From 72672f8074c0a65918756ad89a8ecc2befc72cf0 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Fri, 18 Jan 2013 23:11:07 +0100
Subject: [PATCH] swat: Use X-Frame-Options header to avoid clickjacking

Jann Horn reported a potential clickjacking vulnerability in SWAT where
the SWAT page could be embedded into an attacker's page using a frame or
iframe and then used to trick the user to change Samba settings.

Avoid this by telling the browser to refuse the frame embedding via the
X-Frame-Options: DENY header.

Signed-off-by: Kai Blin <kai@samba.org>
---
 source3/web/swat.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

Index: squeeze/source3/web/swat.c
===================================================================
--- squeeze.orig/source3/web/swat.c
+++ squeeze/source3/web/swat.c
@@ -247,7 +247,8 @@
 	if (!cgi_waspost()) {
 		printf("Expires: 0\r\n");
 	}
-	printf("Content-type: text/html\r\n\r\n");
+	printf("Content-type: text/html\r\n");
+	printf("X-Frame-Options: DENY\r\n\r\n");
 
 	if (!include_html("include/header.html")) {
 		printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n");
