New panel.frameAncestors option

getkirby · Aug 9, 2023 · cd04488 · cd04488
1 parent b9ac70d
commit cd04488
Show file tree

Hide file tree

Showing 2 changed files with 102 additions and 1 deletion.
diff --git a/src/Cms/Panel.php b/src/Cms/Panel.php
@@ -134,8 +134,19 @@ public static function render(App $kirby)
             ]
         ]);
 
+        $frameAncestorsOption = $kirby->option('panel.frameAncestors');
+        if ($frameAncestorsOption === true) {
+            $frameAncestors = "'self'";
+        } elseif (is_array($frameAncestorsOption)) {
+            $frameAncestors = "'self' " . implode(' ', $frameAncestorsOption);
+        } elseif (is_string($frameAncestorsOption)) {
+            $frameAncestors = $frameAncestorsOption;
+        } else {
+            $frameAncestors = "'none'";
+        }
+
         return new Response($view->render(), 'text/html', 200, [
-            'Content-Security-Policy' => "frame-ancestors 'none'"
+            'Content-Security-Policy' => 'frame-ancestors ' . $frameAncestors
         ]);
     }
 }
diff --git a/tests/Cms/Panel/PanelTest.php b/tests/Cms/Panel/PanelTest.php
@@ -6,6 +6,9 @@
 use Kirby\Toolkit\F;
 use PHPUnit\Framework\TestCase;
 
+/**
+ * @coversDefaultClass \Kirby\Cms\Panel
+ */
 class PanelTest extends TestCase
 {
     protected $app;
@@ -90,4 +93,91 @@ public function testRender(): void
         // clear session file
         $this->app->session()->destroy();
     }
+
+    /**
+     * @covers ::render
+     */
+    public function testResponseFrameAncestorsSelf(): void
+    {
+        $this->app = $this->app->clone([
+            'options' => [
+                'panel' => [
+                    'frameAncestors' => true
+                ]
+            ]
+        ]);
+
+        // create panel dist files first to avoid redirect
+        Panel::link($this->app);
+
+        // get panel response
+        $response = Panel::render($this->app);
+
+        $this->assertInstanceOf(Response::class, $response);
+        $this->assertSame(200, $response->code());
+        $this->assertSame('text/html', $response->type());
+        $this->assertSame('UTF-8', $response->charset());
+        $this->assertSame("frame-ancestors 'self'", $response->header('Content-Security-Policy'));
+        $this->assertNotNull($response->body());
+    }
+
+    /**
+     * @covers ::render
+     */
+    public function testResponseFrameAncestorsArray(): void
+    {
+        $this->app = $this->app->clone([
+            'options' => [
+                'panel' => [
+                    'frameAncestors' => ['*.example.com', 'https://example.com']
+                ]
+            ]
+        ]);
+
+        // create panel dist files first to avoid redirect
+        Panel::link($this->app);
+
+        // get panel response
+        $response = Panel::render($this->app);
+
+        $this->assertInstanceOf(Response::class, $response);
+        $this->assertSame(200, $response->code());
+        $this->assertSame('text/html', $response->type());
+        $this->assertSame('UTF-8', $response->charset());
+        $this->assertSame(
+            "frame-ancestors 'self' *.example.com https://example.com",
+            $response->header('Content-Security-Policy')
+        );
+        $this->assertNotNull($response->body());
+    }
+
+    /**
+     * @covers ::render
+     */
+    public function testResponseFrameAncestorsString(): void
+    {
+        $this->app = $this->app->clone([
+            'options' => [
+                'panel' => [
+                    'frameAncestors' => '*.example.com https://example.com'
+                ]
+            ]
+        ]);
+
+        // create panel dist files first to avoid redirect
+        Panel::link($this->app);
+
+        // get panel response
+        $response = Panel::render($this->app);
+
+        $this->assertInstanceOf(Response::class, $response);
+        $this->assertSame(200, $response->code());
+        $this->assertSame('text/html', $response->type());
+        $this->assertSame('UTF-8', $response->charset());
+        $this->assertSame(
+            'frame-ancestors *.example.com https://example.com',
+            $response->header('Content-Security-Policy')
+        );
+        $this->assertNotNull($response->body());
+    }
 }