From c892d4561aa1ac7f229f097b42c3a72b183c773a Mon Sep 17 00:00:00 2001
From: Bachir Soussi Chiadmi <bachir@figureslibres.io>
Date: Mon, 29 Apr 2019 13:09:22 +0200
Subject: [PATCH] changed nginx X-Frame-Option to SAMEORIGIN

---
 assets/vhosts/drupal-ssl.nginxconf        | 2 +-
 assets/vhosts/drupal.nginxconf            | 4 ++++
 assets/vhosts/simple-phpfpm-ssl.nginxconf | 4 ++++
 assets/vhosts/simple-phpfpm.nginxconf     | 4 ++++
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/assets/vhosts/drupal-ssl.nginxconf b/assets/vhosts/drupal-ssl.nginxconf
index 05a5b1f..fcbd1b9 100644
--- a/assets/vhosts/drupal-ssl.nginxconf
+++ b/assets/vhosts/drupal-ssl.nginxconf
@@ -136,5 +136,5 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options DENY;
+  add_header X-Frame-Options SAMEORIGIN;;
 }
diff --git a/assets/vhosts/drupal.nginxconf b/assets/vhosts/drupal.nginxconf
index c3314a0..19d2f32 100644
--- a/assets/vhosts/drupal.nginxconf
+++ b/assets/vhosts/drupal.nginxconf
@@ -110,4 +110,8 @@ server {
       expires max;
       log_not_found off;
     }
+
+    # website should not be displayed inside a <frame>, an <iframe> or an <object>
+    add_header X-Frame-Options SAMEORIGIN;;
+
 }
diff --git a/assets/vhosts/simple-phpfpm-ssl.nginxconf b/assets/vhosts/simple-phpfpm-ssl.nginxconf
index 8a53196..2092d21 100644
--- a/assets/vhosts/simple-phpfpm-ssl.nginxconf
+++ b/assets/vhosts/simple-phpfpm-ssl.nginxconf
@@ -59,4 +59,8 @@ server {
   location ~ /\.ht {
     deny all;
   }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;;
+
 }
diff --git a/assets/vhosts/simple-phpfpm.nginxconf b/assets/vhosts/simple-phpfpm.nginxconf
index 3a2b8d6..e20c02b 100644
--- a/assets/vhosts/simple-phpfpm.nginxconf
+++ b/assets/vhosts/simple-phpfpm.nginxconf
@@ -35,4 +35,8 @@ server {
   location ~ /\.ht {
     deny all;
   }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;;
+
 }