| 1 |
<?php |
| 2 |
/** |
| 3 |
* Author: Hoang Ngo |
| 4 |
*/ |
| 5 |
|
| 6 |
namespace WP_Defender\Component\Security_Headers; |
| 7 |
|
| 8 |
use WP_Defender\Component\Security_Header; |
| 9 |
|
| 10 |
class Sh_Feature_Policy extends Security_Header { |
| 11 |
static $rule_slug = 'sh_feature_policy'; |
| 12 |
|
| 13 |
public function check() { |
| 14 |
$model = $this->get_model(); |
| 15 |
|
| 16 |
if ( ! $model->sh_feature_policy ) { |
| 17 |
return false; |
| 18 |
} |
| 19 |
if ( isset( $model->sh_feature_policy_mode ) && ! empty( $model->sh_feature_policy_mode ) ) { |
| 20 |
return true; |
| 21 |
} |
| 22 |
$headers = $this->head_request( network_site_url(), self::$rule_slug ); |
| 23 |
if ( is_wp_error( $headers ) ) { |
| 24 |
$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ) ); |
| 25 |
|
| 26 |
return false; |
| 27 |
} |
| 28 |
if ( isset( $headers['feature-policy'] ) ) { |
| 29 |
return true; |
| 30 |
} |
| 31 |
|
| 32 |
return false; |
| 33 |
} |
| 34 |
|
| 35 |
/** |
| 36 |
* @return array |
| 37 |
*/ |
| 38 |
public function get_misc_data() { |
| 39 |
$model = $this->get_model(); |
| 40 |
|
| 41 |
return array( |
| 42 |
'intro_text' => esc_html__( 'The Permissions-Policy response header provides control over what browser features can be used when web pages are embedded in iframes.', 'wpdef' ), |
| 43 |
'mode' => $model->sh_feature_policy_mode ?? 'self', |
| 44 |
'values' => $model->sh_feature_policy_urls ?? '', |
| 45 |
); |
| 46 |
} |
| 47 |
|
| 48 |
public function add_hooks() { |
| 49 |
add_action( 'send_headers', array( $this, 'append_header' ) ); |
| 50 |
add_filter( 'defender_filtering_data_settings', array( $this, 'filtering_headers' ) ); |
| 51 |
} |
| 52 |
|
| 53 |
public function filtering_headers( $data ) { |
| 54 |
if ( ! isset( $data['sh_feature_policy'] ) ) { |
| 55 |
return $data; |
| 56 |
} |
| 57 |
if ( 'origins' !== $data['sh_feature_policy_mode'] || empty( $data['sh_feature_policy_urls'] ) ) { |
| 58 |
return $data; |
| 59 |
} |
| 60 |
$urls = sanitize_textarea_field( $data['sh_feature_policy_urls'] ); |
| 61 |
$urls = explode( PHP_EOL, $urls ); |
| 62 |
$urls = array_map( 'trim', $urls ); |
| 63 |
foreach ( $urls as $key => $url ) { |
| 64 |
if ( false === filter_var( $url, FILTER_VALIDATE_URL ) ) { |
| 65 |
unset( $urls[ $key ] ); |
| 66 |
} |
| 67 |
} |
| 68 |
$data['sh_feature_policy_urls'] = implode( PHP_EOL, $urls ); |
| 69 |
|
| 70 |
return $data; |
| 71 |
} |
| 72 |
|
| 73 |
public function append_header() { |
| 74 |
if ( headers_sent() ) { |
| 75 |
return; |
| 76 |
} |
| 77 |
$model = $this->get_model(); |
| 78 |
if ( ! $this->maybe_submit_header( 'Permissions-Policy', false ) ) { |
| 79 |
|
| 80 |
return; |
| 81 |
} |
| 82 |
|
| 83 |
if ( true === $model->sh_feature_policy |
| 84 |
&& isset( $model->sh_feature_policy_mode ) |
| 85 |
&& in_array( $model->sh_feature_policy_mode, array( 'self', 'allow', 'origins', 'none' ), true ) |
| 86 |
) { |
| 87 |
$headers = ''; |
| 88 |
// @since 2.6.1 |
| 89 |
$features = apply_filters( 'wd_permissions_policy_directives', |
| 90 |
array( |
| 91 |
'accelerometer', |
| 92 |
'autoplay', |
| 93 |
'camera', |
| 94 |
'encrypted-media', |
| 95 |
'fullscreen', |
| 96 |
'geolocation', |
| 97 |
'gyroscope', |
| 98 |
'magnetometer', |
| 99 |
'microphone', |
| 100 |
'midi', |
| 101 |
'payment', |
| 102 |
'usb', |
| 103 |
) |
| 104 |
); |
| 105 |
|
| 106 |
switch ( $model->sh_feature_policy_mode ) { |
| 107 |
case 'self': |
| 108 |
array_walk( |
| 109 |
$features, |
| 110 |
function ( &$value ) { |
| 111 |
$value .= "=(self)"; |
| 112 |
} |
| 113 |
); |
| 114 |
$headers = 'Permissions-Policy: ' . implode( ', ', $features ); |
| 115 |
break; |
| 116 |
case 'allow': |
| 117 |
array_walk( |
| 118 |
$features, |
| 119 |
function ( &$value ) { |
| 120 |
$value .= '=*'; |
| 121 |
} |
| 122 |
); |
| 123 |
$headers = 'Permissions-Policy: ' . implode( ', ', $features ); |
| 124 |
break; |
| 125 |
case 'origins': |
| 126 |
if ( isset( $model->sh_feature_policy_urls ) && ! empty( $model->sh_feature_policy_urls ) ) { |
| 127 |
$urls = explode( PHP_EOL, $model->sh_feature_policy_urls ); |
| 128 |
$urls = array_map( 'trim', $urls ); |
| 129 |
// Wrap strings in quotes. |
| 130 |
array_walk( $urls, function( &$x ) { $x = '"' . $x . '"'; } ); |
| 131 |
$urls = implode( ' ', $urls ); |
| 132 |
array_walk( |
| 133 |
$features, |
| 134 |
function ( &$value ) use ( $urls ) { |
| 135 |
$value .= '=(' . $urls . ')'; |
| 136 |
} |
| 137 |
); |
| 138 |
$headers = 'Permissions-Policy: ' . implode( ', ', $features ); |
| 139 |
} |
| 140 |
break; |
| 141 |
case 'none': |
| 142 |
array_walk( |
| 143 |
$features, |
| 144 |
function ( &$value ) { |
| 145 |
$value .= "=()"; |
| 146 |
} |
| 147 |
); |
| 148 |
$headers = 'Permissions-Policy: ' . implode( ', ', $features ); |
| 149 |
break; |
| 150 |
default: |
| 151 |
break; |
| 152 |
} |
| 153 |
if ( strlen( $headers ) > 0 ) { |
| 154 |
header( trim( $headers ) ); |
| 155 |
} |
| 156 |
} |
| 157 |
} |
| 158 |
|
| 159 |
/** |
| 160 |
* @return string |
| 161 |
*/ |
| 162 |
public function get_title() { |
| 163 |
return __( 'Permissions-Policy', 'wpdef' ); |
| 164 |
} |
| 165 |
} |
| 166 |
|
