MantisBT: master-1.3.x 2e7fac44

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad vboctor master-1.3.x 2016-09-01 06:30 master-1.3.x 35ba0d92
Affected Issues  0012881: Add support for Strict-Transport-Security header
 0021262: Invalid Strict-Transport-Security header when server would already send it anyway
Changeset

Do not set HSTS header

Enabling HTTP Strict-Transport-Security should be a decision made by the
system administrator, and implemented at server level, probably
site-wide and not just for MantisBT's PHP files.

Furthermore, Mantis setting this header causes issues if it is already
set for the server (invalid header), and may have unwanted side effects
as described in 0021262.

This reverts the change implemented to resolve issue 0012881.

Fixes 0021262
mod - core/http_api.php Diff File