Dropped configuration directive: AllowThirdPartyFraming

ChangeLog

@@ -49,10 +49,11 @@ VerboseMultiSubmit, ReplaceHelpImg
 - bug #3577443 [edit] "Browse foreign values" does not show on ajax edit
 + rfe #3522109 [browse] Grid editing: action to trigger it (or disable)
 - bug #3526598 [interface] SQL query not shown when creating table
++ Dropped configuration directive: AllowThirdPartyFraming
 
 3.5.4.0 (not yet released)
 - bug #3570212 [edit] uuid_short() is a no-arguments function
-- bug #3569577 [edit] Add routine parameter headers not valid for "function" 
+- bug #3569577 [edit] Add routine parameter headers not valid for "function"
 - bug #3575799 [search] Various search operators not working as expected
 - bug #3576322 [search] Invalid select query generated for tables with ENUM fields
 - bug #3577468 [display] Incorrect imagejpeg Syntax Breaks Image Transformation
@@ -79,7 +80,7 @@ VerboseMultiSubmit, ReplaceHelpImg
 - bug #3559955 [edit] current_date from function drop down fails on update
 - bug #3562472 add support for Solaris and FreeBSD system load and memory display in server status
 - bug #3553068 [import] Table import from XML file fails
-- replace Highcharts with jqplot for Display chart 
+- replace Highcharts with jqplot for Display chart
 - bug #3567684 [edit] Pasting value doesn't clear null checkbox
 - bug #3570786 [edit] Datepicker for date and datetime fields is broken
 

Documentation.html

@@ -633,11 +633,6 @@ since this link provides funding for phpMyAdmin.
     <dt id="cfg_TranslationWarningThreshold">$cfg['TranslationWarningThreshold'] integer</dt>
     <dd>Show warning about incomplete translations on certain threshold.</dd>
 
-    <dt id="cfg_AllowThirdPartyFraming">$cfg['AllowThirdPartyFraming'] boolean</dt>
-    <dd>Setting this to <code>true</code> allows a page located on a different
-    domain to call phpMyAdmin inside a frame, and is a potential security
-    hole allowing cross-frame scripting attacks.</dd>
-
     <dt id="cfg_blowfish_secret">$cfg['blowfish_secret'] string</dt>
     <dd>The &quot;cookie&quot; auth_type uses blowfish
         algorithm to encrypt the password.<br />

js/cross_framing_protection.js

@@ -1,18 +0,0 @@
-/* vim: set expandtab sw=4 ts=4 sts=4: */
-/**
- * Conditionally included if third-party framing is not allowed
- *
- */
-
-try {
-    // can't access this if on a different domain
-    var topdomain = top.document.domain;
-    // double-check just for sure
-    if (topdomain != self.document.domain) {
-        alert("Redirecting...");
-        top.location.replace(self.document.URL.substring(0, self.document.URL.lastIndexOf("/")+1));
-    }
-} catch(e) {
-    alert("Redirecting... (error: " + e);
-    top.location.replace(self.document.URL.substring(0, self.document.URL.lastIndexOf("/")+1));
-}

libraries/Header.class.php

@@ -158,11 +158,6 @@ class PMA_Header
             $this->_scripts->addFile('codemirror/mode/mysql/mysql.js');
         }
 
-        // Cross-framing protection
-        if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
-            $this->_scripts->addFile('cross_framing_protection.js');
-        }
-
         $this->_scripts->addFile('rte.js');
 
         // Localised strings
@@ -373,15 +368,11 @@ class PMA_Header
          * Sends http headers
          */
         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
-        /* Prevent against ClickJacking by allowing frames only from same origin */
-        if (! $GLOBALS['cfg']['AllowThirdPartyFraming'] && ! defined('TESTSUITE')) {
-            header(
-                'X-Frame-Options: SAMEORIGIN'
-            );
+        if (! defined('TESTSUITE')) {
             header(
                 "X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; "
                 . "options inline-script eval-script; "
-                . "frame-ancestors 'self'; img-src 'self' data:; "
+                . "img-src 'self' data:; "
             );
             header(
                 "X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; "

libraries/Scripts.class.php

@@ -127,7 +127,6 @@ class PMA_Scripts
             || strpos($filename, 'ajax.js') !== false
             || strpos($filename, 'navigation.js') !== false
             || strpos($filename, 'get_image.js.php') !== false
-            || strpos($filename, 'cross_framing_protection.js') !== false
         ) {
             return 0;
         } else {

libraries/config.default.php

@@ -76,14 +76,6 @@ $cfg['ServerLibraryDifference_DisableWarning'] = false;
  */
 $cfg['TranslationWarningThreshold'] = 80;
 
-/**
- * Allows phpMyAdmin to be included from a document located on
- * another domain; setting this to true is a potential security hole
- *
- * @global boolean $cfg['AllowThirdPartyFraming']
- */
-$cfg['AllowThirdPartyFraming'] = false;
-
 /**
  * The 'cookie' auth_type uses blowfish algorithm to encrypt the password. If
  * at least one server configuration uses 'cookie' auth_type, enter here a

libraries/config/messages.inc.php

@@ -18,8 +18,6 @@ $strConfigAjaxEnable_desc = __('Improves efficiency of screen refresh');
 $strConfigAjaxEnable_name = __('Enable Ajax');
 $strConfigAllowArbitraryServer_desc = __('If enabled user can enter any MySQL server in login form for cookie auth');
 $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server');
-$strConfigAllowThirdPartyFraming_desc = __('Enabling this allows a page located on a different domain to call phpMyAdmin inside a frame, and is a potential [strong]security hole[/strong] allowing cross-frame scripting attacks');
-$strConfigAllowThirdPartyFraming_name = __('Allow third party framing');
 $strConfigAllowUserDropDatabase_name = __('Show "Drop database" link to normal users');
 $strConfigblowfish_secret_desc = __('Secret passphrase used for encrypting cookies in [kbd]cookie[/kbd] authentication');
 $strConfigblowfish_secret_name = __('Blowfish secret');

libraries/config/setup.forms.php

@@ -137,8 +137,7 @@ $forms['Features']['Other_core_settings'] = array(
     'MemoryLimit',
     'SkipLockedTables',
     'DisableMultiTableMaintenance',
-    'UseDbSearch',
-    'AllowThirdPartyFraming');
+    'UseDbSearch');
 $forms['Sql_queries']['Sql_queries'] = array(
     'ShowSQL',
     'Confirm',