Ok - good point.  As long as it's hard to do something stupid then I'm on
board.  Good work :-)


On Fri, Apr 19, 2013 at 10:31 PM, shadlaws <notifications@github.com> wrote:

> In modules/gallery/classes/Gallery/Controller.php:
>
> > @@ -28,6 +28,9 @@
> >    public function before() {
> >      parent::before();
> >
> > +    // Restrict all response frames to the same origin for security
> > +    $this->response->headers("X-Frame-Options", "SAMEORIGIN");
>
> If they did, then Gallery::ready() also wouldn't be called (no theme, no
> user), logins would be bypassed from private gallery and/or maintenance
> mode restrictions... in other words, this would be really hard to do
> without noticing.
>
> IMHO, I feel like we're better off making a core that follows standards
> and sets a good precedent for contrib modules than making exceptions to
> catch really badly-written contrib modules that make the core less clean to
> follow. To the best of my understanding, using the before() function is the
> Kohana-sanctioned place to do security and auth related activities.
>
> https://github.com/kloopko/kohana-admin/blob/master/classes/controller/admin.php#L21
> http://kohanaframework.org/3.3/guide/kohana/mvc/controllers
>
> That said, there is another option we could use: we could put this in a
> Response class override of send_headers(), which adds the header before
> they're sent. This has the advantage of being impossible to override in
> anything except another Reponse class. I still feel slightly funny about
> not using before(), but would feel much better about this option than
> leaving it as an exception in index.php.
>
> Thoughts?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/gallery/gallery3/pull/301/files#r3884433>
> .
>