configuration option to bust frames or not

diff --git a/README b/README
index c27182395c2d11adedccf76e86ac4e05fbf9db57..58ebd290b0e87eee71f7cfdc1569c4de6c35b0df 100644 (file)
--- a/README
+++ b/README
@@ -1139,6 +1139,9 @@ ssl: Whether to use SSL for JavaScript files. Default is null, which means
 sslserver: SSL server to use when page is HTTPS-encrypted. If
     unspecified, site ssl server and so on will be used.
 sslpath: If sslserver if defined, path to use when page is HTTPS-encrypted.
+bustframes: If true, all web pages will break out of framesets. If false,
+           can comfortably live in a frame or iframe... probably. Default
+           to true.
 
 xmpp
 ----

diff --git a/lib/action.php b/lib/action.php
index 173e2c2a5877491d690fc8813e6e00c05fed9956..fef425926436e58d64a3dcda0f973e1f5ab29775 100644 (file)
--- a/lib/action.php
+++ b/lib/action.php
@@ -298,7 +298,9 @@ class Action extends HTMLOutputter // lawsuit
                 $this->script('util.min.js');
                 $this->showScriptMessages();
                 // Frame-busting code to avoid clickjacking attacks.
-                $this->inlineScript('if (window.top !== window.self) { window.top.location.href = window.self.location.href; }');
+                if (common_config('javascript', 'bustframes')) {
+                    $this->inlineScript('if (window.top !== window.self) { window.top.location.href = window.self.location.href; }');
+                }
                 Event::handle('EndShowStatusNetScripts', array($this));
                 Event::handle('EndShowLaconicaScripts', array($this));
             }

diff --git a/lib/default.php b/lib/default.php
index 124c90c9983df0a2a9668869030861348c7354a9..c1dfcbc87d073d762af4950420cdc35b3212b022 100644 (file)
--- a/lib/default.php
+++ b/lib/default.php
@@ -154,7 +154,8 @@ $default =
         'javascript' =>
         array('server' => null,
               'path'=> null,
-              'ssl' => null),
+              'ssl' => null,
+              'bustframes' => true),
         'local' => // To override path/server for themes in 'local' dir (not currently applied to local plugins)
         array('server' => null,
               'dir' => null,