diff options
author | Frédéric Buclin <LpSolit@gmail.com> | 2014-03-12 19:25:25 +0100 |
---|---|---|
committer | Frédéric Buclin <LpSolit@gmail.com> | 2014-03-12 19:25:25 +0100 |
commit | ca7b39aa66be9b4deea1ead8e6a788025759b80d (patch) | |
tree | 175449c1a84408cdd89c244c834d0f13f115358b /template/en/default/attachment/show-multiple.html.tmpl | |
parent | d51abfd7e3e1fcc3eea37e72ab0f49f3e28950a2 (diff) | |
download | bugzilla-ca7b39aa66be9b4deea1ead8e6a788025759b80d.tar.gz bugzilla-ca7b39aa66be9b4deea1ead8e6a788025759b80d.tar.xz |
Bug 728892: The attachment "Details" page is still vulnerable to Clickjacking with SVG or XHTML attachments
r/a=justdave
Diffstat (limited to 'template/en/default/attachment/show-multiple.html.tmpl')
-rw-r--r-- | template/en/default/attachment/show-multiple.html.tmpl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/template/en/default/attachment/show-multiple.html.tmpl b/template/en/default/attachment/show-multiple.html.tmpl index a7c266b3c..e2c95cb80 100644 --- a/template/en/default/attachment/show-multiple.html.tmpl +++ b/template/en/default/attachment/show-multiple.html.tmpl @@ -78,7 +78,7 @@ classes = 'viewall_frame' %] [% ELSE %] - <iframe src="attachment.cgi?id=[% a.id %]" class="viewall_frame"> + <iframe src="attachment.cgi?id=[% a.id %]" class="viewall_frame" sandbox> <b>You cannot view the attachment on this page because your browser does not support IFRAMEs. <a href="attachment.cgi?id=[% a.id %]">View the attachment on a separate page</a>.</b> </iframe> |