Bug 16210: Revert OPAC changes from Bug 15111
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 8 Apr 2016 09:03:24 +0000 (10:03 +0100)
committerFrédéric Demians <f.demians@tamil.fr>
Wed, 27 Apr 2016 15:09:16 +0000 (17:09 +0200)
commit62b3d204b2fa0e719ba6d9ecad1371d670aa5a1e
treef9530ac937a1f457b6519529e8d7616790752620
parent4a47224136df62b528f73d0e38c4febde903808a
Bug 16210: Revert OPAC changes from Bug 15111

This patch reverts the changes made at the OPAC from the following
patches:

Do not include the antiClickjack legacy browser trick for greybox"

Revert "Bug 15111: Do not include the antiClickjack legacy browser trick for greybox"
This reverts commit fc640d2a86f395ad392f84314bce22e8b4dab1fe.

Revert "Bug 15111: Change X-Frame-Options with SAMEORIGIN"
This reverts commit fb167c0e4b897bf9a93b4fd6176b15e2d4dbd4df.

Revert "Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks"
This reverts commit dc03bca76cf5b7cb48d98d1ce245fc65b98be929.

Setting X-Frame-Options to SAMEORIGIN is enough for mordern browsers:
https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

The antiClickjack trick should be removed at the OPAC as we want to keep
the OPAC usable even if the user has disabled JS.
That means the OPAC will be vulnerable to XFS if a user is navigating
with a prehistoric browser:
Firefox 3.6.9 September 2010
IE 8    March 2008
Opera 10.5  March 2010
Safari 4  February 2009
Chrome 4.1.…  somewhen 2010

Test plan:
Confirm that there are no regression of bug 15111 with modern browsers

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
(cherry picked from commit d496d03e8aa3079e0d29837b27b31b9a55afd02e)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
(cherry picked from commit 57fc49475db35b965ea50e5b60114fa46b2be37f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt