DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2025-01-11 13:57:41 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Allow X-Frame-Options to be disabled via env if necessary

Browse source
This commit is contained in:
snipe 2016-08-29 22:57:29 -07:00
parent 276e0a7114
commit 64cd4fb1c9
4 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.env.example
View file

@ -75,3 +75,4 @@ APP_LOG=single
APP_LOCKED=false
FILESYSTEM_DISK=local
APP_TRUSTED_PROXIES=192.168.1.1,10.0.0.1
ALLOW_IFRAMING=false

5
app/Http/Middleware/FrameGuard.php
View file

@ -15,7 +15,10 @@ class FrameGuard
public function handle($request, Closure $next)
{
$response = $next($request);
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', false);
if (config('app.allow_iframing') == false) {
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', false);
}
return $response;
}
}

15
config/app.php
View file

@ -127,6 +127,20 @@ return [
'private_uploads' => storage_path().'/private_uploads',
/*
|--------------------------------------------------------------------------
| ALLOW I-FRAMING
|--------------------------------------------------------------------------
|
| Normal users will never need to edit this. This option lets you run
| Snipe-IT within an I-Frame, which is normally disabled by default for
| security reasons, to prevent clickjacking. It should normally be set to false.
|
*/
'allow_iframing' => env('ALLOW_IFRAMING', false),
/*
|--------------------------------------------------------------------------
| Demo Mode Lockdown
@ -140,7 +154,6 @@ return [
'lock_passwords' => env('APP_LOCKED', false),
/*
|--------------------------------------------------------------------------
| Autoloaded Service Providers

2
docker.env
View file

@ -22,3 +22,5 @@ APP_KEY=Y5hJeC7x1i7OxhDrvrQPlB9KvCorvRdO
APP_URL=http://127.0.0.1:32782
APP_TIMEZONE=US/Pacific
APP_LOCALE=en
ALLOW_IFRAMING=false