From 1a7d664714b8d8e7f92e07f02fe3a8fc966c0c98 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@kylehall.info>
Date: Fri, 28 Apr 2017 12:20:06 +0000
Subject: [PATCH] Bug 17942 - Add anti-clickjack code to installer doc head
 close
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
---
 .../prog/en/includes/installer-doc-head-close.inc      | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc
index 797db5ecc4..16de754256 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc
@@ -11,4 +11,14 @@
 <script type="text/javascript" src="[% interface %]/lib/jquery/plugins/jquery.validate.min.js"></script>
 <script type="text/javascript">
     function _(s) { return s } // dummy function for gettext
+    [%# Prevent XFS attacks -%]
+    $(document).ready(function() {
+       if (self === top) {
+           var antiClickjack = document.getElementById("antiClickjack");
+           antiClickjack.parentNode.removeChild(antiClickjack);
+       } else {
+           top.location = self.location;
+       }
+    });
 </script>
+<style id="antiClickjack">body{display:none !important;}</style>
-- 
2.39.5