v1.11.0: Masked redirects being rejected: Page 2

v1.11.0: Masked redirects being rejected

LesD

Eurica!

Rebuild was straight forward.

Disabled SELinux and worked first time.

Create folder support in document root.
Copy two install folders into support.
Copy my live ost-config.php to the right folder
Point browser to http://10.27.27.63/support/upload/setup/ (10.27.27.63 is the new VM)
Detects the copied config file and provides link to log in as Admin

All done and working.

Thank you.

Back to the original problem with redirects.

I will do some more testing and report back.

ntozier

Right on! I look forward to your report.

As a side note, since things are working you should probably look into writing rules for SELinux so that you can re-enable it afterwards. Scott Miller has a pretty good CentOS 7 installing osTicket 1.10 tutorial over on mangolassi.it.

https://mangolassi.it/topic/11624/installing-osticket-1-10-on-centos-7

It's a little dated on the osTicket version, but last I checked he's pretty responsive (although it has been a while).

LesD

Found it!

\upload\include\client\header.inc.php

line 9

header("X-Frame-Options: SAMEORIGIN");

I think the above is blocking anything coming via a frame - which is the way forwarding works. Maybe put there as a security measure.

Removing that line fixes the problem - though still to be tested thoroughly.

KevinTheJedi

@LesD

Maybe put there as a security measure.

Yes, this is a security measure put in place to avoid XSS etc. I’m eventually building something to allow X-Frame-Options from specified domains, but this is of course when I get time (which is sparse but I do have some free time....some times lol).

You can remove it for now and that should work until we release the additions I mentioned above.

Cheers.

LesD

Many thanks to you both for all the help.

Very much appreciated.

ntozier

Very welcome. ?

« Previous Page