Readd AllowThirdPartyFraming option

We want by default no framing of phpMyAdmin, but still some sites might
need to embed it, so configuration option (with appropriate security
warning) is there.

This basically reverts d7e0bed284.

doc/config.rst

@@ -119,6 +119,15 @@ Basic settings
 
     Show warning about incomplete translations on certain threshold.
 
+.. config:option:: $cfg['AllowThirdPartyFraming']
+
+    :type: boolean
+    :default: false
+    
+    Setting this to ``true`` allows phpMyAdmin to be included inside a frame,
+    and is a potential security hole allowing cross-frame scripting attacks or
+    clickjacking.
+
 Server connection settings
 --------------------------
 

js/cross_framing_protection.js

@@ -0,0 +1,14 @@
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * Conditionally included if third-party framing is not allowed
+ *
+ */
+
+try {
+    if (top != self) {
+        top.location.href = self.location.href;
+    }
+} catch(e) {
+    alert("Redirecting... (error: " + e);
+    top.location.href = self.location.href;
+}

libraries/Header.class.php

@@ -158,6 +158,12 @@ class PMA_Header
         $this->_scripts->addFile('jquery/jquery.ba-hashchange-1.3.js');
         $this->_scripts->addFile('jquery/jquery.debounce-1.0.5.js');
         $this->_scripts->addFile('jquery/jquery.menuResizer-1.0.js');
+
+        // Cross-framing protection
+        if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
+            $this->_scripts->addFile('cross_framing_protection.js');
+        }
+
         $this->_scripts->addFile('rte.js');
 
         // Here would not be a good place to add CodeMirror because
@@ -449,6 +455,12 @@ class PMA_Header
          */
         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
         if (! defined('TESTSUITE')) {
+            /* Prevent against ClickJacking by disabling framing */
+            if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
+                header(
+                    'X-Frame-Options: DENY'
+                );
+            }
             header(
                 "X-Content-Security-Policy: default-src 'self' "
                 . $GLOBALS['cfg']['CSPAllow'] . ';'

libraries/Scripts.class.php

@@ -129,6 +129,7 @@ class PMA_Scripts
             || strpos($filename, 'ajax.js') !== false
             || strpos($filename, 'navigation.js') !== false
             || strpos($filename, 'get_image.js.php') !== false
+            || strpos($filename, 'cross_framing_protection.js') !== false
         ) {
             return 0;
         } else {

libraries/config.default.php

@@ -83,6 +83,14 @@ $cfg['ReservedWordDisableWarning'] = false;
  */
 $cfg['TranslationWarningThreshold'] = 80;
 
+/**
+ * Allows phpMyAdmin to be included from a other document in a frame;
+ * setting this to true is a potential security hole
+ *
+ * @global boolean $cfg['AllowThirdPartyFraming']
+ */
+$cfg['AllowThirdPartyFraming'] = false;
+
 /**
  * The 'cookie' auth_type uses blowfish algorithm to encrypt the password. If
  * at least one server configuration uses 'cookie' auth_type, enter here a

libraries/config/messages.inc.php

@@ -16,6 +16,8 @@ if (!function_exists('__')) {
 
 $strConfigAllowArbitraryServer_desc = __('If enabled user can enter any MySQL server in login form for cookie auth');
 $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server');
+$strConfigAllowThirdPartyFraming_desc = __('Enabling this allows a page located on a different domain to call phpMyAdmin inside a frame, and is a potential [strong]security hole[/strong] allowing cross-frame scripting attacks');
+$strConfigAllowThirdPartyFraming_name = __('Allow third party framing');
 $strConfigAllowUserDropDatabase_name = __('Show "Drop database" link to normal users');
 $strConfigblowfish_secret_desc = __('Secret passphrase used for encrypting cookies in [kbd]cookie[/kbd] authentication');
 $strConfigblowfish_secret_name = __('Blowfish secret');

libraries/config/setup.forms.php

@@ -136,7 +136,8 @@ $forms['Features']['Other_core_settings'] = array(
     'MemoryLimit',
     'SkipLockedTables',
     'DisableMultiTableMaintenance',
-    'UseDbSearch');
+    'UseDbSearch',
+    'AllowThirdPartyFraming');
 $forms['Sql_queries']['Sql_queries'] = array(
     'ShowSQL',
     'Confirm',