silverwind 5f8e19fcef Move X_FRAME_OPTIONS setting from cors to security section (#30256) ...

## Summary

- Move `cors.X_FRAME_OPTIONS` to `security.X_FRAME_OPTIONS` (old
location still works with a deprecation warning)
- Support `"unset"` as a special value to remove the `X-Frame-Options`
header entirely
- Remove `X-Frame-Options` header from API responses (only set for
web/HTML responses)

## Migration

If you had customized `cors.X_FRAME_OPTIONS`, move it to the
`[security]` section. The old location is deprecated and will be removed
in a future release.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-02-22 20:26:46 +00:00

..

config

Use configurable remote name for git commands (#35172)

2025-08-21 10:14:35 -07:00

actions_test.go

Add actions.WORKFLOW_DIRS setting (#36619)

2026-02-19 01:31:01 +01:00

actions.go

Add actions.WORKFLOW_DIRS setting (#36619)

2026-02-19 01:31:01 +01:00

admin.go

Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688)

2026-02-21 00:56:43 +00:00

api.go

Add API endpoint to request contents of multiple files simultaniously (#34139)

2025-04-22 01:20:11 +08:00

asset_dynamic.go

Use a general approach to access custom/static/builtin assets (#24022)

2023-04-12 18:16:45 +08:00

asset_static.go

Use a general approach to access custom/static/builtin assets (#24022)

2023-04-12 18:16:45 +08:00

attachment_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

attachment.go

various fixes (#36697)

2026-02-22 08:01:43 +01:00

cache.go

Always enable caches (#28527)

2023-12-19 09:29:05 +00:00

camo.go

Use camo.Always instead of camo.Allways (#32097)

2024-09-21 12:50:54 +03:00

config_env_test.go

enforce explanation for necessary nolints and fix bugs (#34883)

2025-06-27 21:48:03 +08:00

config_env.go

chore: add comments for "api/healthz", clean up test env (#36481)

2026-01-30 10:23:38 +08:00

config_provider_test.go

Remove unused functions (#36672)

2026-02-20 22:49:02 +00:00

config_provider.go

Remove unused functions (#36672)

2026-02-20 22:49:02 +00:00

config.go

Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)

2025-12-17 20:50:53 +00:00

cors.go

Move X_FRAME_OPTIONS setting from cors to security section (#30256)

2026-02-22 20:26:46 +00:00

cron_test.go

Fix a bug where lfs gc never worked. (#35198)

2025-08-12 05:38:17 +00:00

cron.go

Replace interface{} with any (#25686)

2023-07-04 18:36:08 +00:00

database_sqlite.go

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

database_test.go

Fix incorrect PostgreSQL connection string for Unix sockets (#28865)

2024-01-20 16:04:47 +00:00

database.go

Add slow SQL query warning (#27545)

2024-02-23 00:57:24 +00:00

federation.go

Remove SHA1 for support for ssh rsa signing (#31857)

2024-09-07 18:05:18 -04:00

git_test.go

Refactor some tests (#34580)

2025-06-03 01:26:19 +00:00

git.go

Refactor git command context & pipeline (#36406)

2026-01-21 01:35:14 +00:00

gloabl_lock.go

Use global lock instead of NewExclusivePool to allow distributed lock between multiple Gitea instances (#31813)

2024-09-06 10:12:41 +00:00

glob.go

Replace gobwas/glob package (#35478)

2025-09-13 18:01:00 +00:00

global_lock_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

global.go

Fix duplicate sub-path for avatars (#31365)

2024-06-15 11:43:57 +08:00

highlight.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

i18n.go

Update i18n.go - Language Picker (#32933)

2024-12-21 04:56:08 +00:00

incoming_email.go

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

indexer_test.go

Update dependencies (#35733)

2025-10-23 08:35:48 +00:00

indexer.go

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

lfs_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

lfs.go

Use 8 as default value for git lfs concurrency (#32421)

2024-11-05 13:10:57 +00:00

log_test.go

Replace interface{} with any (#25686)

2023-07-04 18:36:08 +00:00

log.go

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

mailer_test.go

Use reserved .test TLD for unit tests (#36498)

2026-01-30 19:42:32 +00:00

mailer.go

Email option to embed images as base64 instead of link (#32061)

2025-03-05 16:29:29 +00:00

markup_test.go

Fix markdown render behaviors (#34122)

2025-04-05 11:56:48 +08:00

markup.go

Support rendering OpenAPI spec (#36449)

2026-01-26 10:34:38 +08:00

metrics.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

migrations.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

mime_type_map.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

mirror.go

Run gopls modernize on codebase (#34751)

2025-06-18 01:48:09 +00:00

oauth2_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

oauth2.go

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

other.go

Add [other].SHOW_FOOTER_POWERED_BY setting to hide Powered by (#30253)

2024-04-03 16:01:50 +00:00

packages_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

packages.go

Fix package upload temp path (#34196)

2025-04-14 18:55:02 +08:00

path_test.go

Refactor path & config system (#25330)

2023-06-21 13:50:26 +08:00

path.go

Uniform all temporary directories and allow customizing temp path (#32352)

2025-04-08 16:15:28 +00:00

picture.go

Fix all possible setting error related storages and added some tests (#23911)

2023-06-14 11:42:38 +08:00

project.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

proxy.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00

queue.go

Increase queue length (#27555)

2023-10-10 18:47:49 +08:00

repository_archive_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

repository_archive.go

Fix all possible setting error related storages and added some tests (#23911)

2023-06-14 11:42:38 +08:00

repository.go

various fixes (#36697)

2026-02-22 08:01:43 +01:00

security.go

Move X_FRAME_OPTIONS setting from cors to security section (#30256)

2026-02-22 20:26:46 +00:00

server.go

Make Golang correctly delete temp files during uploading (#36128)

2025-12-11 19:59:42 +01:00

service_test.go

Replace gobwas/glob package (#35478)

2025-09-13 18:01:00 +00:00

service.go

Replace gobwas/glob package (#35478)

2025-09-13 18:01:00 +00:00

session.go

Support selecting theme on the footer (#35741)

2025-10-28 18:25:00 +08:00

setting_test.go

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

setting.go

Fix bug when viewing the commit diff page with non-ANSI files (#36149)

2025-12-13 21:54:03 +08:00

ssh.go

Update x/crypto package and make builtin SSH use default parameters (#34667)

2025-06-09 19:51:02 +00:00

storage_test.go

Enable testifylint rules (#34075)

2025-03-31 01:53:48 -04:00

storage.go

Fix typos: unknow -> unknown, pktLineTypeUnknow -> pktLineTypeUnknown (#36419)

2026-01-22 01:17:06 +00:00

task.go

handle deprecated settings (#22992)

2023-02-20 16:18:26 -06:00

testenv.go

Clean up Makefile, tests and legacy code (#36638)

2026-02-19 01:23:32 +00:00

time.go

Fix settings not being loaded at CLI (#26402)

2024-12-30 05:54:20 +00:00

ui.go

Add FOLDER_ICON_THEME configuration option (#36496)

2026-01-30 20:48:56 +00:00

webhook.go

Refactor the setting to make unit test easier (#22405)

2023-02-20 00:12:01 +08:00