Always send `x-frame-options`

Resolves #4484

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 2b849b4a5cd860a3f572a8f1dd9c65a9021c584b..bc10016eda28eeded3318e37a922489c2ebb14d9 100644 (file)
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -581,13 +581,6 @@ private:wcf.acp.option.exception_privacy.private</selectoptions>
                                <validationpattern>^[a-zA-Z0-9_]+$</validationpattern>
                        </option>
                        <!-- /general.system.cookie-->
-                       <!-- general.system.http -->
-                       <option name="http_send_x_frame_options">
-                               <categoryname>general.system.http</categoryname>
-                               <optiontype>boolean</optiontype>
-                               <defaultvalue>1</defaultvalue>
-                       </option>
-                       <!-- /general.system.http -->
                        <!-- general.system.packageServer -->
                        <option name="package_server_auth_code">
                                <categoryname>general.system.packageServer</categoryname>
@@ -1666,4 +1659,7 @@ DESC:wcf.global.sortOrder.descending</selectoptions>
                        </option>
                </options>
        </import>
+       <delete>
+               <option name="http_send_x_frame_options"/>
+       </delete>
 </data>

diff --git a/constants.php b/constants.php
index 6144dfe29499d3dde20f8bb67117b4dda19f7606..8948fe5a7f171cf71c26e1b47a63a93fd6462896 100644 (file)
--- a/constants.php
+++ b/constants.php
@@ -56,7 +56,6 @@
 \define('SEARCH_ENGINE', 'mysql');
 \define('EXCEPTION_PRIVACY', 'public');
 \define('COOKIE_PREFIX', 'wcf21_');
-\define('HTTP_SEND_X_FRAME_OPTIONS', 1);
 \define('PACKAGE_SERVER_AUTH_CODE', '');
 \define('PROXY_SERVER_HTTP', '');
 \define('IP_ADDRESS_SEARCH_ENGINE', '');

diff --git a/wcfsetup/install/files/acp/templates/index.tpl b/wcfsetup/install/files/acp/templates/index.tpl
index 50c86ec303df579026da4207179dc95f92f85f42..0fd6901ca6677205e88ecfc80b5de554046e1b1d 100644 (file)
--- a/wcfsetup/install/files/acp/templates/index.tpl
+++ b/wcfsetup/install/files/acp/templates/index.tpl
@@ -25,10 +25,6 @@
        <p class="error">{lang}wcf.acp.index.tmpBroken{/lang}</p>
 {/if}
 
-{if !HTTP_SEND_X_FRAME_OPTIONS}
-       <p class="error">{lang}wcf.acp.index.allowsFrameEmbedding{/lang}</p>
-{/if}
-
 {if $recaptchaWithoutKey}
        <p class="error">{lang}wcf.acp.index.recaptchaWithoutKey{/lang}</p>
 {/if}

diff --git a/wcfsetup/install/files/lib/acp/page/IndexPage.class.php b/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
index c0eed71c51894f975fe63f161f1825b865736869..a8dc7a918a41ee9026100fe223f5bb392b16dfcb 100755 (executable)
--- a/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
@@ -109,15 +109,6 @@ class IndexPage extends AbstractPage
             );
         }
 
-        $xFrameOptionsLink = LinkHandler::getInstance()->getLink(
-            'Option',
-            [
-                'id' => $optionCategories['general']->categoryID,
-                'optionName' => 'http_send_x_frame_options',
-            ],
-            '#category_general.system'
-        );
-
         $evaluationExpired = $evaluationPending = [];
         foreach (ApplicationHandler::getInstance()->getApplications() as $application) {
             if ($application->isTainted) {
@@ -189,7 +180,6 @@ class IndexPage extends AbstractPage
         WCF::getTPL()->assign([
             'recaptchaWithoutKey' => $recaptchaWithoutKey,
             'recaptchaKeyLink' => $recaptchaKeyLink,
-            'xFrameOptionsLink' => $xFrameOptionsLink,
             'server' => $this->server,
             'usersAwaitingApproval' => $usersAwaitingApproval,
             'evaluationExpired' => $evaluationExpired,

diff --git a/wcfsetup/install/files/lib/system/WCF.class.php b/wcfsetup/install/files/lib/system/WCF.class.php
index f8da53a2dfff6d39912b680d450989b74067189f..4faa927fc89002c5f1ad437d3cabfc99272fea9f 100644 (file)
--- a/wcfsetup/install/files/lib/system/WCF.class.php
+++ b/wcfsetup/install/files/lib/system/WCF.class.php
@@ -495,6 +495,9 @@ class WCF
 
