defender-security / src / model / setting / security-headers.php

security-headers.php in Defender Security – Malware Scanner, Login Security & Firewall 3.0.1, at src/model/setting/security-headers.php

327 lines 7.7 KB

Raw Download Zip

1	<?php
2
3	namespace WP_Defender\Model\Setting;
4
5	use Calotes\Model\Setting;
6	use WP_Defender\Component\Security_Headers\Sh_Content_Type_Options;
7	use WP_Defender\Component\Security_Headers\Sh_Feature_Policy;
8	use WP_Defender\Component\Security_Headers\Sh_Referrer_Policy;
9	use WP_Defender\Component\Security_Headers\Sh_Strict_Transport;
10	use WP_Defender\Component\Security_Headers\Sh_X_Frame;
11	use WP_Defender\Component\Security_Headers\Sh_XSS_Protection;
12
13	class Security_Headers extends Setting {
14	/**
15	* Option name
16	* @var string
17	*/
18	public $table = 'wd_security_headers_settings';
19
20	/**
21	* @var bool
22	* @defender_property
23	*/
24	public $sh_xframe = false;
25	/**
26	* @var string
27	* @defender_property
28	*/
29	public $sh_xframe_mode = 'sameorigin';
30	/**
31	* @var bool
32	* @defender_property
33	*/
34	public $sh_xss_protection = false;
35	/**
36	* @var string
37	* @defender_property
38	*/
39	public $sh_xss_protection_mode = 'sanitize';
40	/**
41	* @var bool
42	* @defender_property
43	*/
44	public $sh_content_type_options = false;
45	/**
46	* @var string
47	* @defender_property
48	*/
49	public $sh_content_type_options_mode = 'nosniff';
50	/**
51	* @var bool
52	* @defender_property
53	*/
54	public $sh_strict_transport = false;
55	/**
56	* @var int
57	* @defender_property
58	*/
59	public $hsts_preload = 0;
60	/**
61	* @var int
62	* @defender_property
63	*/
64	public $include_subdomain = 0;
65	/**
66	* @var string
67	* @defender_property
68	*/
69	public $hsts_cache_duration = '30 days';
70	/**
71	* @var bool
72	* @defender_property
73	*/
74	public $sh_referrer_policy = false;
75	/**
76	* @var string
77	* @defender_property
78	*/
79	public $sh_referrer_policy_mode = 'origin-when-cross-origin';
80	/**
81	* @var bool
82	* @defender_property
83	*/
84	public $sh_feature_policy = false;
85	/**
86	* @var string
87	* @defender_property
88	*/
89	public $sh_feature_policy_mode = 'self';
90	/**
91	* @var string
92	* @defender_property
93	*/
94	public $sh_feature_policy_urls = '';
95	/**
96	* Contains all the data generated by rules
97	* @var array
98	*/
99	public $data = array();
100
101	/**
102	* Define labels for settings key
103	*
104	* @param string\|null $key
105	*
106	* @return string\|array\|null
107	*/
108	public function labels( $key = null ) {
109	$labels = array(
110	'sh_xframe' => __( 'Enable X-Frame-Options', 'wpdef' ),
111	'sh_xframe_mode' => __( 'X-Frame-Options mode', 'wpdef' ),
112	'sh_xss_protection' => __( 'Enable X-XSS-Protection', 'wpdef' ),
113	'sh_xss_protection_mode' => __( 'X-XSS-Protection mode', 'wpdef' ),
114	'sh_content_type_options' => __( 'Enable X-Content-Type-Options', 'wpdef' ),
115	'sh_content_type_options_mode' => __( 'X-Content-Type-Options mode', 'wpdef' ),
116	'sh_strict_transport' => __( 'Enable Strict Transport', 'wpdef' ),
117	'hsts_preload' => __( 'HSTS Preload', 'wpdef' ),
118	'include_subdomain' => __( 'Include Subdomains', 'wpdef' ),
119	'hsts_cache_duration' => __( 'Browser caching', 'wpdef' ),
120	'sh_referrer_policy' => __( 'Enable Referrer Policy', 'wpdef' ),
121	'sh_referrer_policy_mode' => __( 'Referrer Information', 'wpdef' ),
122	'sh_feature_policy' => __( 'Enable Permissions-Policy', 'wpdef' ),
123	'sh_feature_policy_mode' => __( 'Permissions-Policy mode', 'wpdef' ),
124	'sh_feature_policy_urls' => __( 'Specific Origins', 'wpdef' ),
125	);
126
127	if ( ! is_null( $key ) ) {
128	return $labels[ $key ] ?? null;
129	}
130
131	return $labels;
132	}
133
134	/**
135	* Get headers
136	*
137	* @return array
138	*/
139	public function get_headers() {
140	return array(
141	Sh_X_Frame::$rule_slug => new Sh_X_Frame(),
142	Sh_XSS_Protection::$rule_slug => new Sh_XSS_Protection(),
143	Sh_Content_Type_Options::$rule_slug => new Sh_Content_Type_Options(),
144	Sh_Strict_Transport::$rule_slug => new Sh_Strict_Transport(),
145	Sh_Referrer_Policy::$rule_slug => new Sh_Referrer_Policy(),
146	Sh_Feature_Policy::$rule_slug => new Sh_Feature_Policy(),
