frame-ancestors CSP (#7677)

4 files changed, 5 insertions, 1 deletions

diff --git a/app/Controllers/feedController.php b/app/Controllers/feedController.php
index 9769a6df0..35b209a4d 100755
--- a/app/Controllers/feedController.php
+++ b/app/Controllers/feedController.php
@@ -1150,6 +1150,7 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController {
 
 		$this->_csp([
 			'default-src' => "'self'",
+			'frame-ancestors' => "'self'",
 			'frame-src' => '*',
 			'img-src' => '* data:',
 			'media-src' => '*',
diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php
index 1f49e03ee..661e8300b 100644
--- a/app/Controllers/indexController.php
+++ b/app/Controllers/indexController.php
@@ -50,6 +50,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 			'default-src' => "'self'",
 			'frame-src' => '*',
 			'img-src' => '* data:',
+			'frame-ancestors' => "'none'",
 			'media-src' => '*',
 		]);
 
@@ -138,6 +139,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 			'default-src' => "'self'",
 			'frame-src' => '*',
 			'img-src' => '* data:',
+			'frame-ancestors' => "'none'",
 			'media-src' => '*',
 		]);
 	}
diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php
index 7a7180176..8759eae9d 100644
--- a/app/Controllers/statsController.php
+++ b/app/Controllers/statsController.php
@@ -29,6 +29,7 @@ class FreshRSS_stats_Controller extends FreshRSS_ActionController {
 
 		$this->_csp([
 			'default-src' => "'self'",
+			'frame-ancestors' => "'none'",
 			'img-src' => '* data:',
 			'style-src' => "'self' 'unsafe-inline'",
 		]);
diff --git a/app/install.php b/app/install.php
index 3d835d1f1..0e408db52 100644
--- a/app/install.php
+++ b/app/install.php
@@ -4,7 +4,7 @@ declare(strict_types=1);
 if (function_exists('opcache_reset')) {
 	opcache_reset();
 }
-header("Content-Security-Policy: default-src 'self'");
+header("Content-Security-Policy: default-src 'self'; frame-ancestors 'none'");
 header('Referrer-Policy: same-origin');
 
 require(LIB_PATH . '/lib_install.php');