Allow removing the X_FRAME_OPTIONS header or setting it from a view (fix #103)
#122
Conversation
…r and respect its value if set by a view.
|
@devdanzin you need to sign the Plone Contributor Agreement to merge this pull request. Learn about the Plone Contributor Agreement: https://plone.org/foundation/contributors-agreement If you have already signed the agreement, please allow a week for your agreement to be processed. If after a week you have not received an invitation, then please contact agreements@plone.org. |
|
@devdanzin thanks for creating this Pull Request and helping to improve Plone! TL;DR: Finish pushing changes, pass all other checks, then paste a comment: To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically. Happy hacking! |
|
@jenkins-plone-org please run jobs |
| @@ -214,7 +214,9 @@ override it at your proxy server, or you can set the environment variable of | |||
| ``PLONE_X_FRAME_OPTIONS`` to whatever value you'd like plone.protect to set | |||
| this to globally. | |||
|
|
|||
| You can opt out of this by making the environment variable empty. | |||
| You can opt out of this by making the environment variable empty, which will | |||
| remove the header entirely. Setting a custom value in a custom view will | |||
This PR removes the
X_FRAME_OPTIONSheader when the environment variablePLONE_X_FRAME_OPTIONSis set to empty or"None". It also respects this header's value if set by a view, and only sets it to the env var's value if it's not present beforehand.This is my first contribution to Plone, so I apologize if the PR is wrong in any way and am ready to improve it upon request.
Edit: there's an
elsebranch to make the behavior easier to follow, but it would probably be better to remove it if the design is approved.Fixes #103.