| 1 |
<?php |
| 2 |
/** |
| 3 |
* Handles the implementation of the Referrer-Policy header for security purposes. |
| 4 |
* |
| 5 |
* @package WP_Defender\Component\Security_Headers |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WP_Defender\Component\Security_Headers; |
| 9 |
|
| 10 |
use WP_Defender\Component\Security_Header; |
| 11 |
|
| 12 |
/** |
| 13 |
* Manages the Referrer-Policy header which controls browser features. |
| 14 |
*/ |
| 15 |
class Sh_Referrer_Policy extends Security_Header { |
| 16 |
|
| 17 |
/** |
| 18 |
* Unique identifier for this security header rule. |
| 19 |
* |
| 20 |
* @var string |
| 21 |
*/ |
| 22 |
public static $rule_slug = 'sh_referrer_policy'; |
| 23 |
|
| 24 |
/** |
| 25 |
* Checks if the Policy should be applied based on the current settings and site configuration. |
| 26 |
* |
| 27 |
* @return bool True if the header should be applied, false otherwise. |
| 28 |
*/ |
| 29 |
public function check() { |
| 30 |
$model = $this->get_model(); |
| 31 |
|
| 32 |
if ( ! $model->sh_referrer_policy ) { |
| 33 |
return false; |
| 34 |
} |
| 35 |
if ( isset( $model->sh_referrer_policy_mode ) && ! empty( $model->sh_referrer_policy_mode ) ) { |
| 36 |
return true; |
| 37 |
} |
| 38 |
$headers = $this->head_request( network_site_url(), self::$rule_slug ); |
| 39 |
if ( is_wp_error( $headers ) ) { |
| 40 |
$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ), wd_internal_log() ); |
| 41 |
|
| 42 |
return false; |
| 43 |
} |
| 44 |
|
| 45 |
return false; |
| 46 |
} |
| 47 |
|
| 48 |
/** |
| 49 |
* Retrieves miscellaneous data related to the Policy. |
| 50 |
* |
| 51 |
* @return array Contains introductory text, mode, and values for the Policy. |
| 52 |
*/ |
| 53 |
public function get_misc_data() { |
| 54 |
$model = $this->get_model(); |
| 55 |
|
| 56 |
return array( |
| 57 |
'intro_text' => esc_html__( |
| 58 |
'The Referrer-Policy HTTP header tells browsers how referrer information should be handled when a user clicks a link that leads to another page or link. A referrer header tells website owners where inbound visitors come from (similar to Google Analytics Acquisition reports), though in some cases you may want to control or restrict the referrer information present in the header.', |
| 59 |
'defender-security' |
| 60 |
), |
| 61 |
'mode' => $model->sh_referrer_policy_mode ?? 'origin-when-cross-origin', |
| 62 |
); |
| 63 |
} |
| 64 |
|
| 65 |
/** |
| 66 |
* Registers hooks related to sending headers. |
| 67 |
*/ |
| 68 |
public function add_hooks() { |
| 69 |
add_action( 'send_headers', array( $this, 'append_header' ) ); |
| 70 |
} |
| 71 |
|
| 72 |
/** |
| 73 |
* Appends the header to the response. |
| 74 |
*/ |
| 75 |
public function append_header() { |
| 76 |
if ( headers_sent() ) { |
| 77 |
return; |
| 78 |
} |
| 79 |
$model = $this->get_model(); |
| 80 |
if ( ! $this->maybe_submit_header( 'Referrer-Policy', false ) ) { |
| 81 |
|
| 82 |
return; |
| 83 |
} |
| 84 |
|
| 85 |
if ( true === $model->sh_referrer_policy |
| 86 |
&& isset( $model->sh_referrer_policy_mode ) |
| 87 |
&& in_array( |
| 88 |
$model->sh_referrer_policy_mode, |
| 89 |
array( |
| 90 |
'no-referrer', |
| 91 |
'no-referrer-when-downgrade', |
| 92 |
'origin', |
| 93 |
'origin-when-cross-origin', |
| 94 |
'same-origin', |
| 95 |
'strict-origin', |
| 96 |
'strict-origin-when-cross-origin', |
| 97 |
'unsafe-url', |
| 98 |
), |
| 99 |
true |
| 100 |
) |
| 101 |
) { |
| 102 |
$headers = 'Referrer-Policy: ' . $model->sh_referrer_policy_mode; |
| 103 |
header( $headers ); |
| 104 |
} |
| 105 |
} |
| 106 |
|
| 107 |
/** |
| 108 |
* Retrieves the title of the Policy. |
| 109 |
* |
| 110 |
* @return string The title of the Policy. |
| 111 |
*/ |
| 112 |
public function get_title() { |
| 113 |
return esc_html__( 'Referrer Policy', 'defender-security' ); |
| 114 |
} |
| 115 |
} |
| 116 |
|
