From f9e4915d756ef4cc929cf0f31fd373f9e527ab7b Mon Sep 17 00:00:00 2001
From: Frédéric Guillot <fred@kanboard.net>
Date: Tue, 7 Oct 2014 19:35:02 -0400
Subject: Allow public board iframe inclusion (see #309)

---
 app/Controller/Base.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'app/Controller')

diff --git a/app/Controller/Base.php b/app/Controller/Base.php
index f24ea8ff..aabb1775 100644
--- a/app/Controller/Base.php
+++ b/app/Controller/Base.php
@@ -116,7 +116,11 @@ abstract class Base
         $this->response->csp(array('style-src' => "'self' 'unsafe-inline'"));
         $this->response->nosniff();
         $this->response->xss();
-        $this->response->xframe();
+
+        // Allow the public board iframe inclusion
+        if ($action !== 'readonly') {
+            $this->response->xframe();
+        }
 
         if (ENABLE_HSTS) {
             $this->response->hsts();
-- 
cgit v1.2.3