Allow Dynamic registration to be embedded.

tsugiproject · Nov 21, 2024 · 2b3ba79 · 2b3ba79
1 parent 1fe4979
commit 2b3ba79
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/include/setup.php b/include/setup.php
@@ -71,8 +71,11 @@ function print_stack_trace() {
 }
 
 // Check for non-embeddable pages and declare appropriate CSP
-if ( preg_match('/(\/admin\/|\/login)/i', $_SERVER['REQUEST_URI']) ) {
-    header("Content-Security-Policy: frame-ancestors 'self';");
+// Allow the Dynamic Registration URL to be embedded as it is required
+if ( preg_match('/(\/admin\/|\/login)/i', $_SERVER['REQUEST_URI'] ?? "") ) {
+    if ( ! preg_match('/(\/admin\/key\/auto.php)/i', $_SERVER['REQUEST_URI']) ) {
+        header("Content-Security-Policy: frame-ancestors 'self';");
+    }
 }
 
 if ( ! isset($CFG->staticroot) ) die_with_error_log('$CFG->staticroot not defined in config.php');