Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#28066] - [4.0] Add clickjacking protection frame-ancestors to the CSP tooling

? ? ? Pending

User tests: Successful: Unsuccessful:

avatar zero-24
zero-24
24 Feb 2020

Summary of Changes

Add clickjacking protection frame-ancestors to the CSP tooling. cc @SniperSister

Testing Instructions

  • Apply this patch
  • go to System -> Content Security Policy -> Options
  • enable Content Security Policy
  • enable report only mode
  • enable the auto or custom mode of the csp.
  • save.
  • open the frontend
  • check the browser console
  • set an individual frame-ancestors directive. Example:
    image
  • make sure only your directive is added to the header.

Expected result

image

Actual result

you have to manually set the frame-ancestors

Documentation Changes Required

This new option has to be documented here: https://docs.joomla.org/J4.x:Http_Header_Management. Will do this after the merge.

avatar zero-24 zero-24 - open - 24 Feb 2020
avatar zero-24 zero-24 - change - 24 Feb 2020
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 24 Feb 2020
Category ⇒ Administration com_csp Language & Strings Front End Plugins
avatar blueforce
blueforce - comment - 29 Feb 2020

Just one thing:

Steps to reproduce:

  1. set the CSP Mode to custom
  2. add directive
  3. add 2nd directive
  4. try delete all direvtives...

Expect result: all directives are deleted
Actual result: I can delete all, until one directive (first) still remain. I can't delete it.

Bildschirmfoto 2020-02-29 um 16 52 49

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28066.
avatar blueforce blueforce - test_item - 29 Feb 2020 - Tested unsuccessfully
avatar zero-24
zero-24 - comment - 29 Feb 2020

@blueforce This seams to be a limitation of the subform field. As you can see by testing before the patch the same issue is there before this patch. When this is the only issue please mark your test here than successful and open an new issue so someone with JS skills can take a look into the subform issue. Thanks!

avatar blueforce
blueforce - comment - 1 Mar 2020

I have tested this item ✅ successfully on 13301a2

New Bug reported #28171

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28066.
avatar blueforce blueforce - test_item - 1 Mar 2020 - Tested successfully
avatar jwaisner
jwaisner - comment - 2 Mar 2020

I have tested this item ✅ successfully on 13301a2

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28066.

avatar jwaisner
jwaisner - comment - 2 Mar 2020

I have tested this item ✅ successfully on 13301a2

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28066.

avatar jwaisner jwaisner - test_item - 2 Mar 2020 - Tested successfully
avatar jwaisner jwaisner - change - 2 Mar 2020
Status Pending ⇒ Ready to Commit
avatar jwaisner
jwaisner - comment - 2 Mar 2020

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28066.

avatar wilsonge wilsonge - change - 3 Mar 2020
Status Ready to Commit ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2020-03-03 11:02:06
Closed_By ⇒ wilsonge
Labels Added: ? ? ?
avatar wilsonge wilsonge - close - 3 Mar 2020
avatar wilsonge wilsonge - merge - 3 Mar 2020
avatar wilsonge
wilsonge - comment - 3 Mar 2020

Thanks!

Add a Comment

Login with GitHub to post a comment