From 2eff53b2bbc19f899f206ccaf1cbf3d6acb6f57b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Fri, 10 Dec 2021 07:17:13 +0100 Subject: [PATCH] Allow qr code iframe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- advanced/lighttpd.conf.debian | 6 ++++-- advanced/lighttpd.conf.fedora | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/advanced/lighttpd.conf.debian b/advanced/lighttpd.conf.debian index 8966dc32..37099ad7 100644 --- a/advanced/lighttpd.conf.debian +++ b/advanced/lighttpd.conf.debian @@ -93,8 +93,10 @@ $HTTP["url"] =~ "/teleporter\.php$" { } # allow API qr code iframe on settings page -$HTTP["url"] =~ "/admin/settings\.php$" { - setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" ) +$HTTP["url"] =~ "/api_token\.php$" { + $HTTP["referer"] =~ "/admin/settings\.php" { + setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" ) + } } # Default expire header diff --git a/advanced/lighttpd.conf.fedora b/advanced/lighttpd.conf.fedora index 6bf9e683..f4916422 100644 --- a/advanced/lighttpd.conf.fedora +++ b/advanced/lighttpd.conf.fedora @@ -101,8 +101,10 @@ $HTTP["url"] =~ "/teleporter\.php$" { } # allow API qr code iframe on settings page -$HTTP["url"] =~ "/admin/settings\.php$" { - setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" ) +$HTTP["url"] =~ "/api_token\.php$" { + $HTTP["referer"] =~ "/admin/settings\.php" { + setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" ) + } } # Default expire header