Add frame-ancestors to allow remote auth

2017-06-07 09:51:10 +02:00
parent 811d031ffd
commit aa9aaefdea
2 changed files with 8 additions and 0 deletions
--- a/server.js
+++ b/server.js
@@ -34,6 +34,11 @@ var setHeaders = (function () {
    const headers = clone(config.httpHeaders);
    if (config.contentSecurity) {
        headers['Content-Security-Policy'] = clone(config.contentSecurity);
+        if (headers['Content-Security-Policy'].indexOf('frame-ancestors') === -1) {
+            // backward compat for those who do not merge the new version of the config
+            // when updating. This prevents endless spinner if someone clicks donate.
+            headers['Content-Security-Policy'] += "frame-ancestors 'self' accounts.cryptpad.fr;";
+        }
    }
    const padHeaders = clone(headers);
    if (config.padContentSecurity) {