Skip to content

bugzilla
bugzilla
Commit 067e958d authored by Max Kanat-Alexander's avatar Max Kanat-Alexander
Browse files
Options

Bug 607138: Don't send the Strict-Transport-Security header for the

attachment_base. r=LpSolit, a=LpSolit
parent 6fac08b9
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 2 deletions
Bugzilla/CGI.pm
View file @ 067e958d
......@@ -275,9 +275,13 @@ sub header {
# Add Strict-Transport-Security (STS) header if this response
# is over SSL and the strict_transport_security param is turned on.
if ($self->https && Bugzilla->params->{'strict_transport_security'} ne 'off') {
if ($self->https && !$self->url_is_attachment_base
&& Bugzilla->params->{'strict_transport_security'} ne 'off')
{
my $sts_opts = 'max-age=' . MAX_STS_AGE;
if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
if (Bugzilla->params->{'strict_transport_security'}
eq 'include_subdomains')
{
$sts_opts .= '; includeSubDomains';
}
unshift(@_, '-strict_transport_security' => $sts_opts);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment