Changeset 18013

Timestamp:

05/24/2011 03:29:12 PM (13 years ago)

Author:

ryan

Message:

Send X-Frame-Options: SAMEORIGIN for admin and login pages. see #12293

Location:

branches/3.1

Files:

• wp-includes/default-filters.php (modified) (2 diffs)
• wp-includes/functions.php (modified) (1 diff)
• wp-login.php (modified) (1 diff)

branches/3.1/wp-includes/default-filters.php

@@ -219 +219 @@
 add_action( 'login_head',          'wp_print_head_scripts',         9     );
 add_action( 'login_footer',        'wp_print_footer_scripts'              );
+add_action( 'login_init',          'send_frame_options_header',     10, 0 );
 
 // Feed Generator Tags
@@ -250 +251 @@
 add_action( 'comment_form', 'wp_comment_form_unfiltered_html_nonce'        );
 add_action( 'wp_scheduled_delete',        'wp_scheduled_delete'            );
+add_action( 'admin_init',                 'send_frame_options_header', 10, 0 );
 
 // Navigation menu actions

branches/3.1/wp-includes/functions.php

@@ -4483 +4483 @@
 }
 
+/**
+ * Send a HTTP header to limit rendering of pages to same origin iframes.
+ *
+ * @link https://developer.mozilla.org/en/the_x-frame-options_response_header
+ *
+ * @since 3.2.0
+ * @return none
+ */
+function send_frame_options_header() {
+    @header( 'X-Frame-Options: SAMEORIGIN' );
+}
+
 ?>

branches/3.1/wp-login.php

@@ -369 +369 @@
 
 // allow plugins to override the default actions, and to add extra actions if they want
-do_action('login_form_' . $action);
+do_action( 'login_init' );
+do_action( 'login_form_' . $action );
 
 $http_post = ('POST' == $_SERVER['REQUEST_METHOD']);