Merge pull request #429 from dionyziz/x_frame_options

X-Frame-Options: DENY. Fix #428
Macarse · Sep 5, 2014 · b72358d · b72358d
2 parents 7093cf9 + 05fdf1e
commit b72358d
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/node/tornadoloop.py b/node/tornadoloop.py
@@ -23,6 +23,11 @@ def get(self):
         self.redirect("/html/index.html")
 
 
+class OpenBazaarStaticHandler(tornado.web.StaticFileHandler):
+    def set_extra_headers(self, path):
+        self.set_header("X-Frame-Options", "DENY")
+
+
 class MarketApplication(tornado.web.Application):
     def __init__(self, market_ip, market_port, market_id=1,
                  bm_user=None, bm_pass=None, bm_port=None, seed_peers=[],
@@ -54,7 +59,7 @@ def post_joined():
         handlers = [
             (r"/", MainHandler),
             (r"/main", MainHandler),
-            (r"/html/(.*)", tornado.web.StaticFileHandler, {'path': './html'}),
+            (r"/html/(.*)", OpenBazaarStaticHandler, {'path': './html'}),
             (r"/ws", WebSocketHandler,
                 dict(transport=self.transport, market=self.market, db=db))
         ]