From 825b02fb83cb7ab2913bdaf94c8400787535f902 Mon Sep 17 00:00:00 2001
From: Sebastiaan Janssen <sebastiaan@umbraco.com>
Date: Fri, 24 Feb 2017 15:51:10 +0100
Subject: [PATCH] Disallow iframing

---
 OurUmbraco.Site/web.template.config | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/OurUmbraco.Site/web.template.config b/OurUmbraco.Site/web.template.config
index 44f322e5..b0b99364 100644
--- a/OurUmbraco.Site/web.template.config
+++ b/OurUmbraco.Site/web.template.config
@@ -419,6 +419,8 @@
       <customHeaders>
         <add name="P3P" value="policyref=&quot;http://our.umbraco.org/w3c/p3p.xml&quot;" />
         <remove name="X-Powered-By" />
+        <remove name="X-Frame-Options" />
+        <add name="X-Frame-Options" value="SAMEORIGIN" />
       </customHeaders>
     </httpProtocol>
 
@@ -661,4 +663,31 @@
       <urlCompression doStaticCompression="false" doDynamicCompression="false" dynamicCompressionBeforeCache="false" />
     </system.webServer>
   </location>
+  <location path="repo">
+    <system.webServer>
+      <httpProtocol>
+        <customHeaders>
+          <remove name="X-Frame-Options" />
+        </customHeaders>
+      </httpProtocol>
+    </system.webServer>
+  </location>
+  <location path="repo_category">
+    <system.webServer>
+      <httpProtocol>
+        <customHeaders>
+          <remove name="X-Frame-Options" />
+        </customHeaders>
+      </httpProtocol>
+    </system.webServer>
+  </location>
+  <location path="repo_viewproject">
+    <system.webServer>
+      <httpProtocol>
+        <customHeaders>
+          <remove name="X-Frame-Options" />
+        </customHeaders>
+      </httpProtocol>
+    </system.webServer>
+  </location>
 </configuration>
\ No newline at end of file