mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-07-30 17:49:43 +00:00
Vinícius Ferrão
9261a765bd
Add standard security response headers (X-Frame-Options, X-Content-Type- Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the /install and /tftpboot directories, mask the server banner with "ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from those file-serving directories. Indexes on /install/postscripts, /install/post and the doc directory are left intact so directory browsing still works where xCAT relies on it. The Header directives are wrapped in <IfModule mod_headers.c> so a server whose mod_headers is not loaded still starts cleanly instead of failing on an unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by default, the xCAT and xCATsn package postinst scripts run "a2enmod headers" before restarting Apache so the headers take effect there as well; on RHEL/SLES the module is loaded by default and needs no action. Recovered from the unmerged lenovobuild branch (originals7ee0c129,85c8bc09,d4d1783a), adapted: the deprecated X-XSS-Protection header and the mod_allowmethods-dependent AllowMethods directive are omitted, and the Header directives use "set" rather than "append". Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>