Support CDO.allowed_iframe_ancestors configuration to whitelist allowed domains - #5009
Merged
Conversation
|
Looks reasonable to me. I hadn't heard they replaced x-frame-options so this is a pleasant surprise. |
philbogle
added a commit
that referenced
this pull request
Nov 1, 2015
Support CDO.allowed_iframe_ancestors configuration to whitelist allowed domains
Contributor
Author
|
There is a better place to do this in lib/cdo/rack/upgrade_insecure_requests; will revert this change and do this there. |
deploy-code-org
added a commit
that referenced
this pull request
Nov 2, 2015
f4cecc7 Merge pull request #4994 from code-dot-org/level-15-instructions (Brad Buchanan) b14b8b1 Merge pull request #5015 from code-dot-org/revert-5009-iframe_domain_whitelist (philbogle) c928a7c Revert "Support CDO.allowed_iframe_ancestors configuration to whitelist allowed domains" (philbogle) 1e44018 Merge pull request #5009 from code-dot-org/iframe_domain_whitelist (philbogle) 7804029 Update environment.rb (philbogle) ebbc090 Set Content-Security-Policy to whitelist allowed domains (Phil Bogle) 3894748 Merge pull request #5008 from code-dot-org/dynamic-config-env (Trevor Berg)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR allows Code.org dashboard pages to be syndicated to a whitelisted set of syndication partners.
If the CDO.allowed_iframe_ancestors configuration variable is defined, the default SAMEORIGIN policy is replaced with one that allows iframing by the specified the specified source list plus 'self' (as described in http://w3c.github.io/webappsec-csp/#source-lists).