Bug 600692, as one example, requires the addition of extra HTTP headers. And there have been various other security specs which require it, some of which we now support natively (e.g. X-XSS-Protection, X-Frame-Options). We should have a hook in Bugzilla::CGI::header() which allows manipulation of HTTP headers. Gerv

This patch converts the data structure in the function to a more hook-friendly hash rather than a list, and passes it to a new hook. Is the "cgi" param necessary, or should a hook just get it from Bugzilla->cgi? It could be that the hook doesn't always have the info it needs to make a decision whether or not to add a particular header, but I'm not sure how to give it more. Gerv

Sorry; forgot to regenerate patch before attaching. :-| Gerv

Comment on attachment 832293 [details] [diff] [review] Patch v.2 The code looks good, but you must document this hook in Bugzilla/Hook.pm and add an example in extensions/Example/Extension.pm.

Thank you. Here is a patch with documentation. Gerv

Comment on attachment 832331 [details] [diff] [review] Patch v.3 r=LpSolit

Gerv forgot to close this bug 3 days ago (and to paste the revision number!). Committing to: bzr+ssh://bzr.mozilla.org/bugzilla/trunk/ modified Bugzilla/CGI.pm modified Bugzilla/Hook.pm modified extensions/Example/Extension.pm Committed revision 8820.

Oops, sorry. Thank you! Gerv

remove tabs: Committing to: bzr+ssh://bjones%40mozilla.com@bzr.mozilla.org/bugzilla/trunk/ modified extensions/Example/Extension.pm Committed revision 8822.

Added to relnotes for 5.0rc1.