Version 4.7.0

system/Output/Output.php

@@ -247,7 +247,9 @@ class _Output
 			}
 			elseif ( \IPS\Settings::i()->clickjackprevention != 'none' )
 			{
-				$this->httpHeaders['X-Frame-Options'] = 'sameorigin';
+				$this->httpHeaders['X-Frame-Options'] = "sameorigin";
+				$this->httpHeaders['Content-Security-Policy'] = "frame-ancestors 'self'";
+				$this->httpHeaders['X-Content-Security-Policy'] = "frame-ancestors 'self'";
 			}
 
 			/* 2 = entire suite, 1 = ACP only */
@@ -458,7 +460,7 @@ class _Output
 			'Date'			=> \IPS\DateTime::ts( time(), TRUE )->rfc1123(),
 			'Last-Modified'	=> \IPS\DateTime::ts( $lastModified, TRUE )->rfc1123(),
 			'Expires'		=> \IPS\DateTime::ts( ( time() + $cacheSeconds ), TRUE )->rfc1123(),
-			'Cache-Control'	=> "max-age=" . $cacheSeconds . ", public, s-maxage=" . $cacheSeconds . ", stale-while-revalidate, stale-if-error",
+			'Cache-Control'	=> 'no-cache="Set-Cookie", max-age=' . $cacheSeconds . ", public, s-maxage=" . $cacheSeconds . ", stale-while-revalidate, stale-if-error",
 		);
 	}
 	
@@ -471,7 +473,7 @@ class _Output
 	{
 		return array(
 			'Expires'		=> 0,
-			'Cache-Control'	=> "no-cache, no-store, must-revalidate"
+			'Cache-Control'	=> "no-cache, no-store, must-revalidate, max-age=0, s-maxage=0"
 		);
 	}
 
@@ -505,7 +507,10 @@ class _Output
 			break;
 
 			case 'explorer':
-			//case 'chrome':
+			case 'Edge':
+			case 'edge':
+			case 'chrome':
+			case 'Chrome':
 				$return	.= '="' . rawurlencode( $filename ) . '"';
 			break;
 
@@ -631,6 +636,9 @@ class _Output
 			$this->sendOutput( \IPS\Member::loggedIn()->language()->get( $message ), $httpStatusCode, 'text/html', $httpHeaders, FALSE );
 			return;
 		}
+
+		/* Remove the page token */
+		unset( \IPS\Output::i()->jsVars['page_token'] );
 		
 		/* Work out the title */
 		$title = "{$httpStatusCode}_error_title";
@@ -801,6 +809,12 @@ class _Output
 			exit;
 		}
 
+		/* Cache session Data Layer events */
+		if ( !( $httpStatusCode === 200 AND !\IPS\Request::i()->isAjax() AND $contentType == 'text/html' ) )
+		{
+			\IPS\core\DataLayer::i()->cache();
+		}
+
 		/* Replace language stack keys with actual content */
 		if ( \IPS\Dispatcher::hasInstance() and !\in_array( $contentType, array( 'text/javascript', 'text/css', 'application/json' ) ) and $output and !$pageIsCached )
 		{
@@ -930,7 +944,10 @@ class _Output
 		}
 
 		/* Remove anything from the output buffer that should not be there as it can confuse content-length */
-		@ob_end_clean();
+		if( ob_get_length() )
+		{
+			@ob_end_clean();
+		}
 
 		/* Trim any blank spaces before the beginning of output */
 		$output = ltrim( $output );
@@ -1283,7 +1300,10 @@ class _Output
 		\IPS\Output::i()->sidebar['enabled'] = FALSE;
 
 		\IPS\Dispatcher\Front::i()->checkMfa();
-		
+
+		/* Unset page token */
+		unset( \IPS\Output::i()->jsVars['page_token'] );
+
 		$this->sendOutput( \IPS\Theme::i()->getTemplate( 'global', 'core' )->globalTemplate( $this->title, $this->output, array( 'app' => \IPS\Dispatcher::i()->application->directory, 'module' => \IPS\Dispatcher::i()->module->key, 'controller' => \IPS\Dispatcher::i()->controller ) ), 503 );
 	}
 
@@ -1329,6 +1349,9 @@ class _Output
 
 		\IPS\Output::i()->sidebar['enabled'] = FALSE;
 
+		/* Unset page token */
+		unset( \IPS\Output::i()->jsVars['page_token'] );
+
 		$this->sendOutput( \IPS\Theme::i()->getTemplate( 'global', 'core' )->globalTemplate( $this->title, $this->output, array( 'app' => \IPS\Dispatcher::i()->application->directory, 'module' => \IPS\Dispatcher::i()->module->key, 'controller' => \IPS\Dispatcher::i()->controller ) ), 403, 'text/html', array(), FALSE );
 	}
 
@@ -1376,8 +1399,8 @@ class _Output
 		/* Add Admin-specified ones */
 		if( !$this->metaTagsUrl )
 		{
-			$this->metaTagsUrl	= ( \IPS\Request::i()->url() instanceof \IPS\Http\Url\Friendly ) ? \IPS\Request::i()->url()->friendlyUrlComponent : NULL;
-	
+			$this->metaTagsUrl	= ( \IPS\Request::i()->url() instanceof \IPS\Http\Url\Friendly ) ? \IPS\Request::i()->url()->friendlyUrlComponent : '';
+
 			if ( isset( \IPS\Data\Store::i()->metaTags ) )
 			{
 				$rows = \IPS\Data\Store::i()->metaTags;
@@ -1492,6 +1515,8 @@ class _Output
 		}
 
 		/* Automatically generate JSON-LD markup */
+		$mainSiteUrl = ( \IPS\Settings::i()->site_site_elsewhere and \IPS\Settings::i()->site_main_url ) ? \IPS\Settings::i()->site_main_url : \IPS\Settings::i()->base_url;
+		$mainSiteTitle = ( \IPS\Settings::i()->site_site_elsewhere and \IPS\Settings::i()->site_main_title ) ? \IPS\Settings::i()->site_main_title : \IPS\Settings::i()->board_name;
 		$jsonLd = array(
 			'website'		=> array(
 				'@context'	=> "http://www.schema.org",
@@ -1511,10 +1536,10 @@ class _Output
 			'organization'	=> array(
 				'@context'	=> "http://www.schema.org",
 				'@type'		=> "Organization",
-				'@id' 		=> \IPS\Settings::i()->base_url . '#organization',
-	            'mainEntityOfPage' => \IPS\Settings::i()->base_url,
-				'name'		=> \IPS\Settings::i()->board_name,
-				'url'		=> \IPS\Settings::i()->base_url,
+				'@id' 		=> $mainSiteUrl . '#organization',
+	            'mainEntityOfPage' => $mainSiteUrl,
+				'name'		=> $mainSiteTitle,
+				'url'		=> $mainSiteUrl,
 			)
 		);