Duplicate X-Frame-Options

[cherouvim]

Viewing a pdf document preview at /pages/UI.php?operation=details&class=DocumentFile&id=2&c[menu]=Document does not work because:

Refused to display 'https://example.com/' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('sameorigin, '). Falling back to 'deny'.

That's because itop already emits a configurable X-Frame-Options http response header configured at pages/exec.php?exec_module=itop-config&exec_page=config.php&exec_env=production&c%5Bmenu%5D=ConfigEditor with name security_header_xframe. See documentation at https://www.itophub.io/wiki/page?id=3_0_0:admin:itop_configuration_file

security_header_xframe string No New in 2.7.2-2 - Value of the X-Frame-Options HTTP header sent by iTop SAMEORIGIN

The container has /etc/apache2/conf-available/security.conf which specifies this:

Header always set X-Frame-Options "sameorigin"

And this needs to be removed.