fix: X-Frame-Options/frame-ancestors 改为同源以修复条例弹窗空白

ai_review/security_middleware.py

@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info