change X_FRAME_OPTIONS do not work

[daixiang]

I want to change X_FRAME_OPTIONS so that i update /usr/share/zabbix/include/defines.inc.php:

define('X_FRAME_OPTIONS', 'http://192.168.60.45:8080,http://10.0.2.79:8080');

Then i restart httpd service.

But when i test, i find below error:

Refused to display 'http://10.0.2.79/zabbix/zabbix.php?action=dashboard.view' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

I know that 'sameorgin' is the default value which means changes do not work.

My zabbix version is 3.0.14-1.el7.

[kernbug]

Hello,

From the official documentation:

Same origin policy for IFrames. Zabbix now cannot be placed in frames on a different domain. Still, pages placed into a Zabbix frame will have access to Zabbix frontend (through JavaScript) if the page that is placed in the frame and Zabbix frontend are on the same domain. A page like http://secure-zabbix.com/cms/page.html, if placed into screens or dashboards on http://secure-zabbix.com/zabbix/, will have full JS access to Zabbix.

https://www.zabbix.com/documentation/3.0/manual/installation/requirements