Embed OTRS in an IFrame

[rockdale]

Hi, All:

I am trying to embed OTRS in one of our intranet web page. It is not working because the "X-Frame-" is set to "SAMEORIGIN" by default.

After some research I see there was a bug reported

https://bugs.otrs.org/show_bug.cgi?id=10883

and since fixed

https://github.com/OTRS/otrs/commit/4b4 ... bd90143bc5.

So I changed the Framework.xml configure file to enableIFrame as following

<ConfigItem Name="DisableIFrameOriginRestricted" Required="0" Valid="1">
<Description Translatable="1">Disable HTTP header "X-Frame-Options: SAMEORIGIN" to allow OTRS to be included as an IFrame in other websites. Disabling this HTTP header can be a security issue! Only disable it, if you know what you are doing!</Description>
<Group>Framework</Group>
<SubGroup>Core::Web</SubGroup>
<Setting>
<Option SelectedID="1">
<Item Key="0" Translatable="1">No</Item>
<Item Key="1" Translatable="1">Yes</Item>
</Option>
</Setting>
</ConfigItem>
<ConfigItem Name="DisableContentSecurityPolicy" Required="0" Valid="1">
<Description Translatable="1">Disable HTTP header "Content-Security-Policy" to allow loading of external script contents. Disabling this HTTP header can be a security issue! Only disable it, if you know what you are doing!</Description>
<Group>Framework</Group>
<SubGroup>Core::Web</SubGroup>
<Setting>
<Option SelectedID="1">
<Item Key="0" Translatable="1">No</Item>
<Item Key="1" Translatable="1">Yes</Item>
</Option>
</Setting>
</ConfigItem>

Restart OTRS Daemon. But still OTRS is not showing in the iframe (same reason: X-Frame-Option set to SAMEORIGIN)

Further research (google) bring me to this post

viewtopic.php?f=36&t=26754&p=107347&hil ... me#p107347
It is in Germany and it is before the bug fixed. But I see it talks about clear Template and loader cache - this might be what I am missing - where are the template and cache stored and how do I clear them?

And what other steps I need to do to make OTRS embed in an iframe work?

Thanks in advance.
-Rockdale

[rockdale]

I still cannot get it to work after another day of struggle. There is nobody worked on this before. Can somebody shed some light on this? Thanks a lot
-rockdale

[EXG133]

Just to be sure: you changed all the files mentioned in the git commit and not just the XML?

It's possible you need to use otrs.Console.pl to clear caches:

perl bin/otrs.Console.pl Maint::Cache::Delete
perl bin/otrs.Console.pl Maint::Loader::CacheCleanup

and if you're manually changing configuration XML's you might need to run

perl bin/otrs.Console.pl Maint::Config::Rebuild

PS: full list of console commands: perl bin/otrs.Console.pl --help

[rockdale]

Thank you for the reply.

NO I did not change all the files in the git commit.

When I looked at the Framework.xml the section of "DisableIFrameOriginRestricted" is already there. What I changed is just change the <Option SelectedID="0"> to <Option SelectedID="1"> to enable DisableFrameOriginRestricted and enable DisableContentSecurityPolicy. Since we installed the latest version and I saw that the Framework.xml already contains the changes of the commit, I assumed the other 3 files should contains the changes as well - but I will double check them to confirm.

Thanks for all the perl command, I will try them and report back.

Again, thanks a lot
-rockdale