         // The captcha option related to the removed SearchForm was removed in 5.5.
         \define('SEARCH_USE_CAPTCHA', 0);
+
+        // Disabling X-Frame-Options is no longer possible since 5.6.
+        \define('HTTP_SEND_X_FRAME_OPTIONS', 1);
     }
 
     /**

diff --git a/wcfsetup/install/files/lib/system/WCFSetup.class.php b/wcfsetup/install/files/lib/system/WCFSetup.class.php
index 607e4315cfba8499a361f444a96f83de91e8609a..43062ad071be76d660bc540d6c8d1c749e701070 100644 (file)
--- a/wcfsetup/install/files/lib/system/WCFSetup.class.php
+++ b/wcfsetup/install/files/lib/system/WCFSetup.class.php
@@ -36,7 +36,6 @@ use wcf\util\XML;
 
 // define
 \define('PACKAGE_ID', 0);
-\define('HTTP_SEND_X_FRAME_OPTIONS', 1);
 \define('CACHE_SOURCE_TYPE', 'disk');
 \define('ENABLE_DEBUG_MODE', 1);
 \define('ENABLE_BENCHMARK', 0);

diff --git a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
index b71e9fdf80a86cbb9da808cf5e5c84bc9335245b..620e5b8f09a47f3b8212231ebfe4e179e66e8ad5 100644 (file)
--- a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
@@ -502,10 +502,6 @@ final class SessionHandler extends SingletonFactory
                 $sameSite = '; SameSite=lax';
             }
 
-            if (!HTTP_SEND_X_FRAME_OPTIONS) {
-                $sameSite = '; SameSite=none';
-            }
-
             \header(
                 'set-cookie: XSRF-TOKEN=' . \rawurlencode($xsrfToken) . '; path=/' . $cookieDomain . (RouteHandler::secureConnection() ? '; secure' : '') . $sameSite,
                 false

diff --git a/wcfsetup/install/files/lib/util/HeaderUtil.class.php b/wcfsetup/install/files/lib/util/HeaderUtil.class.php
index 2197eedc5c0a52cec9f6decef2521ce236071fef..fa1ef62365b36336993ee916932cea33bf267fdb 100644 (file)
--- a/wcfsetup/install/files/lib/util/HeaderUtil.class.php
+++ b/wcfsetup/install/files/lib/util/HeaderUtil.class.php
@@ -42,16 +42,11 @@ final class HeaderUtil
     {
         $cookieDomain = self::getCookieDomain();
 
-        $sameSite = '';
-        if (!HTTP_SEND_X_FRAME_OPTIONS) {
-            $sameSite = '; SameSite=none';
-        }
-
         @\header(
             'Set-Cookie: ' . \rawurlencode(COOKIE_PREFIX . $name) . '=' . \rawurlencode((string)$value) . ($expire ? '; expires=' . \gmdate(
                 'D, d-M-Y H:i:s',
                 $expire
-            ) . ' GMT; max-age=' . ($expire - TIME_NOW) : '') . '; path=/' . ($cookieDomain !== null ? '; domain=' . $cookieDomain : '') . (RouteHandler::secureConnection() ? '; secure' : '') . $sameSite . '; HttpOnly',
+            ) . ' GMT; max-age=' . ($expire - TIME_NOW) : '') . '; path=/' . ($cookieDomain !== null ? '; domain=' . $cookieDomain : '') . (RouteHandler::secureConnection() ? '; secure' : '') . '; HttpOnly',
             false
         );
     }
@@ -95,10 +90,7 @@ final class HeaderUtil
             self::sendNoCacheHeaders();
         }
 
-        // send X-Frame-Options
-        if (HTTP_SEND_X_FRAME_OPTIONS) {
-            @\header('X-Frame-Options: SAMEORIGIN');
-        }
+        @\header('X-Frame-Options: SAMEORIGIN');
 
         \ob_start([self::class, 'parseOutput']);
     }

diff --git a/wcfsetup/install/files/options.inc.php b/wcfsetup/install/files/options.inc.php
index 21870e4dadcb387d464c5a473ee1b85d5975bf82..e4677425c63eb4e4479317aba822716849388a06 100644 (file)
--- a/wcfsetup/install/files/options.inc.php
+++ b/wcfsetup/install/files/options.inc.php
@@ -22,8 +22,6 @@ if (\file_exists(WCF_DIR . 'cookiePrefix.txt')) {
 \define('COOKIE_PATH', '');
 \define('COOKIE_DOMAIN', '');
 
