浏览代码

HUE-1743 [core] Prevent frame busting and clickjacking

Added specific JS code
Enrico Berti 12 年之前
父节点
当前提交
90f3eda970
共有 1 个文件被更改,包括 10 次插入0 次删除
  1. 10 0
      desktop/core/src/desktop/templates/common_header.mako

+ 10 - 0
desktop/core/src/desktop/templates/common_header.mako

@@ -56,6 +56,7 @@ from django.utils.translation import ugettext as _
   <style type="text/css">
     % if conf.CUSTOM.BANNER_TOP_HTML.get():
       body {
+        display: none;
         padding-top: ${str(int(padding[:-2]) + 30) + 'px'};
       }
       .banner {
@@ -75,6 +76,7 @@ from django.utils.translation import ugettext as _
       }
     % else:
       body {
+        display: none;
         padding-top: ${padding};
       }
     % endif
@@ -137,6 +139,14 @@ from django.utils.translation import ugettext as _
 
   <script type="text/javascript" charset="utf-8">
     $(document).ready(function () {
+      // prevents framebusting and clickjacking
+      if (self == top){
+        $("body").show();
+      }
+      else {
+        top.location = self.location;
+      }
+
       $("input, textarea").placeholder();
       $(".submitter").keydown(function (e) {
         if (e.keyCode == 13) {