Commit 65b71ab7 authored by David Rothstein's avatar David Rothstein
Browse files

Issue #2646280 by Elijah Lynn, pietmarcus: Remove IE pre-check and post-check Cache-control headers

parent a95cb56b

CHANGELOG.txt

+2 −0
Changes for CHANGELOG.txt: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line 


Drupal 7.44, xxxx-xx-xx (development version)

-----------------------

- Removed meaningless post-check=0 and pre-check=0 cache control headers from

  Drupal HTTP responses.

- Added clickjacking protection to Drupal core by setting the X-Frame-Options

  header to SAMEORIGIN by default (https://www.drupal.org/node/2735873).

- Added a new "administer fields" permission for trusted users, which is

includes/bootstrap.inc

+1 −1
Changes for includes/bootstrap.inc: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -1261,7 +1261,7 @@ function drupal_page_header() { 


  $default_headers = array(

    'Expires' => 'Sun, 19 Nov 1978 05:00:00 GMT',

    'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',

    'Cache-Control' => 'no-cache, must-revalidate',

    // Prevent browsers from sniffing a response and picking a MIME type

    // different from the declared content-type, since that can lead to

    // XSS and other vulnerabilities.

modules/image/image.test

+1 −1
Changes for modules/image/image.test: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -285,7 +285,7 @@ class ImageStylesPathAndUrlTestCase extends DrupalWebTestCase { 
    $this->assertEqual($this->drupalGetHeader('Content-Length'), $generated_image_info['file_size'], 'Expected Content-Length was reported.');

    if ($scheme == 'private') {

      $this->assertEqual($this->drupalGetHeader('Expires'), 'Sun, 19 Nov 1978 05:00:00 GMT', 'Expires header was sent.');

      $this->assertEqual($this->drupalGetHeader('Cache-Control'), 'no-cache, must-revalidate, post-check=0, pre-check=0', 'Cache-Control header was set to prevent caching.');

      $this->assertEqual($this->drupalGetHeader('Cache-Control'), 'no-cache, must-revalidate', 'Cache-Control header was set to prevent caching.');

      $this->assertEqual($this->drupalGetHeader('X-Image-Owned-By'), 'image_module_test', 'Expected custom header has been added.');



      // Make sure that a second request to the already existing derivate works

modules/simpletest/tests/bootstrap.test

+1 −1
Changes for modules/simpletest/tests/bootstrap.test: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -191,7 +191,7 @@ class BootstrapPageCacheTestCase extends DrupalWebTestCase { 
    $this->drupalGet('system-test/set-header', array('query' => array('name' => 'Foo', 'value' => 'bar')));

    $this->assertFalse($this->drupalGetHeader('X-Drupal-Cache'), 'Caching was bypassed.');

    $this->assertTrue(strpos($this->drupalGetHeader('Vary'), 'Cookie') === FALSE, 'Vary: Cookie header was not sent.');

    $this->assertEqual($this->drupalGetHeader('Cache-Control'), 'no-cache, must-revalidate, post-check=0, pre-check=0', 'Cache-Control header was sent.');

    $this->assertEqual($this->drupalGetHeader('Cache-Control'), 'no-cache, must-revalidate', 'Cache-Control header was sent.');

    $this->assertEqual($this->drupalGetHeader('Expires'), 'Sun, 19 Nov 1978 05:00:00 GMT', 'Expires header was sent.');

    $this->assertEqual($this->drupalGetHeader('Foo'), 'bar', 'Custom header was sent.');