Nextcloud in Iframe doesn't work

alecsamoila · May 26, 2017, 11:20am

Hello guys,

we instaled Nextcloud 11 and we want to see all shareable links (in special videos) in our internal site - IN IFRAME (we don’t know other solution)

We don’t need any security beacause it’s a small network without internet.

For Owncloud 9.1 we just comment this lines from .htaccess file

# Add security and privacy related headers **# Header set X-Content-Type-Options "nosniff"** Header set X-XSS-Protection "1; mode=block" Header set X-Robots-Tag "none" **# Header set X-Frame-Options "SAMEORIGIN"** Header set X-Download-Options "noopen" Header set X-Permitted-Cross-Domain-Policies "none" SetEnv modHeadersAvailable true

, but in Nextcloud 11 doesn’t work.

When i go in our internal site - the error from Google Chrome is:

Refused to display ‘http://10.253.251.10/nextcloud/index.php/apps/files/’ in a frame because it set ‘X-Frame-Options’ to ‘Sameorigin’.

Can you help us ?
Best regards

tflidd · June 8, 2017, 3:56pm

Did you restart the server to make sure there are no cached values anywhere? In doubt you can use curl to retrieve the page and check if the headers are still in.

I only made a quick search on the code, could be inserted also via PHP:

github.com

nextcloud/server/blob/c996e91d5914e96c443dd85ba67da38583d9ca6c/lib/private/legacy/response.php#L260


			. 'script-src \'self\' \'unsafe-eval\' \'nonce-'.\OC::$server->getContentSecurityPolicyNonceManager()->getNonce().'\'; '
			. 'style-src \'self\' \'unsafe-inline\'; '
			. 'frame-src *; '
			. 'img-src * data: blob:; '
			. 'font-src \'self\' data:; '
			. 'media-src *; ' 
			. 'connect-src *; '
			. 'object-src \'none\'; '
			. 'base-uri \'self\'; ';
		header('Content-Security-Policy:' . $policy);
		header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains


		// Send fallback headers for installations that don't have the possibility to send
		// custom headers on the webserver side
		if(getenv('modHeadersAvailable') !== 'true') {
			header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
			header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
			header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
			header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
			header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
		}

alecsamoila · June 21, 2017, 7:06am

IT’s WORKS!

I searched for all response.php files with WinSCP, in the Nextcloud folder

And I commented all the lines with - header(‘X-Frame-Options: SAMEORIGIN’);

The problem was in => Nextcloud/lib/private/legacy/response.php line 264

Thank You!

hjj2 · August 15, 2017, 10:14am

hey，i have the same problem. I want to make nextcloud into our site’s iframe , I disable " header(‘X-Frame-Options: SAMEORIGIN’); // Disallow iFraming from other domains " in response.php. but it doesn’t work. Can you give me some advice?