From f6196b803b7351da29f5d24958abbedf0df41a05 Mon Sep 17 00:00:00 2001
From: David Ostrovsky <david@ostrovsky.org>
Date: Fri, 26 Sep 2014 04:52:15 -0400
Subject: [PATCH] Extract authenticate method from CachingPublicKeyAuthenticator

---
 src/main/java/com/gitblit/wicket/pages/BasePage.java |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/src/main/java/com/gitblit/wicket/pages/BasePage.java b/src/main/java/com/gitblit/wicket/pages/BasePage.java
index 4971039..b454b7a 100644
--- a/src/main/java/com/gitblit/wicket/pages/BasePage.java
+++ b/src/main/java/com/gitblit/wicket/pages/BasePage.java
@@ -166,6 +166,9 @@
 			// use default Wicket caching behavior
 			super.setHeaders(response);
 		}
+
+		// XRF vulnerability. issue-500 / ticket-166
+		response.setHeader("X-Frame-Options", "SAMEORIGIN");
 	}
 
 	/**

--
Gitblit v1.9.1