Merge lp:~julian-edwards/maas/clickjacking-bug-1298784 into lp:~maas-committers/maas/trunk

[Julian Edwards]

Enable Django's clickjacking middleware.

Not sure if it warrants a unit test but I verified that the header is present after enabling this.

[Jeroen T. Vermeulen (jtv)]

Testing is a grey area with these things, but I think you're OK. My feeling is that code which merely states configuration only needs to be tested for:

1. Running at all. I'm sure that's covered already.
2. Stating things correctly, if stating them incorrectly is plausible. Not here though.
3. Producing the right interaction within the scope of the product.

For #3 I would say the interaction is completely between Django and the browser. The only thing you do here is tell Django that it should happen.

review: Approve

=== modified file 'src/maas/settings.py'
--- src/maas/settings.py	2014-02-14 12:12:28 +0000
+++ src/maas/settings.py	2014-05-01 06:10:35 +0000
@@ -249,6 +249,7 @@
     'maasserver.middleware.ExternalComponentsMiddleware',
     'metadataserver.middleware.MetadataErrorsMiddleware',
     'django.middleware.transaction.TransactionMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'maasserver.middleware.ExceptionLoggerMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',