From 0b1450c5f99feae797113a70b90fabc725b6846c Mon Sep 17 00:00:00 2001
From: epriestley <epriestley@phabricator.com>
Date: Wed, 16 Feb 2011 22:17:05 -0800
Subject: [PATCH] Add framebusting to Phabricator.

Summary:
Technically we didn't have it in the first place, but should. Also
add in X-Frame-Options for double-plus-good.

Test Plan:
Created a page with Phabricator in an <iframe />, got busted out
of it. Added in the X-Frame-Options, got an empty iframe.

Differential Revision: 38
Reviewed By: tomo
Reviewers: mroch, tomo
---
 src/aphront/response/webpage/AphrontWebpageResponse.php | 3 ++-
 src/view/page/standard/PhabricatorStandardPageView.php  | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/aphront/response/webpage/AphrontWebpageResponse.php b/src/aphront/response/webpage/AphrontWebpageResponse.php
index 94e976a64c..c30ebdcad3 100644
--- a/src/aphront/response/webpage/AphrontWebpageResponse.php
+++ b/src/aphront/response/webpage/AphrontWebpageResponse.php
@@ -34,7 +34,8 @@ class AphrontWebpageResponse extends AphrontResponse {
 
   public function getHeaders() {
     return array(
-      array('Content-Type', 'text/html; charset=UTF-8'),
+      array('Content-Type',    'text/html; charset=UTF-8'),
+      array('X-Frame-Options', 'Deny'),
     );
   }
 
diff --git a/src/view/page/standard/PhabricatorStandardPageView.php b/src/view/page/standard/PhabricatorStandardPageView.php
index b6320fd7f9..660e09cc9b 100755
--- a/src/view/page/standard/PhabricatorStandardPageView.php
+++ b/src/view/page/standard/PhabricatorStandardPageView.php
@@ -98,8 +98,11 @@ class PhabricatorStandardPageView extends AphrontPageView {
   protected function getHead() {
     $response = CelerityAPI::getStaticResourceResponse();
     return
+      '<script type="text/javascript">'.
+        '(top != self) && top.location.replace(self.location.href);'.
+        'window.__DEV__=1;'.
+      '</script>'.
       $response->renderResourcesOfType('css').
-      '<script type="text/javascript">window.__DEV__=1;</script>'.
       '<script type="text/javascript" src="/rsrc/js/javelin/init.dev.js">'.
       '</script>';
   }