webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 23:12:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apache: prevent Referrer leaks via WebUI

Browse Source 
By default, even modern browsers sent the URL of ther originating
site to another one when accessing hyperlinks. This is an information
leak and may expose internal details (such as FQDN or IP address)
of an IPFire installation to a third party.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
peter.mueller@ipfire.org
2019-11-04 18:52:00 +00:00
committed by Arne Fitzenreiter
parent 1141bc69c9
commit 583687a88d
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/httpd/vhosts.d/ipfire-interface-ssl.conf
View File

@@ -22,6 +22,7 @@
Header always set X-Content-Type-Options nosniff
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
Header always set Referrer-Policy strict-origin
<Directory /srv/web/ipfire/html>
Options ExecCGI

1
config/httpd/vhosts.d/ipfire-interface.conf
View File

@@ -8,6 +8,7 @@
Header always set X-Content-Type-Options nosniff
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
Header always set Referrer-Policy strict-origin
<Directory /srv/web/ipfire/html>
Options ExecCGI