Sentastico not so sentastic.

[TGates]

Fixed it... You had for your 'SSL Hardening':

Code:

Header always set X-Frame-Options DENY

This blocks iframes. Commented it out and it works just fine now...
Problem solved!

[worksmarter]

Fixed it... You had for your 'SSL Hardening':

Code:

Header always set X-Frame-Options DENY

This blocks iframes. Commented it out and it works just fine now...
Problem solved!

Well no kidding. Can you elaborate on that - that could only have come from what I cut and pasted from the Let'sEncrypt instructions as that is the only thing that was modified after the install.

That would be something to include somewhere - and I wonder why it does not break the installs in VM's???

Where is "'SSL Hardening'" even set at?

---

Well no kidding. Can you elaborate on that -  that could only have come from what I cut and pasted from the Let'sEncrypt instructions as that is the only thing that was modified after the install.

That would be something to include somewhere - and I wonder why it does not break the installs in VM's???

Where is "'SSL Hardening'" even set at?

OK, I know how that got in there. It is included in the instructions on how to get an A+ sercurity rating on your SSL certificate. I would say that procedure needs modified for anyone that is going to install Sentastico. Thanks for finding that - that had not occurred to me...

[TGates]

In the custom vhost setting for Sentora

It probably can be modified to allow iframes within the same domain, but not allow outside use. I remember seeing something about that when I first was trying to sort out the issue.

Although, I eventually plan on putting the sentastico_admin.php inside the controller.ext someday but this requires a LOT of time and motivation. I already did it with the current code to get the package installer inside controller.ext.

[worksmarter]

To be clear on a response for possible future users running into this, it is not a native Sentora issue.

I added it on the direction of a good post on how to get an excellent security rating for you Let'sEncrypt cert. If you secure your panel alone as per that tutorial/guide, that will not cause issues, but if you follow the "hardening" instructions for your certificate as published here in the forums there are two places you will be copying and pasting the problem entries:
One in the file /etc/httpd/conf.d/ssl.conf

Code:

Header always set X-Frame-Options DENY

Which needs commented out.

And one in the Sentora panel @ Admin > Module Admin > Apache Config > Global Sentora Entry

Code:

#Header

always set X-Frame-Options DENY

If you do this from the get-go as I will now, you ill have no issues, but if you run into the failing Sentastico display issue, this is a simple edit and can be found in the Global Sentora entry in the panel.

Thanks for the the assistance TGates!