defender-security / src / component / class-security-header.php

class-security-header.php in Defender Security – Malware Scanner, Login Security & Firewall 6.0.1, at src/component/class-security-header.php

146 lines 3.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles security headers.
4	*
5	* @package WP_Defender\Component
6	*/
7
8	namespace WP_Defender\Component;
9
10	use Calotes\Base\Component;
11	use WP_Defender\Model\Setting\Security_Headers;
12
13	/**
14	* Base class for managing all security headers.
15	*/
16	abstract class Security_Header extends Component {
17
18	/**
19	* Static variable to store the rule slug.
20	*
21	* @var string
22	*/
23	public static $rule_slug;
24
25	/**
26	* Instance of Security_Headers used for caching.
27	*
28	* @var Security_Headers
29	*/
30	public $model;
31
32	/**
33	* Retrieves miscellaneous data related to the security header.
34	*
35	* @return array Returns an array of miscellaneous data.
36	*/
37	public function get_misc_data() {
38	return array();
39	}
40
41	/**
42	* Checks the condition of the security header.
43	*
44	* @return mixed The result of the check.
45	*/
46	abstract public function check();
47
48	/**
49	* Retrieves the title of the security header.
50	*
51	* @return string The title of the security header.
52	*/
53	abstract public function get_title();
54
55	/**
56	* Adds necessary hooks related to the security header.
57	*
58	* @return void
59	*/
60	abstract public function add_hooks();
61
62	/**
63	* Safely retrieves the model instance, initializing it if not already done.
64	*
65	* @return Security_Headers The instance of Security_Headers.
66	*/
67	protected function get_model() {
68	if ( is_object( $this->model ) ) {
69	return $this->model;
70	}
71
72	$this->model = new Security_Headers();
73	return $this->model;
74	}
75
76	/**
77	* Checks if a specific header is submitted based on the provided conditions.
78	*
79	* @param string $header The header to check.
80	* @param mixed $somewhere Additional condition to evaluate.
81	*
82	* @return bool True if the header is submitted, false otherwise.
83	*/
84	protected function maybe_submit_header( $header, $somewhere ): bool {
85	if ( false === $somewhere ) {
86	return true;
87	}
88	$collection = headers_list();
89	$match = false;
90	foreach ( $collection as $item ) {
91	if ( stristr( $item, $header ) ) {
92	$match = true;
93	}
94	}
95
96	return $match;
97	}
98
99	/**
100	* Performs a HEAD request to a URL and caches the response.
101	*
102	* @param string $url The URL to request.
103	* @param string $origin The origin of the request.
104	* @param int\|null $ttl Time-to-live for the cache entry.
105	*
106	* @return array\|mixed The headers from the response or the WP_Error object if the request fails.
107	*/
108	protected function head_request( $url, $origin, $ttl = null ) {
109	$model = $this->get_model();
110	$cached = $model->get_data_values( 'head_requests' );
111	if ( ! is_array( $cached ) ) {
112	$cached = array();
113	}
114	if ( isset( $cached[ $url ] ) ) {
115	$cache = $cached[ $url ];
116	if ( $cache['ttl'] > time() ) {
117	return $cache['data'];
118	}
119	}
120
121	// No cache or cache expired.
122	$request = wp_remote_head(
123	$url,
124	array( 'user-agent' => 'WP Defender self ping - ' . $origin )
125	);
126	if ( ! is_wp_error( $request ) ) {
127	$headers = wp_remote_retrieve_headers( $request );
128	$headers = $headers->getAll();
129	if ( null === $ttl ) {
130	$ttl = strtotime( '+1 day' );
131	}
132	$headers['response_code'] = wp_remote_retrieve_response_code( $request );
133	$cached[ $url ] = array(
134	'ttl' => apply_filters( 'wd_head_request_ttl', $ttl ),
135	'data' => $headers,
136	);
137	$model->set_data_values( 'head_requests', $cached );
138	$this->log( sprintf( 'Fetched header for %s into cache', $url ), wd_internal_log() );
139
140	return $headers;
141	}
142
143	return $request;
144	}
145	}
146