From fb7e9668e7e0caaccef00722f6b565d1ef322530 Mon Sep 17 00:00:00 2001
From: Cameron <e107inc@gmail.com>
Date: Thu, 18 Jan 2018 14:16:43 -0800
Subject: [PATCH] Prevent clickjacking. Remove js/css query string when
 e_HTTP_STATIC is active.

---
 class2.php                   |  1 +
 e107_handlers/js_manager.php | 18 +++++++++---------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/class2.php b/class2.php
index d829c95fb..9c9c9d75d 100644
--- a/class2.php
+++ b/class2.php
@@ -2773,6 +2773,7 @@ class e_http_header
 		}
 
 
+		$this->setHeader('X-Frame-Options: SAMEORIGIN');
 
 		// should come after the Etag header
 		if ($canCache && isset($_SERVER['HTTP_IF_NONE_MATCH']))
diff --git a/e107_handlers/js_manager.php b/e107_handlers/js_manager.php
index 7b95d641d..f79b1ce8a 100644
--- a/e107_handlers/js_manager.php
+++ b/e107_handlers/js_manager.php
@@ -1442,16 +1442,16 @@ class e_jsmanager
 		}
 
 
-
-
-
-		if(strpos($path,'?')!==false)
+		if(!defined('e_HTTP_STATIC'))
 		{
-			$path .= "&amp;".$this->getCacheId();
-		}
-		else
-		{
-			$path .= "?".$this->getCacheId();
+			if(strpos($path,'?')!==false)
+			{
+				$path .= "&amp;".$this->getCacheId();
+			}
+			else
+			{
+				$path .= "?".$this->getCacheId();
+			}
 		}
 
 		return $path;