Skip to content

Commit 5747b9b

Browse files
PytalPytal
authored
Merge pull request #31629 from nextcloud/feat/remove-ie-headers
2 parents b314a13 + ea0e45d commit 5747b9b

11 files changed

Lines changed: 0 additions & 39 deletions

File tree

‎.htaccess‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,6 @@
2424
Header onsuccess unset X-Content-Type-Options
2525
Header always set X-Content-Type-Options "nosniff"
2626

27-
Header onsuccess unset X-Download-Options
28-
Header always set X-Download-Options "noopen"
29-
3027
Header onsuccess unset X-Frame-Options
3128
Header always set X-Frame-Options "SAMEORIGIN"
3229

‎build/integration/features/carddav.feature‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ Feature: carddav
4444
|Content-Type|text/vcard; charset=utf-8|
4545
|Content-Security-Policy|default-src 'none';|
4646
|X-Content-Type-Options |nosniff|
47-
|X-Download-Options|noopen|
4847
|X-Frame-Options|SAMEORIGIN|
4948
|X-Permitted-Cross-Domain-Policies|none|
5049
|X-Robots-Tag|none|
@@ -59,7 +58,6 @@ Feature: carddav
5958
|Content-Type|image/jpeg|
6059
|Content-Security-Policy|default-src 'none';|
6160
|X-Content-Type-Options |nosniff|
62-
|X-Download-Options|noopen|
6361
|X-Frame-Options|SAMEORIGIN|
6462
|X-Permitted-Cross-Domain-Policies|none|
6563
|X-Robots-Tag|none|

‎build/integration/features/dav-v2.feature‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ Feature: dav-v2
2525
|Content-Disposition|attachment; filename*=UTF-8''welcome.txt; filename="welcome.txt"|
2626
|Content-Security-Policy|default-src 'none';|
2727
|X-Content-Type-Options |nosniff|
28-
|X-Download-Options|noopen|
2928
|X-Frame-Options|SAMEORIGIN|
3029
|X-Permitted-Cross-Domain-Policies|none|
3130
|X-Robots-Tag|none|

‎build/integration/features/webdav-related.feature‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,6 @@ Feature: webdav-related
249249
|Content-Disposition|attachment; filename*=UTF-8''welcome.txt; filename="welcome.txt"|
250250
|Content-Security-Policy|default-src 'none';|
251251
|X-Content-Type-Options |nosniff|
252-
|X-Download-Options|noopen|
253252
|X-Frame-Options|SAMEORIGIN|
254253
|X-Permitted-Cross-Domain-Policies|none|
255254
|X-Robots-Tag|none|

‎core/js/setupchecks.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,6 @@
658658
'X-Content-Type-Options': ['nosniff'],
659659
'X-Robots-Tag': ['none'],
660660
'X-Frame-Options': ['SAMEORIGIN', 'DENY'],
661-
'X-Download-Options': ['noopen'],
662661
'X-Permitted-Cross-Domain-Policies': ['none'],
663662
};
664663
for (var header in securityHeaders) {

