10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-06-05 15:09:37 +09:00
Code Issues Packages Projects Releases Wiki Activity

- implemented safeguards against clickjacking attacks

Browse Source
This commit is contained in:
yuriinalivaiko
2023-12-08 14:48:27 +02:00
parent efe6af6e06
commit 382ae24c73
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-access.php
+18
View File
@@ -76,6 +76,7 @@ if ( ! class_exists( 'um\core\Access' ) ) {
// check the site's accessible more priority have Individual Post/Term Restriction settings
add_action( 'template_redirect', array( &$this, 'template_redirect' ), 1000 );
add_action( 'template_redirect', array( &$this, 'send_frame_options_header' ), 1010 );
add_action( 'um_access_check_blog_page_settings', array( &$this, 'um_access_check_blog_page_settings' ) );
add_action( 'um_access_check_individual_term_settings', array( &$this, 'um_access_check_individual_term_settings' ) );
add_action( 'um_access_check_global_settings', array( &$this, 'um_access_check_global_settings' ) );
@@ -1795,6 +1796,23 @@ if ( ! class_exists( 'um\core\Access' ) ) {
}
/**
* Sends a HTTP header to limit rendering of pages to same origin iframes when loading sensitive pages.
*
* Can be disabled with: remove_action( 'template_redirect', array( UM()->access(), 'send_frame_options_header' ), 1010 );
*
* @since 2.8.0
*/
public function send_frame_options_header() {
if ( um_is_core_page( 'account' )
|| um_is_core_page( 'login' )
|| um_is_core_page( 'password-reset' )
|| um_is_core_page( 'register' ) ) {
send_frame_options_header();
}
}
/**
* Sets a custom access referer in a redirect URL
*