Add frame-ancestors 'self'

go-gitea · Apr 8, 2024 · 5b2d7b6 · 5b2d7b6
1 parent 1adb00d
commit 5b2d7b6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/routers/web/repo/render.go b/routers/web/repo/render.go
@@ -45,7 +45,7 @@ func RenderFile(ctx *context.Context) {
 	isTextFile := st.IsText()
 
 	rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc), charset.ConvertOpts{})
-	ctx.Resp.Header().Add("Content-Security-Policy", "frame-src 'self'; sandbox allow-scripts")
+	ctx.Resp.Header().Add("Content-Security-Policy", "frame-src 'self'; frame-ancestors 'self'; sandbox allow-scripts")
 
 	if markupType := markup.Type(blob.Name()); markupType == "" {
 		if isTextFile {