beenull/adminerevo
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Use Referrer-Policy instead of <meta name="referrer">

Browse source 
To make securityheaders.io happy.

Also fix a typo in the value (https://lists.w3.org/Archives/Public/public-webappsec/2015May/0059.html).
This commit is contained in:
Jakub Vrana 2018-01-09 11:01:37 +01:00
parent 3de101dff4
commit d07b7e3773
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
adminer/include/design.inc.php
View file

@ -20,7 +20,6 @@ function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") {
<html lang="<?php echo $LANG; ?>" dir="<?php echo lang('ltr'); ?>">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="robots" content="noindex">
<meta name="referrer" content="origin-when-crossorigin">
<title><?php echo $title_page; ?></title>
<link rel="stylesheet" type="text/css" href="../adminer/static/default.css">
<script src="../adminer/static/functions.js"></script>
@ -91,6 +90,7 @@ function page_headers() {
if ($adminer->headers()) {
header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox 3.6.9
header("X-XSS-Protection: 0"); // prevents introducing XSS in IE8 by removing safe parts of the page
header("Referrer-Policy: origin-when-cross-origin");
}
}

1
plugins/frames.php
View file

@ -22,6 +22,7 @@ class AdminerFrames {
header("X-Frame-Options: SameOrigin");
}
header("X-XSS-Protection: 0");
header("Referrer-Policy: origin-when-cross-origin");
return false;
}