git.samba.org / samba.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 4f0de0f)
swat: Use X-Frame-Options header to avoid clickjacking
authorKai Blin <kai@samba.org>
Fri, 18 Jan 2013 22:11:07 +0000 (23:11 +0100)
committerKarolin Seeger <kseeger@samba.org>
Tue, 29 Jan 2013 09:52:01 +0000 (10:52 +0100)
Jann Horn reported a potential clickjacking vulnerability in SWAT where
the SWAT page could be embedded into an attacker's page using a frame or
iframe and then used to trick the user to change Samba settings.

Avoid this by telling the browser to refuse the frame embedding via the
X-Frame-Options: DENY header.

Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9576 - CVE-2013-0213: Clickjacking issue in SWAT.

source3/web/swat.c patch | blob | history

diff --git a/source3/web/swat.c b/source3/web/swat.c
index 754e3cee732fec28583b221581ba8cb118e441d4..d2bbee40c342abba0e15d464f0bb5cfeeee222a8 100644 (file)
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -260,7 +260,8 @@ static void print_header(void)
        if (!cgi_waspost()) {
                printf("Expires: 0\r\n");
        }
-       printf("Content-type: text/html\r\n\r\n");
+       printf("Content-type: text/html\r\n");
+       printf("X-Frame-Options: DENY\r\n\r\n");
 
        if (!include_html("include/header.html")) {
                printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n");
Samba Shared Repository