OMV里耗跛，像shellinabox這種界面里加了iframe的口柳，在omv的設(shè)置里默認(rèn)是打不開(kāi)的，security禁止了显晶。下面說(shuō)一下怎么打開(kāi)贷岸。
原因：
主要是OMV在nginx里加了Content Security Policy的設(shè)置，限制在iframe窗口中打開(kāi)
解決：
vi /etc/nginx/openmediavault-webgui.d/security.conf
1 # Content Security Policy (CSP)
2 # https://www.owasp.org/index.php/Content_Security_Policy
3 add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;";
4
5 # https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
6 #add_header X-Frame-Options "SAMEORIGIN";
7 add_header X-Frame-Options "ALLOW-FROM http://$host";
8
9 # http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
10 add_header X-Content-Type-Options "nosniff";
11
12 # https://wiki.mozilla.org/Security/Features/XSS_Filter
13 # http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx
14 add_header X-XSS-Protection "1; mode=block";
把第三行：
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;";
前面加#號(hào)注釋磷雇。
改完后：
1 # Content Security Policy (CSP)
2 # https://www.owasp.org/index.php/Content_Security_Policy
3 add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;";
4
5 # https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
6 #add_header X-Frame-Options "SAMEORIGIN";
7 add_header X-Frame-Options "ALLOW-FROM http://$host";
8
9 # http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
10 add_header X-Content-Type-Options "nosniff";
11
12 # https://wiki.mozilla.org/Security/Features/XSS_Filter
13 # http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx
14 add_header X-XSS-Protection "1; mode=block";
但是偿警，由于shellinabox的web client是https界面，第一次打開(kāi)唯笙，還是需要先點(diǎn)設(shè)置下的『web client』圖標(biāo)螟蒸，先確認(rèn)https界面提示，然后才能在iframe中打開(kāi)崩掘。
如果https加了證書(shū)的應(yīng)該就不需要七嫌。
