[NEW] Add option to enable X-Frame-options header to avoid loading inside any Iframe

app/cors/server/cors.js

@@ -48,6 +48,9 @@ WebApp.rawConnectHandlers.use(function(req, res, next) {
 	if (/^\/(api|_timesync|sockjs|tap-i18n)(\/|$)/.test(req.url)) {
 		res.setHeader('Access-Control-Allow-Origin', '*');
 	}
+	if (!settings.get('Allow_Loading_In_Iframe')) {
+		res.setHeader('X-Frame-Options', settings.get('X_Frame_Options'));
+	}
 
 	const { setHeader } = res;
 	res.setHeader = function(key, val, ...args) {
@@ -56,6 +59,7 @@ WebApp.rawConnectHandlers.use(function(req, res, next) {
 		}
 		return setHeader.apply(this, [key, val, ...args]);
 	};
+
 	return next();
 });
 

app/lib/server/startup/settings.js

@@ -752,6 +752,18 @@ settings.addGroup('General', function() {
 		type: 'boolean',
 		secret: true,
 	});
+	this.add('Allow_Loading_In_Iframe', false, {
+		type: 'boolean',
+		secret: true,
+	});
+	this.add('X_Frame_Options', 'sameorigin', {
+		type: 'string',
+		secret: true,
+		enableQuery: {
+			_id: 'Allow_Loading_In_Iframe',
+			value: false,
+		},
+	});
 	this.add('Favorite_Rooms', true, {
 		type: 'boolean',
 		public: true,

packages/rocketchat-i18n/i18n/en.i18n.json

@@ -253,6 +253,8 @@
   "Allow_Invalid_SelfSigned_Certs": "Allow Invalid Self-Signed Certs",
   "Allow_Invalid_SelfSigned_Certs_Description": "Allow invalid and self-signed SSL certificate's for link validation and previews.",
   "Allow_switching_departments": "Allow Visitor to Switch Departments",
+  "Allow_Loading_In_Iframe": "Allow loading inside any Iframe",
+  "Allow_Loading_In_Iframe_Description": "Allows loading inside any Iframe without restrictions",
   "Allow_Marketing_Emails": "Allow Marketing Emails",
   "Almost_done": "Almost done",
   "Alphabetical": "Alphabetical",
@@ -3208,6 +3210,8 @@
   "will_be_able_to": "will be able to",
   "Worldwide": "Worldwide",
   "Would_you_like_to_return_the_inquiry": "Would you like to return the inquiry?",
+  "X_Frame_Options": "Options to X-Frame-Options",
+  "X_Frame_Options_Description": "Options to X-Frame-Options. [You can see all the options here.](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options#Syntax)",
   "Yes": "Yes",
   "Yesterday": "Yesterday",
   "Yes_archive_it": "Yes, archive it!",

server/startup/migrations/v148.js

@@ -0,0 +1,13 @@
+import { Migrations } from '../../../app/migrations';
+import { Settings } from '../../../app/models';
+
+Migrations.add({
+	version: 148,
+	up() {
+		Settings.upsert({ _id: 'Allow_Loading_In_Iframe' }, {
+			$set: {
+				value: true,
+			},
+		});
+	},
+});