{"action":"created","comment":{"url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/comments/240365248","pull_request_review_id":183379944,"id":240365248,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI0MDM2NTI0OA==","diff_hunk":"@@ -559,19 +559,20 @@ Http::Response WebApplication::processRequest(const Http::Request &request, cons\n             print(error.message(), Http::CONTENT_TYPE_TXT);\n     }\n \n-    header(Http::HEADER_X_XSS_PROTECTION, \"1; mode=block\");\n-    header(Http::HEADER_X_CONTENT_TYPE_OPTIONS, \"nosniff\");\n+    header(QLatin1String(Http::HEADER_X_XSS_PROTECTION), QLatin1String(\"1; mode=block\"));\n+    header(QLatin1String(Http::HEADER_X_CONTENT_TYPE_OPTIONS), QLatin1String(\"nosniff\"));\n \n-    QString csp = QLatin1String(\"default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none'; form-action 'self';\");\n-    if (m_isClickjackingProtectionEnabled) {\n-        header(Http::HEADER_X_FRAME_OPTIONS, \"SAMEORIGIN\");\n-        csp += QLatin1String(\" frame-ancestors 'self';\");\n-    }\n-    if (m_isHttpsEnabled) {\n-        csp += QLatin1String(\" upgrade-insecure-requests;\");\n-    }\n+    if (m_isClickjackingProtectionEnabled)\n+        header(QLatin1String(Http::HEADER_X_FRAME_OPTIONS), QLatin1String(\"SAMEORIGIN\"));\n \n-    header(Http::HEADER_CONTENT_SECURITY_POLICY, csp);\n+    if (!m_isAltUIUsed) {\n+        header(QLatin1String(Http::HEADER_REFERRER_POLICY), QLatin1String(\"same-origin\"));\n+\n+        const QString csp = QLatin1String(\"default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none'; form-action 'self';\")","path":"src/webui/webapplication.cpp","position":27,"original_position":24,"commit_id":"e7f8f9a821f2f045e84a77011bbc798b5dfd56b0","original_commit_id":"8b4fc816132a20f8633019b83067a59a1db9c2c9","user":{"login":"Piccirello","id":8296030,"node_id":"MDQ6VXNlcjgyOTYwMzA=","avatar_url":"https://avatars1.githubusercontent.com/u/8296030?v=4","gravatar_id":"","url":"https://api.github.com/users/Piccirello","html_url":"https://github.com/Piccirello","followers_url":"https://api.github.com/users/Piccirello/followers","following_url":"https://api.github.com/users/Piccirello/following{/other_user}","gists_url":"https://api.github.com/users/Piccirello/gists{/gist_id}","starred_url":"https://api.github.com/users/Piccirello/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Piccirello/subscriptions","organizations_url":"https://api.github.com/users/Piccirello/orgs","repos_url":"https://api.github.com/users/Piccirello/repos","events_url":"https://api.github.com/users/Piccirello/events{/privacy}","received_events_url":"https://api.github.com/users/Piccirello/received_events","type":"User","site_admin":false},"body":"I'm thinking we should do the same for click jacking protection. If users want to disable it, they should disable the option.","created_at":"2018-12-10T20:19:10Z","updated_at":"2018-12-10T20:19:10Z","html_url":"https://github.com/qbittorrent/qBittorrent/pull/9993#discussion_r240365248","pull_request_url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/comments/240365248"},"html":{"href":"https://github.com/qbittorrent/qBittorrent/pull/9993#discussion_r240365248"},"pull_request":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993"}},"in_reply_to_id":240274653},"pull_request":{"url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993","id":237217602,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM3MjE3NjAy","html_url":"https://github.com/qbittorrent/qBittorrent/pull/9993","diff_url":"https://github.com/qbittorrent/qBittorrent/pull/9993.diff","patch_url":"https://github.com/qbittorrent/qBittorrent/pull/9993.patch","issue_url":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/9993","number":9993,"state":"open","locked":false,"title":"Enforce referrer-policy in