‎core/js/tests/specs/setupchecksSpec.js‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1492,13 +1492,9 @@ describe('OC.SetupChecks tests', function() {
14921492
}, {
14931493
msg: 'The "X-Robots-Tag" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14941494
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
1495-
14961495
}, {
14971496
msg: 'The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14981497
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
1499-
}, {
1500-
msg: 'The "X-Download-Options" HTTP header is not set to "noopen". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1501-
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
15021498
}, {
15031499
msg: 'The "X-Permitted-Cross-Domain-Policies" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
15041500
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
@@ -1524,7 +1520,6 @@ describe('OC.SetupChecks tests', function() {
15241520
'X-Robots-Tag': 'none',
15251521
'X-Frame-Options': 'SAMEORIGIN',
15261522
'Strict-Transport-Security': 'max-age=15768000;preload',
1527-
'X-Download-Options': 'noopen',
15281523
'X-Permitted-Cross-Domain-Policies': 'none',
15291524
'Referrer-Policy': 'no-referrer',
15301525
}
@@ -1556,7 +1551,6 @@ describe('OC.SetupChecks tests', function() {
15561551
'X-Robots-Tag': 'none',
15571552
'X-Frame-Options': 'SAMEORIGIN',
15581553
'Strict-Transport-Security': 'max-age=15768000',
1559-
'X-Download-Options': 'noopen',
15601554
'X-Permitted-Cross-Domain-Policies': 'none',
15611555
'Referrer-Policy': 'no-referrer'
15621556
}
@@ -1579,7 +1573,6 @@ describe('OC.SetupChecks tests', function() {
15791573
'X-Content-Type-Options': 'nosniff',
15801574
'X-Robots-Tag': 'none',
15811575
'X-Frame-Options': 'SAMEORIGIN',
1582-
'X-Download-Options': 'noopen',
15831576
'X-Permitted-Cross-Domain-Policies': 'none',
15841577
'Referrer-Policy': 'no-referrer',
15851578
});
@@ -1600,7 +1593,6 @@ describe('OC.SetupChecks tests', function() {
16001593
'X-Content-Type-Options': 'nosniff',
16011594
'X-Robots-Tag': 'none',
16021595
'X-Frame-Options': 'SAMEORIGIN',
1603-
'X-Download-Options': 'noopen',
16041596
'X-Permitted-Cross-Domain-Policies': 'none',
16051597
'Referrer-Policy': 'no-referrer',
16061598
});
@@ -1621,7 +1613,6 @@ describe('OC.SetupChecks tests', function() {
16211613
'X-Content-Type-Options': 'nosniff',
16221614
'X-Robots-Tag': 'none',
16231615
'X-Frame-Options': 'SAMEORIGIN',
1624-
'X-Download-Options': 'noopen',
16251616
'X-Permitted-Cross-Domain-Policies': 'none',
16261617
'Referrer-Policy': 'no-referrer',
16271618
});
@@ -1647,7 +1638,6 @@ describe('OC.SetupChecks tests', function() {
16471638
'X-Content-Type-Options': 'nosniff',
16481639
'X-Robots-Tag': 'none',
16491640
'X-Frame-Options': 'SAMEORIGIN',
1650-
'X-Download-Options': 'noopen',
16511641
'X-Permitted-Cross-Domain-Policies': 'none',
16521642
'Referrer-Policy': 'no-referrer',
16531643
});
@@ -1675,7 +1665,6 @@ describe('OC.SetupChecks tests', function() {
16751665
'X-Content-Type-Options': 'nosniff',
16761666
'X-Robots-Tag': 'none',
16771667
'X-Frame-Options': 'SAMEORIGIN',
1678-
'X-Download-Options': 'noopen',
16791668
'X-Permitted-Cross-Domain-Policies': 'none',
16801669
'Referrer-Policy': 'no-referrer',
16811670
});
@@ -1696,7 +1685,6 @@ describe('OC.SetupChecks tests', function() {
16961685
'X-Content-Type-Options': 'nosniff',
16971686
'X-Robots-Tag': 'none',
16981687
'X-Frame-Options': 'SAMEORIGIN',
1699-
'X-Download-Options': 'noopen',
17001688
'X-Permitted-Cross-Domain-Policies': 'none',
17011689
'Referrer-Policy': 'no-referrer-when-downgrade',
17021690
});
@@ -1717,7 +1705,6 @@ describe('OC.SetupChecks tests', function() {
17171705
'X-Content-Type-Options': 'nosniff',
17181706
'X-Robots-Tag': 'none',
17191707
'X-Frame-Options': 'SAMEORIGIN',
1720-
'X-Download-Options': 'noopen',
17211708
'X-Permitted-Cross-Domain-Policies': 'none',
17221709
'Referrer-Policy': 'strict-origin',
17231710
});
@@ -1738,7 +1725,6 @@ describe('OC.SetupChecks tests', function() {
17381725
'X-Content-Type-Options': 'nosniff',
17391726
'X-Robots-Tag': 'none',
17401727
'X-Frame-Options': 'SAMEORIGIN',
1741-
'X-Download-Options': 'noopen',
17421728
'X-Permitted-Cross-Domain-Policies': 'none',
17431729
'Referrer-Policy': 'strict-origin-when-cross-origin',
17441730
});
@@ -1759,7 +1745,6 @@ describe('OC.SetupChecks tests', function() {
17591745
'X-Content-Type-Options': 'nosniff',
17601746
'X-Robots-Tag': 'none',
17611747
'X-Frame-Options': 'SAMEORIGIN',
1762-
'X-Download-Options': 'noopen',
17631748
'X-Permitted-Cross-Domain-Policies': 'none',
17641749
'Referrer-Policy': 'same-origin',
17651750
});
@@ -1780,7 +1765,6 @@ describe('OC.SetupChecks tests', function() {
17801765
'X-Content-Type-Options': 'nosniff',
17811766
'X-Robots-Tag': 'none',
17821767
'X-Frame-Options': 'SAMEORIGIN',
1783-
'X-Download-Options': 'noopen',
17841768
'X-Permitted-Cross-Domain-Policies': 'none',
17851769
'Referrer-Policy': 'origin',
17861770
});
@@ -1806,7 +1790,6 @@ describe('OC.SetupChecks tests', function() {
18061790
'X-Content-Type-Options': 'nosniff',
18071791
'X-Robots-Tag': 'none',
18081792
'X-Frame-Options': 'SAMEORIGIN',
1809-
'X-Download-Options': 'noopen',
18101793
'X-Permitted-Cross-Domain-Policies': 'none',
18111794
'Referrer-Policy': 'origin-when-cross-origin',
18121795
});
@@ -1832,7 +1815,6 @@ describe('OC.SetupChecks tests', function() {
18321815
'X-Content-Type-Options': 'nosniff',
18331816
'X-Robots-Tag': 'none',
18341817
'X-Frame-Options': 'SAMEORIGIN',
1835-
'X-Download-Options': 'noopen',
18361818
'X-Permitted-Cross-Domain-Policies': 'none',
18371819
'Referrer-Policy': 'unsafe-url',
18381820
});
@@ -1860,7 +1842,6 @@ describe('OC.SetupChecks tests', function() {
18601842
'X-Content-Type-Options': 'nosniff',
18611843
'X-Robots-Tag': 'none',
18621844
'X-Frame-Options': 'SAMEORIGIN',
1863-
'X-Download-Options': 'noopen',
18641845
'X-Permitted-Cross-Domain-Policies': 'none',
18651846
'Referrer-Policy': 'no-referrer',
18661847
}
@@ -1907,7 +1888,6 @@ describe('OC.SetupChecks tests', function() {
19071888
'X-Content-Type-Options': 'nosniff',
19081889
'X-Robots-Tag': 'none',
19091890
'X-Frame-Options': 'SAMEORIGIN',
1910-
'X-Download-Options': 'noopen',
19111891
'X-Permitted-Cross-Domain-Policies': 'none',
19121892
'Referrer-Policy': 'no-referrer',
19131893
}
@@ -1933,7 +1913,6 @@ describe('OC.SetupChecks tests', function() {
19331913
'X-Content-Type-Options': 'nosniff',
19341914
'X-Robots-Tag': 'none',
19351915
'X-Frame-Options': 'SAMEORIGIN',
1936-
'X-Download-Options': 'noopen',
19371916
'X-Permitted-Cross-Domain-Policies': 'none',
19381917
'Referrer-Policy': 'no-referrer',
19391918
}
@@ -1959,7 +1938,6 @@ describe('OC.SetupChecks tests', function() {
19591938
'X-Content-Type-Options': 'nosniff',
19601939
'X-Robots-Tag': 'none',
19611940
'X-Frame-Options': 'SAMEORIGIN',
1962-
'X-Download-Options': 'noopen',
19631941
'X-Permitted-Cross-Domain-Policies': 'none',
19641942
'Referrer-Policy': 'no-referrer',
19651943
}
@@ -1984,7 +1962,6 @@ describe('OC.SetupChecks tests', function() {
19841962
'X-Content-Type-Options': 'nosniff',
19851963
'X-Robots-Tag': 'none',
19861964
'X-Frame-Options': 'SAMEORIGIN',
1987-
'X-Download-Options': 'noopen',
19881965
'X-Permitted-Cross-Domain-Policies': 'none',
19891966
'Referrer-Policy': 'no-referrer',
19901967
});
@@ -2005,7 +1982,6 @@ describe('OC.SetupChecks tests', function() {
20051982
'X-Content-Type-Options': 'nosniff',
20061983
'X-Robots-Tag': 'none',
20071984
'X-Frame-Options': 'SAMEORIGIN',
2008-
'X-Download-Options': 'noopen',
20091985
'X-Permitted-Cross-Domain-Policies': 'none',
20101986
'Referrer-Policy': 'no-referrer',
20111987
});
@@ -2026,7 +2002,6 @@ describe('OC.SetupChecks tests', function() {
20262002
'X-Content-Type-Options': 'nosniff',
20272003
'X-Robots-Tag': 'none',
20282004
'X-Frame-Options': 'SAMEORIGIN',
2029-
'X-Download-Options': 'noopen',
20302005
'X-Permitted-Cross-Domain-Policies': 'none',
20312006
'Referrer-Policy': 'no-referrer',
20322007
});
@@ -2047,7 +2022,6 @@ describe('OC.SetupChecks tests', function() {
20472022
'X-Content-Type-Options': 'nosniff',
20482023
'X-Robots-Tag': 'none',
20492024
'X-Frame-Options': 'SAMEORIGIN',
2050-
'X-Download-Options': 'noopen',
20512025
'X-Permitted-Cross-Domain-Policies': 'none',
20522026
'Referrer-Policy': 'no-referrer',
20532027
});

