From 2f27a57d01911436017f87bf08b9e36dcfaa86cc Mon Sep 17 00:00:00 2001 From: axfla <33458662+axfla@users.noreply.github.com> Date: Fri, 27 Jun 2025 23:27:35 +0200 Subject: [PATCH] Merge commit from fork --- src/confighttp.cpp | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/src/confighttp.cpp b/src/confighttp.cpp index 43d6df24..059b6242 100644 --- a/src/confighttp.cpp +++ b/src/confighttp.cpp @@ -81,7 +81,8 @@ namespace confighttp { void send_response(resp_https_t response, const nlohmann::json &output_tree) { SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "application/json"); - + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(output_tree.dump(), headers); } @@ -103,7 +104,9 @@ namespace confighttp { const SimpleWeb::CaseInsensitiveMultimap headers { {"Content-Type", "application/json"}, - {"WWW-Authenticate", R"(Basic realm="Sunshine Gamestream Host", charset="UTF-8")"} + {"WWW-Authenticate", R"(Basic realm="Sunshine Gamestream Host", charset="UTF-8")"}, + {"X-Frame-Options", "DENY"}, + {"Content-Security-Policy", "frame-ancestors 'none';"} }; response->write(code, tree.dump(), headers); @@ -119,7 +122,9 @@ namespace confighttp { auto address = net::addr_to_normalized_string(request->remote_endpoint().address()); BOOST_LOG(info) << "Web UI: ["sv << address << "] -- not authorized"sv; const SimpleWeb::CaseInsensitiveMultimap headers { - {"Location", path} + {"Location", path}, + {"X-Frame-Options", "DENY"}, + {"Content-Security-Policy", "frame-ancestors 'none';"} }; response->write(SimpleWeb::StatusCode::redirection_temporary_redirect, headers); } @@ -189,6 +194,8 @@ namespace confighttp { SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "application/json"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(code, tree.dump(), headers); } @@ -209,6 +216,8 @@ namespace confighttp { SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "application/json"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(code, tree.dump(), headers); } @@ -262,6 +271,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "index.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -280,6 +291,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "pin.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -298,6 +311,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "apps.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); headers.emplace("Access-Control-Allow-Origin", "https://images.igdb.com/"); response->write(content, headers); } @@ -317,6 +332,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "clients.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -335,6 +352,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "config.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -353,6 +372,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "password.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -370,6 +391,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "welcome.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -388,6 +411,8 @@ namespace confighttp { std::string content = file_handler::read_file(WEB_DIR "troubleshooting.html"); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/html; charset=utf-8"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(content, headers); } @@ -404,6 +429,8 @@ namespace confighttp { std::ifstream in(WEB_DIR "images/sunshine.ico", std::ios::binary); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "image/x-icon"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(SimpleWeb::StatusCode::success_ok, in, headers); } @@ -420,6 +447,8 @@ namespace confighttp { std::ifstream in(WEB_DIR "images/logo-sunshine-45.png", std::ios::binary); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "image/png"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(SimpleWeb::StatusCode::success_ok, in, headers); } @@ -471,6 +500,8 @@ namespace confighttp { // if it is, set the content type to the mime type SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", mimeType->second); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); std::ifstream in(filePath.string(), std::ios::binary); response->write(SimpleWeb::StatusCode::success_ok, in, headers); } @@ -971,6 +1002,8 @@ namespace confighttp { std::string content = file_handler::read_file(config::sunshine.log_file.c_str()); SimpleWeb::CaseInsensitiveMultimap headers; headers.emplace("Content-Type", "text/plain"); + headers.emplace("X-Frame-Options", "DENY"); + headers.emplace("Content-Security-Policy", "frame-ancestors 'none';"); response->write(SimpleWeb::StatusCode::success_ok, content, headers); }