Forráskód Böngészése

X-Frame-Options value can be set in desktop config.

oxpa 9 éve
szülő
commit
f7b823a

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -84,6 +84,9 @@
   # Execute this script to produce the SSL password. This will be used when `ssl_password` is not set.
   ## ssl_password_script=
 
+  # Django sets X-Frame-Options HTTP header to this value. Default is 'SAMEORIGIN'.
+  ## django_x_frame_options=DENY
+
   # List of allowed and disallowed ciphers in cipher list format.
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on
   # cipher list format. This list is from

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -91,6 +91,12 @@ HTTP_ALLOWED_METHODS = Config(
   private=True,
   default=['OPTIONS', 'GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT'])
 
+X_FRAME_OPTIONS = Config(
+  key="django_x_frame_options",
+  help=_("X-Frame-Options HTTP header value."),
+  type=str,
+  default="SAMEORIGIN")
+
 SSL_CERTIFICATE = Config(
   key="ssl_certificate",
   help=_("Filename of SSL Certificate"),

+ 2 - 0
desktop/core/src/desktop/settings.py

@@ -277,6 +277,8 @@ if DEBUG: # For simplification, force all DEBUG when django_debug_mode is True a
 # Configure allowed hosts
 ALLOWED_HOSTS = desktop.conf.ALLOWED_HOSTS.get()
 
+X_FRAME_OPTIONS = desktop.conf.X_FRAME_OPTIONS.get()
+
 # Configure hue admins
 ADMINS = []
 for admin in desktop.conf.DJANGO_ADMINS.get():