-\define('HTTP_SEND_X_FRAME_OPTIONS', 1);
-
 \define('CACHE_SOURCE_TYPE', 'disk');
 \define('IMAGE_ADAPTER_TYPE', 'gd');
 \define('TIMEZONE', 'Europe/Berlin');

diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 600318f9f0d86730ccfcdbb441e5763a569df2d6..b44f05309ea6bcdf4b8b5a1e6462f6dcc050d328 100644 (file)
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -1333,8 +1333,6 @@ ACHTUNG: Die oben genannten Meldungen sind stark gekürzt. Sie können Details z
                <item name="wcf.acp.option.error.tooLow"><![CDATA[Der angegebene Wert ist zu gering.{if $option->minvalue !== null} Der minimale Wert ist {#$option->minvalue}.{/if}]]></item>
                <item name="wcf.acp.option.error.tooLong"><![CDATA[Der eingegebene Text ist zu lang.]]></item>
                <item name="wcf.acp.option.error.tooShort"><![CDATA[Der eingegebene Text ist zu kurz.]]></item>
-               <item name="wcf.acp.option.http_send_x_frame_options"><![CDATA[Einbindung in einem Frame verhindern (obsolet)]]></item>
-               <item name="wcf.acp.option.http_send_x_frame_options.description"><![CDATA[Die Option zur Kontrolle der Einbindung in einem Frame ist veraltet, wird in einer zukünftigen Version entfernt und die Einbindung generell unterbunden. Die Einbindung in einem Frame reduziert die Sicherheit, da <a href="https://de.wikipedia.org/wiki/Clickjacking" class="externalURL">Clickjacking-Angriffe</a> ermöglicht werden. Darüber hinaus können bestimmte Sicherheitsmerkmale von Cookies in Frames nicht verwendet werden.]]></item>
                <item name="wcf.acp.option.image_adapter_type"><![CDATA[Grafik-Bibliothek]]></item>
                <item name="wcf.acp.option.image_adapter_type.gd"><![CDATA[GD Graphics Library (Standard)]]></item>
                <item name="wcf.acp.option.image_adapter_type.imagick"><![CDATA[ImageMagick]]></item>
@@ -5564,4 +5562,8 @@ Benachrichtigungen auf <a href="{link isHtmlEmail=true}{/link}">{PAGE_TITLE|phra
                <item name="wcf.upload.error.uploadFailed"><![CDATA[Beim Hochladen der Datei ist ein unbekannter Fehler aufgetreten.]]></item>
        </category>
 </import>
+<delete>
+       <item name="wcf.acp.option.http_send_x_frame_options"/>
+       <item name="wcf.acp.option.http_send_x_frame_options.description"/>
+</delete>
 </language>

diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 8ccc9da5e73e4b48d2fb0ca63166219bdff70d6d..c0890aabc8d267e5a76ee07ebb9ce7cb88df564d 100644 (file)
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -1312,8 +1312,6 @@ ATTENTION: The messages listed above are greatly shortened. You can view details
                <item name="wcf.acp.option.error.tooLow"><![CDATA[Under the minimum value{if $option->minvalue !== null} of {#$option->minvalue}{/if}.]]></item>
                <item name="wcf.acp.option.error.tooLong"><![CDATA[The entered text is too long.]]></item>
                <item name="wcf.acp.option.error.tooShort"><![CDATA[The entered text is too short.]]></item>
-               <item name="wcf.acp.option.http_send_x_frame_options"><![CDATA[Disallow embedding in a frame (deprecated)]]></item>
-               <item name="wcf.acp.option.http_send_x_frame_options.description"><![CDATA[The option to control embedding within a frame is deprecated, will be removed in a future version and embedding will be prevented in all cases. Allowing embedding reduces security by allowing <a href="https://en.wikipedia.org/wiki/Clickjacking" class="externalURL">Clickjacking attacks</a> to happen. In addition certain security features for cookies are not available within frames.]]></item>
                <item name="wcf.acp.option.image_adapter_type"><![CDATA[Graphics Library]]></item>
                <item name="wcf.acp.option.image_adapter_type.gd"><![CDATA[Use GD Graphics Library (default)]]></item>
                <item name="wcf.acp.option.image_adapter_type.imagick"><![CDATA[Use ImageMagick]]></item>
@@ -5566,4 +5564,8 @@ your notifications on <a href="{link isHtmlEmail=true}{/link}">{PAGE_TITLE|phras
                <item name="wcf.upload.error.uploadFailed"><![CDATA[An unknown error occurred during the upload.]]></item>
        </category>
 </import>
+<delete>
+       <item name="wcf.acp.option.http_send_x_frame_options"/>
+       <item name="wcf.acp.option.http_send_x_frame_options.description"/>
+</delete>
 </language>