WebUI","user":{"login":"Chocobo1","id":9395168,"node_id":"MDQ6VXNlcjkzOTUxNjg=","avatar_url":"https://avatars2.githubusercontent.com/u/9395168?v=4","gravatar_id":"","url":"https://api.github.com/users/Chocobo1","html_url":"https://github.com/Chocobo1","followers_url":"https://api.github.com/users/Chocobo1/followers","following_url":"https://api.github.com/users/Chocobo1/following{/other_user}","gists_url":"https://api.github.com/users/Chocobo1/gists{/gist_id}","starred_url":"https://api.github.com/users/Chocobo1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chocobo1/subscriptions","organizations_url":"https://api.github.com/users/Chocobo1/orgs","repos_url":"https://api.github.com/users/Chocobo1/repos","events_url":"https://api.github.com/users/Chocobo1/events{/privacy}","received_events_url":"https://api.github.com/users/Chocobo1/received_events","type":"User","site_admin":false},"body":"This stops leaking private data to other websites via Referrer header.\r\n\r\n@Piccirello \r\nI might merge this before your other PRs, so you'll need to add the line to the new file in #9375.","created_at":"2018-12-10T07:07:48Z","updated_at":"2018-12-10T20:19:10Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dc8383c12143df23ea1454464ebca759ff92c645","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":36746818,"node_id":"MDU6TGFiZWwzNjc0NjgxOA==","url":"https://api.github.com/repos/qbittorrent/qBittorrent/labels/WebUI","name":"WebUI","color":"006b75","default":false}],"milestone":{"url":"https://api.github.com/repos/qbittorrent/qBittorrent/milestones/50","html_url":"https://github.com/qbittorrent/qBittorrent/milestone/50","labels_url":"https://api.github.com/repos/qbittorrent/qBittorrent/milestones/50/labels","id":3829917,"node_id":"MDk6TWlsZXN0b25lMzgyOTkxNw==","number":50,"title":"4.1.5","description":"","creator":{"login":"sledgehammer999","id":273315,"node_id":"MDQ6VXNlcjI3MzMxNQ==","avatar_url":"https://avatars0.githubusercontent.com/u/273315?v=4","gravatar_id":"","url":"https://api.github.com/users/sledgehammer999","html_url":"https://github.com/sledgehammer999","followers_url":"https://api.github.com/users/sledgehammer999/followers","following_url":"https://api.github.com/users/sledgehammer999/following{/other_user}","gists_url":"https://api.github.com/users/sledgehammer999/gists{/gist_id}","starred_url":"https://api.github.com/users/sledgehammer999/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sledgehammer999/subscriptions","organizations_url":"https://api.github.com/users/sledgehammer999/orgs","repos_url":"https://api.github.com/users/sledgehammer999/repos","events_url":"https://api.github.com/users/sledgehammer999/events{/privacy}","received_events_url":"https://api.github.com/users/sledgehammer999/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":11,"state":"open","created_at":"2018-11-19T01:39:23Z","updated_at":"2018-12-10T07:07:48Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993/commits","review_comments_url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993/comments","review_comment_url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/comments{/number}","comments_url":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/9993/comments","statuses_url":"https://api.github.com/repos/qbittorrent/qBittorrent/statuses/e7f8f9a821f2f045e84a77011bbc798b5dfd56b0","head":{"label":"Chocobo1:referer","ref":"referer","sha":"e7f8f9a821f2f045e84a77011bbc798b5dfd56b0","user":{"login":"Chocobo1","id":9395168,"node_id":"MDQ6VXNlcjkzOTUxNjg=","avatar_url":"https://avatars2.githubusercontent.com/u/9395168?v=4","gravatar_id":"","url":"https://api.github.com/users/Chocobo1","html_url":"https://github.com/Chocobo1","followers_url":"https://api.github.com/users/Chocobo1/followers","following_url":"https://api.github.com/users/Chocobo1/following{/other_user}","gists_url":"https://api.github.com/users/Chocobo1/