my $cache_policy = 'no-cache';
$cache_policy .= ', no-store, max-age=0' if $extra_options->{force_no_caching};
my $options = {
- type => $content_type_map{$content_type},
- status => $status,
- charset => 'UTF-8',
- Pragma => 'no-cache',
- 'Cache-Control' => $cache_policy,
+ type => $content_type_map{$content_type},
+ status => $status,
+ charset => 'UTF-8',
+ Pragma => 'no-cache',
+ 'Cache-Control' => $cache_policy,
+ 'X-Frame-Options' => 'DENY',
};
$options->{expires} = 'now' if $extra_options->{force_no_caching};
[% USE AudioAlerts %]
[% USE String %]
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+[%# Prevent XFS attacks -%]
+<style id="antiClickjack">body{display:none !important;}</style>
+<script type="text/javascript">
+ if (self === top) {
+ var antiClickjack = document.getElementById("antiClickjack");
+ antiClickjack.parentNode.removeChild(antiClickjack);
+ } else {
+ top.location = self.location;
+ }
+</script>
+
<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
<link rel="stylesheet" type="text/css" href="[% interface %]/lib/jquery/jquery-ui.css" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats -->
<meta name="viewport" content="width=device-width, initial-scale=1" />
+
+[%# Prevent XFS attacks -%]
+<style id="antiClickjack">body{display:none !important;}</style>
+<script type="text/javascript">
+ if (self === top) {
+ var antiClickjack = document.getElementById("antiClickjack");
+ antiClickjack.parentNode.removeChild(antiClickjack);
+ } else {
+ top.location = self.location;
+ }
+</script>
+
<link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
[% IF ( bidi ) %]
<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/lib/bootstrap/css/bootstrap-rtl.min.css" />