Skip to content
Extraits de code Groupes Projets
Valider ae8e02dc rédigé par mattpiwik's avatar mattpiwik
Parcourir les fichiers

Fixes #2701 

 * Iframe busting ALL pages except widgets/dashboard
 * Refactored iframe busting code
 * This new behavior might break some backward compatibility but can be disabled by setting enable_framed_pages = 1 in the config file

@vipsoft your review is welcome on this one!

git-svn-id: http://dev.piwik.org/svn/trunk@5805 59fd770c-687e-43c8-a1e3-f5a4ff64c105
parent 7f079373
Aucune branche associée trouvée
Aucune étiquette associée trouvée
Aucune requête de fusion associée trouvée
Masquer les modifications d'espaces
En ligne Côte à côte
Affichage de
avec 39 ajouts et 35 suppressions
config/global.ini.php
+ 4
− 0
Voir le fichier @ ae8e02dc
...@@ -188,6 +188,10 @@ enable_framed_logins = 0 ...@@ -188,6 +188,10 @@ enable_framed_logins = 0
; Default is 0 (i.e., bust frames on the Settings forms). ; Default is 0 (i.e., bust frames on the Settings forms).
enable_framed_settings = 0 enable_framed_settings = 0
; Set to 1 to disable the framebuster on standard Non-widgets pages (a click-jacking countermeasure).
; Default is 0 (i.e., bust frames on all non Widget pages such as API, Widgets, Email reports, etc.).
enable_framed_pages = 0
; language cookie name for session ; language cookie name for session
language_cookie_name = piwik_lang language_cookie_name = piwik_lang
......
core/Controller.php
+ 6
− 0
Voir le fichier @ ae8e02dc
...@@ -468,6 +468,12 @@ abstract class Piwik_Controller ...@@ -468,6 +468,12 @@ abstract class Piwik_Controller
$view->logoHeader = Piwik_API_API::getInstance()->getHeaderLogoUrl(); $view->logoHeader = Piwik_API_API::getInstance()->getHeaderLogoUrl();
$view->logoLarge = Piwik_API_API::getInstance()->getLogoUrl(); $view->logoLarge = Piwik_API_API::getInstance()->getLogoUrl();
$view->piwikUrl = Piwik::getPiwikUrl(); $view->piwikUrl = Piwik::getPiwikUrl();
$view->enableFrames = Zend_Registry::get('config')->General->enable_framed_pages;
if(!$view->enableFrames)
{
$view->setXFrameOptions('sameorigin');
}
} }
/** /**
......
plugins/CoreAdminHome/templates/header.tpl
+ 3
− 17
Voir le fichier @ ae8e02dc
...@@ -14,25 +14,11 @@ ...@@ -14,25 +14,11 @@
<!--[if IE]> <!--[if IE]>
<link rel="stylesheet" type="text/css" href="themes/default/ieonly.css" /> <link rel="stylesheet" type="text/css" href="themes/default/ieonly.css" />
<![endif]--> <![endif]-->
{if isset($enableFrames) && !$enableFrames} {include file="CoreHome/templates/iframe_buster_header.tpl"}
{literal}
<style type="text/css">body { display : none; }</style>
{/literal}
{/if}
</head> </head>
<body> <body>
{if isset($enableFrames) && !$enableFrames}
{literal} {include file="CoreHome/templates/iframe_buster_body.tpl"}
<script type="text/javascript">
if(self == top) {
var theBody = document.getElementsByTagName('body')[0];
theBody.style.display = 'block';
} else {
top.location = self.location;
}
</script>
{/literal}
{/if}
<div id="root"> <div id="root">
{if !isset($showTopMenu) || $showTopMenu} {if !isset($showTopMenu) || $showTopMenu}
{include file="CoreHome/templates/top_bar.tpl"} {include file="CoreHome/templates/top_bar.tpl"}
......
plugins/CoreHome/templates/header.tpl
+ 3
− 1
Voir le fichier @ ae8e02dc
...@@ -16,8 +16,10 @@ ...@@ -16,8 +16,10 @@
<!--[if IE]> <!--[if IE]>