gists{/gist_id}","starred_url":"https://api.github.com/users/Chocobo1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chocobo1/subscriptions","organizations_url":"https://api.github.com/users/Chocobo1/orgs","repos_url":"https://api.github.com/users/Chocobo1/repos","events_url":"https://api.github.com/users/Chocobo1/events{/privacy}","received_events_url":"https://api.github.com/users/Chocobo1/received_events","type":"User","site_admin":false},"repo":{"id":30459428,"node_id":"MDEwOlJlcG9zaXRvcnkzMDQ1OTQyOA==","name":"qBittorrent","full_name":"Chocobo1/qBittorrent","private":false,"owner":{"login":"Chocobo1","id":9395168,"node_id":"MDQ6VXNlcjkzOTUxNjg=","avatar_url":"https://avatars2.githubusercontent.com/u/9395168?v=4","gravatar_id":"","url":"https://api.github.com/users/Chocobo1","html_url":"https://github.com/Chocobo1","followers_url":"https://api.github.com/users/Chocobo1/followers","following_url":"https://api.github.com/users/Chocobo1/following{/other_user}","gists_url":"https://api.github.com/users/Chocobo1/gists{/gist_id}","starred_url":"https://api.github.com/users/Chocobo1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chocobo1/subscriptions","organizations_url":"https://api.github.com/users/Chocobo1/orgs","repos_url":"https://api.github.com/users/Chocobo1/repos","events_url":"https://api.github.com/users/Chocobo1/events{/privacy}","received_events_url":"https://api.github.com/users/Chocobo1/received_events","type":"User","site_admin":false},"html_url":"https://github.com/Chocobo1/qBittorrent","description":"qBittorrent BitTorrent client","fork":true,"url":"https://api.github.com/repos/Chocobo1/qBittorrent","forks_url":"https://api.github.com/repos/Chocobo1/qBittorrent/forks","keys_url":"https://api.github.com/repos/Chocobo1/qBittorrent/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Chocobo1/qBittorrent/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Chocobo1/qBittorrent/teams","hooks_url":"https://api.github.com/repos/Chocobo1/qBittorrent/hooks","issue_events_url":"https://api.github.com/repos/Chocobo1/qBittorrent/issues/events{/number}","events_url":"https://api.github.com/repos/Chocobo1/qBittorrent/events","assignees_url":"https://api.github.com/repos/Chocobo1/qBittorrent/assignees{/user}","branches_url":"https://api.github.com/repos/Chocobo1/qBittorrent/branches{/branch}","tags_url":"https://api.github.com/repos/Chocobo1/qBittorrent/tags","blobs_url":"https://api.github.com/repos/Chocobo1/qBittorrent/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Chocobo1/qBittorrent/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Chocobo1/qBittorrent/git/refs{/sha}","trees_url":"https://api.github.com/repos/Chocobo1/qBittorrent/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Chocobo1/qBittorrent/statuses/{sha}","languages_url":"https://api.github.com/repos/Chocobo1/qBittorrent/languages","stargazers_url":"https://api.github.com/repos/Chocobo1/qBittorrent/stargazers","contributors_url":"https://api.github.com/repos/Chocobo1/qBittorrent/contributors","subscribers_url":"https://api.github.com/repos/Chocobo1/qBittorrent/subscribers","subscription_url":"https://api.github.com/repos/Chocobo1/qBittorrent/subscription","commits_url":"https://api.github.com/repos/Chocobo1/qBittorrent/commits{/sha}","git_commits_url":"https://api.github.com/repos/Chocobo1/qBittorrent/git/commits{/sha}","comments_url":"https://api.github.com/repos/Chocobo1/qBittorrent/comments{/number}","issue_comment_url":"https://api.github.com/repos/Chocobo1/qBittorrent/issues/comments{/number}","contents_url":"https://api.github.com/repos/Chocobo1/qBittorrent/contents/{+path}","compare_url":"https://api.github.com/repos/Chocobo1/qBittorrent/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Chocobo1/qBittorrent/merges","archive_url":"https://api.github.com/repos/Chocobo1/qBittorrent/