From 1f624bc5e2fc720b7f570b4b217860747ef5dc65 Mon Sep 17 00:00:00 2001 From: maTh <1645099+math-GH@users.noreply.github.com> Date: Tue, 1 Apr 2025 12:23:56 +0200 Subject: Referrer-Policy: same-origin (#6303) * Referrer-Policy: same-origin * same-origin for our own images --------- Co-authored-by: Alexandre Alapetite --- p/.htaccess | 1 + p/ext.php | 1 + 2 files changed, 2 insertions(+) (limited to 'p') diff --git a/p/.htaccess b/p/.htaccess index e7376e46e..8459fe604 100644 --- a/p/.htaccess +++ b/p/.htaccess @@ -41,6 +41,7 @@ AddDefaultCharset UTF-8 Header merge Cache-Control "public" Header edit Set-Cookie ^(.*)$ "$1; SameSite=Lax" + Header set Referrer-Policy "same-origin" # Provide the true IP address of the connection (e.g. last proxy), even when using mod_remoteip diff --git a/p/ext.php b/p/ext.php index 0a8c46546..b3007a4fd 100644 --- a/p/ext.php +++ b/p/ext.php @@ -112,6 +112,7 @@ if (!is_valid_path($absolute_filename)) { $content_type = SUPPORTED_TYPES[$file_type]; header("Content-Type: {$content_type}"); header("Content-Disposition: inline; filename='{$file_name}'"); +header('Referrer-Policy: same-origin'); $mtime = @filemtime($absolute_filename); if ($mtime === false) { -- cgit v1.2.3