Fix: revert removed x-frame-options header in non-debug

src/documents/signals/handlers.py

@@ -784,10 +784,10 @@ def run_workflows(
                         field=field,
                         document=document,
                     ).first()
-                    if instance:
+                    if instance and args[value_field_name] is not None:
                         setattr(instance, value_field_name, args[value_field_name])
                         instance.save()
-                    else:
+                    elif not instance:
                         CustomFieldInstance.objects.create(
                             **args,
                             field=field,

src/paperless/settings.py

@@ -549,6 +549,9 @@ def _parse_remote_user_settings() -> str:
 
 HTTP_REMOTE_USER_HEADER_NAME = _parse_remote_user_settings()
 
+# X-Frame options for embedded PDF display:
+X_FRAME_OPTIONS = "SAMEORIGIN"
+
 # The next 3 settings can also be set using just PAPERLESS_URL
 CSRF_TRUSTED_ORIGINS = __get_list("PAPERLESS_CSRF_TRUSTED_ORIGINS")