blitzwing/bintzwing
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adding HTTP headers to address certain XSS attacks, resolves #91

Browse source
This commit is contained in:
El RIDO 2016-09-18 11:29:37 +02:00
parent ec7af3a738
commit 8cfcf1c9f5
No known key found for this signature in database
GPG key ID: 0F5C940A6BD81F92
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/PrivateBin.php
View file

@ -403,12 +403,15 @@ class PrivateBin
{
// set headers to disable caching
$time = gmdate('D, d M Y H:i:s \G\M\T');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: no-store, no-cache, no-transform, must-revalidate');
header('Pragma: no-cache');
header('Expires: ' . $time);
header('Last-Modified: ' . $time);
header('Vary: Accept');
header('Content-Security-Policy: ' . $this->_conf->getKey('cspheader'));
header('X-Xss-Protection: 1; mode=block');
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
// label all the expiration options
$expire = array();