20,9 @@ class AdminerFrames {
        function headers() {
                if ($this->sameOrigin) {
                        header("X-Frame-Options: SameOrigin");
+               } elseif (function_exists('header_remove')) {
+                       header_remove("X-Frame-Options");
                }
-               header("X-XSS-Protection: 0");
-               header("X-Content-Type-Options: nosniff");
-               header("Referrer-Policy: origin-when-cross-origin");
-               return false;
        }
        
 }
Sources of adminer, a webclient for database management systems.