mirror/advplyr.audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2025-07-01 13:04:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Support ALLOW_IFRAME env variable to not include frame-ancestors header #3684

Browse source
This commit is contained in:
advplyr 2024-12-06 17:17:32 -06:00
parent 9a1c773b7a
commit 3b4a5b8785
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
server/Server.js
View file

@ -53,6 +53,7 @@ class Server {
global.RouterBasePath = ROUTER_BASE_PATH
global.XAccel = process.env.USE_X_ACCEL
global.AllowCors = process.env.ALLOW_CORS === '1'
global.AllowIframe = process.env.ALLOW_IFRAME === '1'
global.DisableSsrfRequestFilter = process.env.DISABLE_SSRF_REQUEST_FILTER === '1'
if (!fs.pathExistsSync(global.ConfigPath)) {
@ -194,8 +195,10 @@ class Server {
const app = express()
app.use((req, res, next) => {
// Prevent clickjacking by disallowing iframes
res.setHeader('Content-Security-Policy', "frame-ancestors 'self'")
if (!global.AllowIframe) {
// Prevent clickjacking by disallowing iframes
res.setHeader('Content-Security-Policy', "frame-ancestors 'self'")
}
/**
* @temporary