]> git.joonet.de Git - adminer.git/commitdiff
projects / adminer.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 3de101d)
Use Referrer-Policy instead of <meta name="referrer">
authorJakub Vrana <jakub@vrana.cz>
Tue, 9 Jan 2018 10:01:37 +0000 (11:01 +0100)
committerJakub Vrana <jakub@vrana.cz>
Thu, 11 Jan 2018 17:38:15 +0000 (18:38 +0100)
To make securityheaders.io happy.

Also fix a typo in the value (https://lists.w3.org/Archives/Public/public-webappsec/2015May/0059.html).

adminer/include/design.inc.php patch | blob | history
plugins/frames.php patch | blob | history

diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 2f40866e6460f68265265cd79612de1c18246b41..f93d81f00d899466132f1cd69c49882ddbf39d67 100644 (file)
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -20,7 +20,6 @@ function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") {
 <html lang="<?php echo $LANG; ?>" dir="<?php echo lang('ltr'); ?>">
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <meta name="robots" content="noindex">
-<meta name="referrer" content="origin-when-crossorigin">
 <title><?php echo $title_page; ?></title>
 <link rel="stylesheet" type="text/css" href="../adminer/static/default.css">
 <script src="../adminer/static/functions.js"></script>
@@ -91,6 +90,7 @@ function page_headers() {
        if ($adminer->headers()) {
                header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox 3.6.9
                header("X-XSS-Protection: 0"); // prevents introducing XSS in IE8 by removing safe parts of the page
+               header("Referrer-Policy: origin-when-cross-origin");
        }
 }
 
diff --git a/plugins/frames.php b/plugins/frames.php
index bb8519d6457c9b5b036e758978e99d8b95be1691..f29b60af6949ccf4ce90beb3db25e9e74f36bd99 100644 (file)
--- a/plugins/frames.php
+++ b/plugins/frames.php
@@ -22,6 +22,7 @@ class AdminerFrames {
                        header("X-Frame-Options: SameOrigin");
                }
                header("X-XSS-Protection: 0");
+               header("Referrer-Policy: origin-when-cross-origin");
                return false;
        }
        
Sources of adminer, a webclient for database management systems.