closes #1616

11 years ago · aafbb55572
parent ee1e869ccb
commit aafbb55572
1 changed files with 6 additions and 1 deletions
--- a/src/middleware/index.js
+++ b/src/middleware/index.js
@ -214,8 +214,13 @@ module.exports = function(app, data) {

 		app.use(function (req, res, next) {
 			res.locals.csrf_token = req.session._csrf;
-			res.setHeader('X-Frame-Options', 'SAMEORIGIN');
 			res.setHeader('X-Powered-By', 'NodeBB');
+
+			res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+			if (meta.config['allow-from-uri']) {
+				res.setHeader('ALLOW-FROM', meta.config['allow-from-uri']);
+			}
+
 			next();
 		});