|
Smarty
WARNING: All discussion is moving to https://reddit.com/r/smarty, please go there! This forum will be closing soon. |
|
View previous topic :: View next topic |
Author |
Message |
jaze22 Smarty Rookie
Joined: 06 Jan 2010 Posts: 6
|
Posted: Thu Jun 07, 2018 3:06 pm Post subject: Anti Click Jacking |
|
|
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
How come this breaks the smarty template from working:
Best-for-now Legacy Browser Frame Breaking Script
One way to defend against clickjacking is to include a "frame-breaker" script in each page that should not be framed. The following methodology will prevent a webpage from being framed even in legacy browsers, that do not support the X-Frame-Options-Header.
In the document HEAD element, add the following:
First apply an ID to the style element itself:
Code: | <style id="antiClickjack">body{display:none !important;}</style> |
And then delete that style by its ID immediately after in the script:
Code: | <script type="text/javascript">
{literal}
if (self === top) {
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
} else {
top.location = self.location;
}
{/literal}
</script> |
|
|
Back to top |
|
AnrDaemon Administrator
Joined: 03 Dec 2012 Posts: 1785
|
Posted: Thu Jun 07, 2018 3:24 pm Post subject: |
|
|
Can you please explain the purpose of your post?
Everything you've posted exists in the documentation in a much cleaner and readable form. |
|
Back to top |
|
jaze22 Smarty Rookie
Joined: 06 Jan 2010 Posts: 6
|
Posted: Thu Jun 07, 2018 7:29 pm Post subject: |
|
|
My question is, if I place that code in a static web page for example page.html it works.
If I put that code in a smarty.tpl file, it breaks smarty template, you just see a blank page. |
|
Back to top |
|
AnrDaemon Administrator
Joined: 03 Dec 2012 Posts: 1785
|
|
Back to top |
|
bsmither Smarty Elite
Joined: 20 Dec 2011 Posts: 322 Location: West Coast
|
Posted: Fri Jun 08, 2018 5:46 pm Post subject: |
|
|
In this statement: Code: | <style id="antiClickjack">body{display:none !important;}</style> | you have unescaped braces. |
|
Back to top |
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|