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Chocobo1/qBittorrent/downloads","issues_url":"https://api.github.com/repos/Chocobo1/qBittorrent/issues{/number}","pulls_url":"https://api.github.com/repos/Chocobo1/qBittorrent/pulls{/number}","milestones_url":"https://api.github.com/repos/Chocobo1/qBittorrent/milestones{/number}","notifications_url":"https://api.github.com/repos/Chocobo1/qBittorrent/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Chocobo1/qBittorrent/labels{/name}","releases_url":"https://api.github.com/repos/Chocobo1/qBittorrent/releases{/id}","deployments_url":"https://api.github.com/repos/Chocobo1/qBittorrent/deployments","created_at":"2015-02-07T15:14:20Z","updated_at":"2018-12-10T04:46:32Z","pushed_at":"2018-12-10T19:27:52Z","git_url":"git://github.com/Chocobo1/qBittorrent.git","ssh_url":"git@github.com:Chocobo1/qBittorrent.git","clone_url":"https://github.com/Chocobo1/qBittorrent.git","svn_url":"https://github.com/Chocobo1/qBittorrent","homepage":"http://www.qbittorrent.org","size":163825,"stargazers_count":1,"watchers_count":1,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"qbittorrent:master","ref":"master","sha":"e1f19b7c7531b4d3bd1b0b83e84302c42c77f210","user":{"login":"qbittorrent","id":2131270,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIxMzEyNzA=","avatar_url":"https://avatars2.githubusercontent.com/u/2131270?v=4","gravatar_id":"","url":"https://api.github.com/users/qbittorrent","html_url":"https://github.com/qbittorrent","followers_url":"https://api.github.com/users/qbittorrent/followers","following_url":"https://api.github.com/users/qbittorrent/following{/other_user}","gists_url":"https://api.github.com/users/qbittorrent/gists{/gist_id}","starred_url":"https://api.github.com/users/qbittorrent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qbittorrent/subscriptions","organizations_url":"https://api.github.com/users/qbittorrent/orgs","repos_url":"https://api.github.com/users/qbittorrent/repos","events_url":"https://api.github.com/users/qbittorrent/events{/privacy}","received_events_url":"https://api.github.com/users/qbittorrent/received_events","type":"Organization","site_admin":false},"repo":{"id":3351871,"node_id":"MDEwOlJlcG9zaXRvcnkzMzUxODcx","name":"qBittorrent","full_name":"qbittorrent/qBittorrent","private":false,"owner":{"login":"qbittorrent","id":2131270,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIxMzEyNzA=","avatar_url":"https://avatars2.githubusercontent.com/u/2131270?v=4","gravatar_id":"","url":"https://api.github.com/users/qbittorrent","html_url":"https://github.com/qbittorrent","followers_url":"https://api.github.com/users/qbittorrent/followers","following_url":"https://api.github.com/users/qbittorrent/following{/other_user}","gists_url":"https://api.github.com/users/qbittorrent/gists{/gist_id}","starred_url":"https://api.github.com/users/qbittorrent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qbittorrent/subscriptions","organizations_url":"https://api.github.com/users/qbittorrent/orgs","repos_url":"https://api.github.com/users/qbittorrent/repos","events_url":"https://api.github.com/users/qbittorrent/events{/privacy}","received_events_url":"https://api.github.com/users/qbittorrent/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/qbittorrent/qBittorrent","description":"qBittorrent BitTorrent