New panel.frameAncestors option

getkirby · Aug 8, 2023 · ff571a1 · ff571a1
1 parent 4672b84
commit ff571a1
Show file tree

Hide file tree

Showing 2 changed files with 102 additions and 1 deletion.
diff --git a/src/Panel/Document.php b/src/Panel/Document.php
@@ -270,8 +270,16 @@ public static function response(array $fiber): Response
 			'panelUrl' => $uri->path()->toString(true) . '/',
 		]);
 
+		$frameAncestors = $kirby->option('panel.frameAncestors');
+		$frameAncestors = match (true) {
+			$frameAncestors === true   => "'self'",
+			is_array($frameAncestors)  => "'self' " . implode(' ', $frameAncestors),
+			is_string($frameAncestors) => $frameAncestors,
+			default                    => "'none'"
+		};
+
 		return new Response($body, 'text/html', $code, [
-			'Content-Security-Policy' => "frame-ancestors 'none'"
+			'Content-Security-Policy' => 'frame-ancestors ' . $frameAncestors
 		]);
 	}
 }
diff --git a/tests/Panel/DocumentTest.php b/tests/Panel/DocumentTest.php
@@ -358,4 +358,97 @@ public function testResponse(): void
 		$this->assertSame("frame-ancestors 'none'", $response->header('Content-Security-Policy'));
 		$this->assertNotNull($response->body());
 	}
+
+	/**
+	 * @covers ::response
+	 */
+	public function testResponseFrameAncestorsSelf(): void
+	{
+		$this->app = $this->app->clone([
+			'options' => [
+				'panel' => [
+					'frameAncestors' => true
+				]
+			]
+		]);
+
+		// create panel dist files first to avoid redirect
+		Document::link($this->app);
+
+		// get panel response
+		$response = Document::response([
+			'test' => 'Test'
+		]);
+
+		$this->assertInstanceOf(Response::class, $response);
+		$this->assertSame(200, $response->code());
+		$this->assertSame('text/html', $response->type());
+		$this->assertSame('UTF-8', $response->charset());
+		$this->assertSame("frame-ancestors 'self'", $response->header('Content-Security-Policy'));
+		$this->assertNotNull($response->body());
+	}
+
+	/**
+	 * @covers ::response
+	 */
+	public function testResponseFrameAncestorsArray(): void
+	{
+		$this->app = $this->app->clone([
+			'options' => [
+				'panel' => [
+					'frameAncestors' => ['*.example.com', 'https://example.com']
+				]
+			]
+		]);
+
+		// create panel dist files first to avoid redirect
+		Document::link($this->app);
+
+		// get panel response
+		$response = Document::response([
+			'test' => 'Test'
+		]);
+
+		$this->assertInstanceOf(Response::class, $response);
+		$this->assertSame(200, $response->code());
+		$this->assertSame('text/html', $response->type());
+		$this->assertSame('UTF-8', $response->charset());
+		$this->assertSame(
+			"frame-ancestors 'self' *.example.com https://example.com",
+			$response->header('Content-Security-Policy')
+		);
+		$this->assertNotNull($response->body());
+	}
+
+	/**
+	 * @covers ::response
+	 */
+	public function testResponseFrameAncestorsString(): void
+	{
+		$this->app = $this->app->clone([
+			'options' => [
+				'panel' => [
+					'frameAncestors' => '*.example.com https://example.com'
+				]
+			]
+		]);
+
+		// create panel dist files first to avoid redirect
+		Document::link($this->app);
+
+		// get panel response
+		$response = Document::response([
+			'test' => 'Test'
+		]);
+
+		$this->assertInstanceOf(Response::class, $response);
+		$this->assertSame(200, $response->code());
+		$this->assertSame('text/html', $response->type());
+		$this->assertSame('UTF-8', $response->charset());
+		$this->assertSame(
+			'frame-ancestors *.example.com https://example.com',
+			$response->header('Content-Security-Policy')
+		);
+		$this->assertNotNull($response->body());
+	}
 }