From 45d1ce6d07ac71eec6862a73b5a690d16809d386 Mon Sep 17 00:00:00 2001 From: noraiz-anwar Date: Wed, 1 Aug 2018 14:57:59 +0500 Subject: [PATCH] setting xframe_options to deny --- cms/djangoapps/contentstore/views/preview.py | 2 ++ cms/envs/common.py | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cms/djangoapps/contentstore/views/preview.py b/cms/djangoapps/contentstore/views/preview.py index 926fce6f54..7848c3d0d1 100644 --- a/cms/djangoapps/contentstore/views/preview.py +++ b/cms/djangoapps/contentstore/views/preview.py @@ -8,6 +8,7 @@ from django.contrib.auth.decorators import login_required from django.urls import reverse from django.http import Http404, HttpResponseBadRequest from django.utils.translation import ugettext as _ +from django.views.decorators.clickjacking import xframe_options_exempt from opaque_keys.edx.keys import UsageKey from web_fragments.fragment import Fragment from xblock.django.request import django_to_webob_request, webob_to_django_response @@ -51,6 +52,7 @@ log = logging.getLogger(__name__) @login_required +@xframe_options_exempt def preview_handler(request, usage_key_string, handler, suffix=''): """ Dispatch an AJAX action to an xblock diff --git a/cms/envs/common.py b/cms/envs/common.py index 331ee29c03..417b2550f3 100644 --- a/cms/envs/common.py +++ b/cms/envs/common.py @@ -531,8 +531,8 @@ MIDDLEWARE_CLASSES = [ 'openedx.core.djangoapps.site_configuration.middleware.SessionCookieDomainOverrideMiddleware', ] -# Clickjacking protection can be enabled by setting this to 'DENY' -X_FRAME_OPTIONS = 'ALLOW' +# Clickjacking protection can be disabled by setting this to 'ALLOW' +X_FRAME_OPTIONS = 'DENY' # Platform for Privacy Preferences header P3P_HEADER = 'CP="Open EdX does not have a P3P policy."'