<link rel="stylesheet" type="text/css" href="themes/default/ieonly.css" /> <link rel="stylesheet" type="text/css" href="themes/default/ieonly.css" />
<![endif]--> <![endif]-->
{include file="CoreHome/templates/iframe_buster_header.tpl"}
</head> </head>
<body> <body>
{include file="CoreHome/templates/iframe_buster_body.tpl"}
<div id="root">{if !isset($showTopMenu) || $showTopMenu} <div id="root">{if !isset($showTopMenu) || $showTopMenu}
{include file="CoreHome/templates/top_bar.tpl"} {include file="CoreHome/templates/top_bar.tpl"}
{/if} {/if}
...@@ -26,4 +28,4 @@ ...@@ -26,4 +28,4 @@
<div class="ui-confirm" id="alert"> <div class="ui-confirm" id="alert">
<h2></h2> <h2></h2>
<input id="yes" type="button" value="{'General_Ok'|translate}" /> <input id="yes" type="button" value="{'General_Ok'|translate}" />
</div> </div>
\ No newline at end of file
plugins/CoreHome/templates/iframe_buster_body.tpl 0 → 100644
+ 14
− 0
Voir le fichier @ ae8e02dc
{if isset($enableFrames) && !$enableFrames}
{literal}
<script type="text/javascript">
if(self == top) {
var theBody = document.getElementsByTagName('body')[0];
theBody.style.display = 'block';
} else {
top.location = self.location;
}
</script>
{/literal}
{/if}
plugins/CoreHome/templates/iframe_buster_header.tpl 0 → 100644
+ 5
− 0
Voir le fichier @ ae8e02dc
{if isset($enableFrames) && !$enableFrames}
{literal}
<style type="text/css">body { display : none; }</style>
{/literal}
{/if}
\ No newline at end of file
plugins/Login/templates/header.tpl
+ 4
− 17
Voir le fichier @ ae8e02dc
...@@ -8,11 +8,8 @@ ...@@ -8,11 +8,8 @@
<link rel="stylesheet" type="text/css" href="plugins/Login/templates/login.css" /> <link rel="stylesheet" type="text/css" href="plugins/Login/templates/login.css" />
<meta name="description" content="{'General_OpenSourceWebAnalytics'|translate|escape}" /> <meta name="description" content="{'General_OpenSourceWebAnalytics'|translate|escape}" />
{if isset($enableFrames) && !$enableFrames}
{literal}
<style type="text/css">body { display : none; }</style>
{/literal}
{/if}
{if isset($forceSslLogin) && $forceSslLogin} {if isset($forceSslLogin) && $forceSslLogin}
{literal} {literal}
<script type="text/javascript"> <script type="text/javascript">
...@@ -40,20 +37,10 @@ ...@@ -40,20 +37,10 @@
{if 'General_LayoutDirection'|translate =='rtl'} {if 'General_LayoutDirection'|translate =='rtl'}
<link rel="stylesheet" type="text/css" href="themes/default/rtl.css" /> <link rel="stylesheet" type="text/css" href="themes/default/rtl.css" />
{/if} {/if}
{include file="CoreHome/templates/iframe_buster_header.tpl"}
</head> </head>
<body class="login"> <body class="login">
{if isset($enableFrames) && !$enableFrames} {include file="CoreHome/templates/iframe_buster_body.tpl"}
{literal}
<script type="text/javascript">
if(self == top) {
var theBody = document.getElementsByTagName('body')[0];
theBody.style.display = 'block';
} else {
top.location = self.location;
}
</script>
{/literal}
{/if}
{include file="default/ie6.tpl"} {include file="default/ie6.tpl"}
<div id="logo"> <div id="logo">
{if !$isCustomLogo}<a href="http://piwik.org" alt="Piwik" title="{$linkTitle}">{/if} {if !$isCustomLogo}<a href="http://piwik.org" alt="Piwik" title="{$linkTitle}">{/if}
......
0% ou .
You are about to add 0 people to the discussion. Proceed with caution.
Terminez d'abord l'édition de ce message.
Veuillez vous inscrire ou vous pour commenter