def xframe_allow_whitelisted(view_func):
 def wrapped_view(request, *args, **kwargs):
  ' Modify the response with the correct X-Frame-Options. '
  resp = view_func(request, *args, **kwargs)
  x_frame_option = 'DENY'
  if settings.FEATURES['ENABLE_THIRD_PARTY_AUTH']:
   referer = request.META.get('HTTP_REFERER')
   if (referer is not None):
    parsed_url = urlparse(referer)
    hostname = parsed_url.hostname
    if LTIProviderConfig.objects.current_set().filter(lti_hostname=hostname, enabled=True).exists():
     x_frame_option = 'ALLOW'
  resp['X-Frame-Options'] = x_frame_option
  return resp
 return wraps(view_func, assigned=available_attrs(view_func))(wrapped_view)

def xframe_allow_whitelisted ( view_func ) : def wrapped_view ( request , * args , ** kwargs ) : resp = view_func ( request , * args , ** kwargs ) x_frame_option = 'DENY' if settings . FEATURES [ 'ENABLE_THIRD_PARTY_AUTH' ] : referer = request . META . get ( 'HTTP_REFERER' ) if ( referer is not None ) : parsed_url = urlparse ( referer ) hostname = parsed_url . hostname if LTIProviderConfig . objects . current_set ( ) . filter ( lti_hostname = hostname , enabled = True ) . exists ( ) : x_frame_option = 'ALLOW' resp [ 'X-Frame-Options' ] = x_frame_option return resp return wraps ( view_func , assigned = available_attrs ( view_func ) ) ( wrapped_view )
modifies a view function so that its response has the x-frame-options http header set to deny if the request http referrer is not from a whitelisted hostname .