Glpi: iframe when click on span +

[dvinkic]

• Steps to reproduce (which actions have you made) :

When click on + in created ticket to add new Location new window is open but I see blank page
Same happening when I click on + side on Projects - Group and all other + links

• Expected result :

Open aditional page to add Locations, State, Type,....

• Actual result :

• URL of the page :

• Screenshot of the problem (if pertinent) :

• Your GLPI setup (you can find it in Setup > General menu, System tab) :

GLPI 9.2.1 ( => /var/www/glpi)

PHP 5.6.32 apache2handler (Core, PDO, Phar, Reflection, SPL, SQLite, SimpleXML, Zend OPcache, apache2handler, apc, apcu, bz2,
calendar, ctype, curl, date, dom, ereg, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, igbinary, imap, json, ldap,
libxml, mbstring, mcrypt, memcache, memcached, mhash, mongo, msgpack, mysql, mysqli, mysqlnd, openssl, pcre, pdo_mysql,
pdo_pgsql, pdo_sqlite, pgsql, posix, redis, session, shmop, soap, sockets, sqlite3, standard, sysvmsg, sysvsem, sysvshm,
tokenizer, wddx, xml, xmlreader, xmlwriter, xsl, zip, zlib)
Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files"
upload_max_filesize="2M"
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.32 ()
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36
Server Software: MariaDB Server
Server Version: 5.5.56-MariaDB
Server SQL Mode:
Parameters: glpiuser@localhost/glpidb
Host info: Localhost via UNIX socket

mysqli extension is installed
ctype extension is installed
fileinfo extension is installed
json extension is installed
mbstring extension is installed
zlib extension is installed
curl extension is installed
gd extension is installed
simplexml extension is installed
xml extension is installed
ldap extension is installed
imap extension is installed
Zend OPcache extension is installed
APCu extension is installed
xmlrpc extension is not present
/var/www/glpi/config : OK
/var/www/glpi/files : OK
/var/www/glpi/files/_dumps : OK
/var/www/glpi/files/_sessions : OK
/var/www/glpi/files/_cron : OK
/var/www/glpi/files/_graphs : OK
/var/www/glpi/files/_lock : OK
/var/www/glpi/files/_plugins : OK
/var/www/glpi/files/_tmp : OK
/var/www/glpi/files/_cache : OK
/var/www/glpi/files/_rss : OK
/var/www/glpi/files/_uploads : OK
/var/www/glpi/files/_pictures : OK
/var/www/glpi/files/_log : OK
Web access to files directory is protected : OK
SELinux mode is Disabled

[dvinkic]

I think the problem is with Ajax call. Is it php - ajax issue?

[trasher]

Just tested with current 9.2/bugfixes branch, I cannot reproduce.

Please test with this branch; or check logs (system and GLPI); there must be an error if something goes wrong.

[Dallo71]

its a iFrame related problem.

in my Chrome consolle i've those outputs:

Refused to display 'https://glpi.unimore.it/front/group.form.php?_in_modal=1' in a frame because it set 'X-Frame-Options' to 'deny'. computer.form.php?id=2:1 
Refused to display 'https://glpi.unimore.it/front/state.form.php?_in_modal=1' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN'). Falling back to 'deny'.

I've fixed inserting this line in the [glpi_folder]/.htaccess

Header always set X-Frame-Options SAMEORIGIN

or modify in the same way the file [glpi_folder]/inc/html.class.php at line line
header('x-frame-options:SAMEORIGIN');

[trasher]

We've already seen that (issue with some extra config added from some SSL config files). Anyways, maybe the header stuff may be added to GLPI (not the htacces since it targets only apache webserver).

[dvinkic]

@Dallo71 I tried to put SAMEORIGIN in .htaccesss and in apache conf but the same thing.
in [glpi_folder]/inc/html.class.php is standing SAMEORIGIN

But now I found where is the problem.
In /etc/httpd/conf.d/ssl.conf
found Header always set X-Frame-Options DENY

Change to SAMEORIGIN and every thing works fine.

Thank you all for help

[GitMyk26]

I ran into same issue. But in Apache 2.4.25, it is in apache2/conf-available/security.conf
added
Header set Content-Security-Policy: "frame-ancestors 'self'"
Don't forget to restart Apache2
service apache2 restart

you can also use

Header always set Content-Security-Policy: "frame-ancestors https://yoursite.com"
to really limit it to one site.