Merge branch 'master' of https://github.com/unacms/una

inc/classes/BxDolTemplate.php

@@ -3736,7 +3736,9 @@ class BxDolTemplate extends BxDolFactory implements iBxDolSingleton
         bx_alert('system', 'design_before_output', 0, 0, ['page' => &$this->aPage, 'page_content' => &$this->aPageContent]);
 
         header( 'Content-type: text/html; charset=utf-8' );
-        header( 'X-Frame-Options: sameorigin' );
+        $sXFrameOpts = getParam('sys_x_frame_options');
+        if ('Off' !== $sXFrameOpts)
+            header( 'X-Frame-Options: ' . $sXFrameOpts );
         if (BX_PAGE_EMBED == $oTemplate->getPageNameIndex())
             header('Content-Security-Policy: frame-ancestors ' . getParam('sys_csp_frame_ancestors'));
 

install/sql/system.sql

@@ -411,6 +411,7 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_curl_ssl_allow_untrusted', '_adm_stg_cpt_option_sys_ssl_allow_untrusted', '', 'checkbox', '', '', '', '', 145),
 
 (@iCategoryId, 'sys_csp_frame_ancestors', '_adm_stg_cpt_option_sys_csp_frame_ancestors', '*', 'digit', '', '', '', '', 150),
+(@iCategoryId, 'sys_x_frame_options', '_adm_stg_cpt_option_sys_x_frame_options', 'SAMEORIGIN', 'select', 'Off,SAMEORIGIN,DENY', '', '', '', 151),
 (@iCategoryId, 'sys_samesite_cookies', '_adm_stg_cpt_option_sys_samesite_cookies', 'Lax', 'select', 'None,Lax,Strict', '', '', '', 152),
 
 (@iCategoryId, 'sys_notify_to_approve_by_role', '_adm_stg_cpt_option_sys_notify_to_approve_by_role', '', 'checkbox', '', '', '', '', 160),