147	);
148	}
149
150	/**
151	* Filter the security headers and return data as array
152	*
153	* @param bool $sort
154	*
155	* @return array
156	*/
157	public function get_headers_as_array( $sort = false ) {
158	$headers = $this->get_headers();
159	$data = array();
160	foreach ( $headers as $header ) {
161	$data[ $header::$rule_slug ] = array(
162	'slug' => $header::$rule_slug,
163	'title' => $header->get_title(),
164	'diff' => $header->get_misc_data(),
165	);
166	}
167
168	if ( $sort ) {
169	ksort( $data );
170	}
171
172	return $data;
173	}
174
175	/**
176	* @param $key
177	*
178	* @return mixed
179	*/
180	public function get_data_values( $key ) {
181	if ( is_array( $this->data ) && isset( $this->data[ $key ] ) ) {
182	return $this->data[ $key ];
183	}
184
185	return null;
186	}
187
188	/**
189	* @param $key
190	* @param $value
191	*/
192	public function set_data_values( $key, $value ) {
193	if ( null === $value ) {
194	unset( $this->data[ $key ] );
195	} elseif ( is_array( $this->data ) ) {
196	$this->data[ $key ] = $value;
197	}
198	$this->save();
199	}
200
201	public function after_validate() {
202	if ( true === $this->sh_xframe
203	&& ( empty( $this->sh_xframe_mode )
204	\|\| ! in_array( $this->sh_xframe_mode, array( 'sameorigin', 'deny' ), true ) )
205	) {
206	$this->errors[] = __( 'X-Frame-Options mode is invalid', 'wpdef' );
207
208	return false;
209	}
210
211	if ( true === $this->sh_xss_protection
212	&& ( empty( $this->sh_xss_protection_mode )
213	\|\| ! in_array( $this->sh_xss_protection_mode, array( 'sanitize', 'block', 'none' ), true ) )
214	) {
215	$this->errors[] = __( 'X-XSS-Protection mode is invalid', 'wpdef' );
216
217	return false;
218	}
219
220	if ( true === $this->sh_referrer_policy
221	&& ( empty( $this->sh_referrer_policy_mode )
222	\|\| ! in_array(
223	$this->sh_referrer_policy_mode,
224	array(
225	'no-referrer',
226	'no-referrer-when-downgrade',
227	'origin',
228	'origin-when-cross-origin',
229	'same-origin',
230	'strict-origin',
231	'strict-origin-when-cross-origin',
232	'unsafe-url',
233	),
234	true
235	)
236	)
237	) {
238	$this->errors[] = __( 'Referrer Policy mode is invalid', 'wpdef' );
239
240	return false;
241	}
242	}
243
244	/**
245	* Refresh headers
246	*
247	* @return array
248	*/
249	public function refresh_headers() {
250	$defined_headers = $this->get_headers();
251	$enabled = array();
252	foreach ( $defined_headers as $header ) {
253	if ( true === $header->check() ) {
254	$enabled[] = array(
255	'title' => $header->get_title(),
256	);
257	}
258	}
259	return $enabled;
260	}
261
262	/**
263	* Get active, inactive or both types of headers
264	* @param string $type can be active\|inactive\|both
265	*
266	* @return array
267	*/
268	public function get_headers_by_type( $type = 'both' ) {
269	$headers = array(
270	'active' => array(),
271	'inactive' => array(),
272	);
273	if ( ! in_array( $type, ['active', 'inactive', 'both'], true ) ) {
274
275	return $headers;
276	}
277	$url = network_admin_url( 'admin.php?page=wdf-advanced-tools&view=security-headers#' );
278	foreach ( $this->get_headers() as $header ) {
279	$key = true === $header->check() ? 'active' : 'inactive';
280	$headers[ $key ][] = array(
281	'title' => $header->get_title(),
282	'url' => $url . $header::$rule_slug
283	);
284	}
285
286	return 'both' === $type ? $headers : $headers[ $type ];
287	}
288
289	/**
290	* @return bool
291	*/
292	public function is_any_activated() {
293	if (
294	true === $this->sh_xframe
295	\|\| true === $this->sh_xss_protection
296	\|\| true === $this->sh_content_type_options
297	\|\| true === $this->sh_feature_policy
298	\|\| true === $this->sh_strict_transport
299	\|\| true === $this->sh_referrer_policy
300	) {
301	return true;
302	}
303
304	return false;
305	}
306
307	/**
308	* Get enabled headers
309	* @param int $total
310	*
311	* @return array
312	*/
313	public function get_enabled_headers( $total = 3 ) {
314	$defined_headers = $this->get_headers();
315	$enabled = array();
316	foreach ( $defined_headers as $header ) {
317	if ( true === $header->check() ) {
318	$enabled[ $header::$rule_slug ] = array(
319	'title' => $header->get_title(),
320	);
321	}
322	}
323
324	return array_slice( $enabled, 0, $total );
325	}
326	}
327