Allow public board iframe inclusion (see #309)

1 files changed, 5 insertions, 1 deletions

diff --git a/app/Controller/Base.php b/app/Controller/Base.php
index f24ea8ff..aabb1775 100644
--- a/app/Controller/Base.php
+++ b/app/Controller/Base.php
@@ -116,7 +116,11 @@ abstract class Base
         $this->response->csp(array('style-src' => "'self' 'unsafe-inline'"));
         $this->response->nosniff();
         $this->response->xss();
-        $this->response->xframe();
+
+        // Allow the public board iframe inclusion
+        if ($action !== 'readonly') {
+            $this->response->xframe();
+        }
 
         if (ENABLE_HSTS) {
             $this->response->hsts();