client","fork":false,"url":"https://api.github.com/repos/qbittorrent/qBittorrent","forks_url":"https://api.github.com/repos/qbittorrent/qBittorrent/forks","keys_url":"https://api.github.com/repos/qbittorrent/qBittorrent/keys{/key_id}","collaborators_url":"https://api.github.com/repos/qbittorrent/qBittorrent/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/qbittorrent/qBittorrent/teams","hooks_url":"https://api.github.com/repos/qbittorrent/qBittorrent/hooks","issue_events_url":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/events{/number}","events_url":"https://api.github.com/repos/qbittorrent/qBittorrent/events","assignees_url":"https://api.github.com/repos/qbittorrent/qBittorrent/assignees{/user}","branches_url":"https://api.github.com/repos/qbittorrent/qBittorrent/branches{/branch}","tags_url":"https://api.github.com/repos/qbittorrent/qBittorrent/tags","blobs_url":"https://api.github.com/repos/qbittorrent/qBittorrent/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/qbittorrent/qBittorrent/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/qbittorrent/qBittorrent/git/refs{/sha}","trees_url":"https://api.github.com/repos/qbittorrent/qBittorrent/git/trees{/sha}","statuses_url":"https://api.github.com/repos/qbittorrent/qBittorrent/statuses/{sha}","languages_url":"https://api.github.com/repos/qbittorrent/qBittorrent/languages","stargazers_url":"https://api.github.com/repos/qbittorrent/qBittorrent/stargazers","contributors_url":"https://api.github.com/repos/qbittorrent/qBittorrent/contributors","subscribers_url":"https://api.github.com/repos/qbittorrent/qBittorrent/subscribers","subscription_url":"https://api.github.com/repos/qbittorrent/qBittorrent/subscription","commits_url":"https://api.github.com/repos/qbittorrent/qBittorrent/commits{/sha}","git_commits_url":"https://api.github.com/repos/qbittorrent/qBittorrent/git/commits{/sha}","comments_url":"https://api.github.com/repos/qbittorrent/qBittorrent/comments{/number}","issue_comment_url":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/comments{/number}","contents_url":"https://api.github.com/repos/qbittorrent/qBittorrent/contents/{+path}","compare_url":"https://api.github.com/repos/qbittorrent/qBittorrent/compare/{base}...{head}","merges_url":"https://api.github.com/repos/qbittorrent/qBittorrent/merges","archive_url":"https://api.github.com/repos/qbittorrent/qBittorrent/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/qbittorrent/qBittorrent/downloads","issues_url":"https://api.github.com/repos/qbittorrent/qBittorrent/issues{/number}","pulls_url":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls{/number}","milestones_url":"https://api.github.com/repos/qbittorrent/qBittorrent/milestones{/number}","notifications_url":"https://api.github.com/repos/qbittorrent/qBittorrent/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/qbittorrent/qBittorrent/labels{/name}","releases_url":"https://api.github.com/repos/qbittorrent/qBittorrent/releases{/id}","deployments_url":"https://api.github.com/repos/qbittorrent/qBittorrent/deployments","created_at":"2012-02-04T09:37:46Z","updated_at":"2018-12-10T16:06:09Z","pushed_at":"2018-12-10T19:27:55Z","git_url":"git://github.com/qbittorrent/qBittorrent.git","ssh_url":"git@github.com:qbittorrent/qBittorrent.git","clone_url":"https://github.com/qbittorrent/qBittorrent.git","svn_url":"https://github.com/qbittorrent/qBittorrent","homepage":"https://www.qbittorrent.org","size":168648,"stargazers_count":5384,"watchers_count":5384,"language":"C++","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":944,"mirror_url":null,"archived":false,"open_issues_count":2284,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":944,"open_issues":2284,"watchers":5384,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993"},"html":{"href":"https://github.com/qbittorrent/qBittorrent/pull/9993"},"issue":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/9993"},"comments":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/issues/9993/comments"},"review_comments":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993/comments"},"review_comment":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/pulls/9993/commits"},"statuses":{"href":"https://api.github.com/repos/qbittorrent/qBittorrent/statuses/e7f8f9a821f2f045e84a77011bbc798b5dfd56b0"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"Piccirello"}}