Drop usage of self._debug and use self.debug instead

[cascardo/ipsilon.git] / ipsilon / util / endpoint.py

diff --git a/ipsilon/util/endpoint.py b/ipsilon/util/endpoint.py
index f160329..20d3694 100644 (file)
--- a/ipsilon/util/endpoint.py
+++ b/ipsilon/util/endpoint.py
@@ -4,6 +4,7 @@ import cherrypy
 from ipsilon.util.log import Log
 from ipsilon.util.user import UserSession
 from urllib import unquote
+from functools import wraps
 try:
     from urlparse import urlparse
 except ImportError:
@@ -11,6 +12,23 @@ except ImportError:
     from urllib.parse import urlparse
 
 
+def allow_iframe(func):
+    """
+    Remove the X-Frame-Options and CSP frame-options deny headers.
+    """
+    @wraps(func)
+    def wrapper(*args, **kwargs):
+        result = func(*args, **kwargs)
+        for (header, value) in [
+                ('X-Frame-Options', 'deny'),
+                ('Content-Security-Policy', 'frame-options \'deny\'')]:
+            if cherrypy.response.headers.get(header, None) == value:
+                cherrypy.response.headers.pop(header, None)
+        return result
+
+    return wrapper
+
+
 class Endpoint(Log):
     def __init__(self, site):
         self._site = site
@@ -19,6 +37,8 @@ class Endpoint(Log):
         self.default_headers = {
             'Cache-Control': 'no-cache, no-store, must-revalidate, private',
             'Pragma': 'no-cache',
+            'Content-Security-Policy': 'frame-options \'deny\'',
+            'X-Frame-Options': 'deny',
         }
         self.auth_protect = False
 
@@ -50,20 +70,20 @@ class Endpoint(Log):
         if self.auth_protect and self.user.is_anonymous:
             raise cherrypy.HTTPError(401)
 
-        self._debug("method: %s" % cherrypy.request.method)
+        self.debug("method: %s" % cherrypy.request.method)
         op = getattr(self, cherrypy.request.method, None)
         if callable(op):
             # Basic CSRF protection
             if cherrypy.request.method != 'GET':
                 url = self.get_url()
                 if 'referer' not in cherrypy.request.headers:
-                    self._debug("Missing referer in %s request to %s"
-                                % (cherrypy.request.method, url))
+                    self.debug("Missing referer in %s request to %s"
+                               % (cherrypy.request.method, url))
                     raise cherrypy.HTTPError(403)
                 referer = cherrypy.request.headers['referer']
                 if not self._check_referer(referer, url):
-                    self._debug("Wrong referer %s in request to %s"
-                                % (referer, url))
+                    self.debug("Wrong referer %s in request to %s"
+                               % (referer, url))
                     raise cherrypy.HTTPError(403)
             return op(*args, **kwargs)
         else: