Add support for X-Content-Type-Options and X-XSS-Protection security …

…headers
plone · Jul 31, 2018 · 2fe5258 · 2fe5258
1 parent 836ae26
commit 2fe5258
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -11,7 +11,8 @@ Breaking changes:
 
 New features:
 
-- *add item here*
+- Add support for ``X-Content-Type-Options`` and ``X-XSS-Protection`` security headers.
+  [hvelarde]
 
 Bug fixes:
 

diff --git a/Products/TinyMCE/skins/tinymce/plugins/fullscreen/fullscreen.htm.pt b/Products/TinyMCE/skins/tinymce/plugins/fullscreen/fullscreen.htm.pt
@@ -3,6 +3,8 @@
 <head>
 	<title></title>
 	<meta http-equiv="X-UA-Compatible" content="IE=edge" />
+	<meta http-equiv="X-Content-Type-Options" content="nosniff" />
+	<meta http-equiv="X-XSS-Protection" content="1; mode=block" />
 	<script type="text/javascript" src="../../tiny_mce_dev.js?v={tinymce_version}"></script>
 	<script type="text/javascript">
 		function patchCallback(settings, key) {