update to 6.8.27

class/flask_compress.py

@@ -2,7 +2,7 @@ import sys,os
 from gzip import GzipFile
 from io import BytesIO
 
-from flask import request, current_app,session,Response,g
+from flask import request, current_app,session,Response,g,abort
 
 
 if sys.version_info[:2] == (2, 6):
@@ -80,7 +80,8 @@ class Compress(object):
         accept_encoding = request.headers.get('Accept-Encoding', '')
         response.headers['Server'] = 'nginx'
         response.headers['Connection'] = 'keep-alive'
-
+        if not 'tmp_login' in session:
+            response.headers["X-Frame-Options"] = "SAMEORIGIN"
         if 'dologin' in g and app.config['SSL']:
             try:
                 for k,v in request.cookies.items():
@@ -104,6 +105,23 @@ class Compress(object):
             if request_token:
                 response.set_cookie('request_token',request_token,path='/',max_age=86400 * 30)
 
+        if response.content_length is not None:
+            if response.content_length < 512:
+                if not session.get('login',None) or g.get('api_request',None):
+                    import public
+                    default_pl = "{}/default.pl".format(public.get_panel_path())
+                    default_body = public.readFile(default_pl,'rb')
+
+                    if default_body:
+                        if not default_body: default_body = b""
+                        resp_body = response.get_data()
+
+                        if default_body and resp_body.find(default_body.strip()) != -1:
+                            result = b'{"status":false,"msg":"Error: 403 Forbidden"}'
+                            response.set_data(result)
+                            response.headers['Content-Length'] = len(result)
+                            return response
+
 
         if (response.mimetype not in app.config['COMPRESS_MIMETYPES'] or
             'gzip' not in accept_encoding.lower() or