setting xframe_options to deny

2018-08-01 14:57:59 +05:00
parent 90e3270fd0
commit 45d1ce6d07
2 changed files with 4 additions and 2 deletions
--- a/cms/envs/common.py
+++ b/cms/envs/common.py
@@ -531,8 +531,8 @@ MIDDLEWARE_CLASSES = [
    'openedx.core.djangoapps.site_configuration.middleware.SessionCookieDomainOverrideMiddleware',
 ]

-# Clickjacking protection can be enabled by setting this to 'DENY'
-X_FRAME_OPTIONS = 'ALLOW'
+# Clickjacking protection can be disabled by setting this to 'ALLOW'
+X_FRAME_OPTIONS = 'DENY'

 # Platform for Privacy Preferences header
 P3P_HEADER = 'CP="Open EdX does not have a P3P policy."'