diff --git a/filebrowser/sites.py b/filebrowser/sites.py index 1937128..65d8ea3 100644 --- a/filebrowser/sites.py +++ b/filebrowser/sites.py @@ -20,6 +20,7 @@ from django.core.paginator import Paginator, InvalidPage, EmptyPage from django.utils.encoding import smart_text from django.contrib import messages +from django.views.decorators.clickjacking import xframe_options_sameorigin from django.views.decorators.csrf import csrf_exempt from django.core.files.storage import DefaultStorage, default_storage, FileSystemStorage @@ -172,7 +173,7 @@ def handle_file_upload(path, file, site): def filebrowser_view(view): "Only let staff browse the files" - return staff_member_required(never_cache(view)) + return staff_member_required(never_cache(xframe_options_sameorigin(view))) class FileBrowserSite(object):