CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-22 12:42:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

Browse Source 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
This commit is contained in:
Raphael Michel
2026-07-01 15:15:43 +02:00
co-authored by Mira Weller
parent 000bf54105
commit c9781f012b
17 changed files with 63 additions and 206 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/static/pretixbase/js/framebreak.js
+3
View File
@@ -0,0 +1,3 @@
// Attempt to auto-open page in new tab. Will be ignored by most browser's popup blockers anyways, though.
var url = JSON.parse(document.getElementById('framebreak-url').innerText)
window.open(url)