‎core/templates/layout.base.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
<title>
66
<?php p($theme->getTitle()); ?>
77
</title>
8-
<meta http-equiv="X-UA-Compatible" content="IE=edge">
98
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
109
<meta name="theme-color" content="<?php p($theme->getColorPrimary()); ?>">
1110
<link rel="icon" href="<?php print_unescaped(image_path('', 'favicon.ico')); /* IE11+ supports png */ ?>">

‎core/templates/layout.guest.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
<title>
1010
<?php p($theme->getTitle()); ?>
1111
</title>
12-
<meta http-equiv="X-UA-Compatible" content="IE=edge">
1312
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
1413
<?php if ($theme->getiTunesAppId() !== '') { ?>
1514
<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">

‎core/templates/layout.public.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
p($theme->getTitle());
99
?>
1010
</title>
11-
<meta http-equiv="X-UA-Compatible" content="IE=edge">
1211
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
1312
<?php if ($theme->getiTunesAppId() !== '') { ?>
1413
<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">

‎core/templates/layout.user.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
p($theme->getTitle());
2323
?>
2424
</title>
25-
<meta http-equiv="X-UA-Compatible" content="IE=edge">
2625
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
2726
<?php if ($theme->getiTunesAppId() !== '') { ?>
2827
<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">

0 commit comments

Comments
 (0)