* adjust for X-Frame-Options.

config/config.php

@@ -115,7 +115,8 @@ $config->framework->detectDevice['fr']    = true; // 在en语言情况下，是
 $config->framework->detectDevice['vi']    = true; // 在en语言情况下，是否启用设备检测功能。    Whether enable device detect or not.
 
 /* IP white list settings.*/
-$config->ipWhiteList = '*';
+$config->ipWhiteList   = '*';
+$config->xFrameOptions = 'SAMEORIGIN';
 
 /* Switch for zentao features. */
 $config->features = new stdclass();

module/common/model.php

@@ -45,8 +45,9 @@ class commonModel extends model
     public function sendHeader()
     {
         header("Content-Type: text/html; Language={$this->config->charset}");
-        header("X-Frame-Options: SAMEORIGIN");
         header("Cache-control: private");
+
+        if(!empty($this->config->xFrameOptions)) header("X-Frame-Options: {$this->config->xFrameOptions}");
     }
 
     /**

www/.htaccess

@@ -30,10 +30,6 @@ php_value display_errors 1
 php_value max_input_vars 100000
 </IfModule>
 
-<IfModule mod_headers.c>
-Header always append X-Frame-Options SAMEORIGIN
-</IfModule>
-
 # yslow settings.
 <IfModule mod_expires.c>
 ExpiresActive On

www/.ztaccess

@@ -26,10 +26,6 @@ php_value display_errors 1
 php_value max_input_vars 100000
 </IfModule>
 
-<IfModule mod_headers.c>
-Header always append X-Frame-Options SAMEORIGIN
-</IfModule>
-
 # yslow settings.
 <IfModule mod_expires.c>
 ExpiresActive On