Explorar o código

HUE-1743 [core] Prevent frame busting and clickjacking

Added to the login page too
Enrico Berti %!s(int64=12) %!d(string=hai) anos
pai
achega
8de897e
Modificáronse 1 ficheiros con 9 adicións e 0 borrados
  1. 9 0
      desktop/core/src/desktop/templates/login.mako

+ 9 - 0
desktop/core/src/desktop/templates/login.mako

@@ -37,6 +37,7 @@ from django.utils.translation import ugettext as _
 
   <style type="text/css">
     body {
+      display: none;
       padding-top: 80px;
     }
 
@@ -171,6 +172,14 @@ from django.utils.translation import ugettext as _
 <script src="/static/ext/js/jquery/jquery-2.0.2.min.js"></script>
 <script>
   $(document).ready(function () {
+    // prevents framebusting and clickjacking
+    if (self == top){
+      $("body").show();
+    }
+    else {
+      top.location = self.location;
+    }
+
     var _skew = -1;
     $("[data-hover]").on("mouseover", function () {
       var _this = $(this);