Support

Admin Tools

#25436 Allow Iframes from specific domains HTTP_REFERRERs

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Friday, 22 July 2016 17:20 CDT

Wednesday, 22 June 2016 11:00 CDT

machadoug
Greetings,

I need to add an exception to clickjacking protection, so it will allow iframes from another domains I own.

Thanks in advanced for your help.

Douglas

Douglas Machado

 

Wednesday, 22 June 2016 11:56 CDT

nicholas
You have to turn off that option and enter a custom rule in the "Custom .htaccess rules at the bottom of the file" section of the .htaccess Maker. The custom rule is per OWASP's advice:
<IfModule mod_headers.c>

	Header always append X-Frame-Options ALLOW-FROM http://www.example.com

	# The `X-Frame-Options` response header should be send only for
	# HTML documents and not for the other resources.

	<FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|woff2?|xloc|xml|xpi)$">
		Header unset X-Frame-Options
	</FilesMatch>

</IfModule>

where www.example.com is the URL you want to allow.

HOWEVER!! Chrome is buggy and does not respect the ALLOW-FROM and will block frames anyway. Since Chrome is about 50% of Internet users out there you are, unfortunately, obliged to simply turn off this feature :(

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 22 July 2016 17:20 CDT

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
Edited by on 2016-07-22 17:20 CDT

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!