From f9e4915d756ef4cc929cf0f31fd373f9e527ab7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Guillot?= <fred@kanboard.net>
Date: Tue, 7 Oct 2014 19:35:02 -0400
Subject: [PATCH] Allow public board iframe inclusion (see #309)

---
 app/Controller/Base.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/Controller/Base.php b/app/Controller/Base.php
index f24ea8ff1..aabb17752 100644
--- a/app/Controller/Base.php
+++ b/app/Controller/Base.php
@@ -116,7 +116,11 @@ abstract class Base
         $this->response->csp(array('style-src' => "'self' 'unsafe-inline'"));
         $this->response->nosniff();
         $this->response->xss();
-        $this->response->xframe();
+
+        // Allow the public board iframe inclusion
+        if ($action !== 'readonly') {
+            $this->response->xframe();
+        }
 
         if (ENABLE_HSTS) {
             $this->response->hsts();