| 1 |
<?php |
| 2 |
/** |
| 3 |
* Handles the implementation of the X-Frame header for security purposes. |
| 4 |
* |
| 5 |
* @package WP_Defender\Component\Security_Headers |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WP_Defender\Component\Security_Headers; |
| 9 |
|
| 10 |
use WP_Defender\Component\Security_Header; |
| 11 |
|
| 12 |
/** |
| 13 |
* Manages the X-Frame header which controls browser features. |
| 14 |
*/ |
| 15 |
class Sh_X_Frame extends Security_Header { |
| 16 |
|
| 17 |
/** |
| 18 |
* Unique identifier for this security header rule. |
| 19 |
* |
| 20 |
* @var string |
| 21 |
*/ |
| 22 |
public static $rule_slug = 'sh_xframe'; |
| 23 |
|
| 24 |
/** |
| 25 |
* Checks if the Policy should be applied based on the current settings and site configuration. |
| 26 |
* |
| 27 |
* @return bool True if the header should be applied, false otherwise. |
| 28 |
*/ |
| 29 |
public function check() { |
| 30 |
$model = $this->get_model(); |
| 31 |
|
| 32 |
if ( ! $model->sh_xframe ) { |
| 33 |
return false; |
| 34 |
} |
| 35 |
if ( isset( $model->sh_xframe_mode ) && '' !== $model->sh_xframe_mode ) { |
| 36 |
return true; |
| 37 |
} |
| 38 |
$headers = $this->head_request( network_site_url(), self::$rule_slug ); |
| 39 |
if ( is_wp_error( $headers ) ) { |
| 40 |
$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ), wd_internal_log() ); |
| 41 |
|
| 42 |
return false; |
| 43 |
} |
| 44 |
|
| 45 |
if ( isset( $headers['x-frame-options'] ) ) { |
| 46 |
$header_xframe = is_array( $headers['x-frame-options'] ) ? $headers['x-frame-options'][0] : $headers['x-frame-options']; |
| 47 |
|
| 48 |
$content = strtolower( trim( $header_xframe ) ); |
| 49 |
// If deprecated header directive is ALLOW-FROM then redirect to Sameorigin tab. |
| 50 |
if ( stristr( $content, 'allow-from' ) ) { |
| 51 |
$model->sh_xframe_mode = 'sameorigin'; |
| 52 |
} elseif ( in_array( strtolower( $content ), array( 'sameorigin', 'deny' ), true ) ) { |
| 53 |
$model->sh_xframe_mode = strtolower( $content ); |
| 54 |
} |
| 55 |
$model->save(); |
| 56 |
|
| 57 |
return true; |
| 58 |
} |
| 59 |
|
| 60 |
return false; |
| 61 |
} |
| 62 |
|
| 63 |
/** |
| 64 |
* Retrieves miscellaneous data related to the Policy. |
| 65 |
* |
| 66 |
* @return array Contains introductory text, mode, and values for the Policy. |
| 67 |
*/ |
| 68 |
public function get_misc_data() { |
| 69 |
$model = $this->get_model(); |
| 70 |
|
| 71 |
return array( |
| 72 |
'intro_text' => sprintf( |
| 73 |
/* translators: %s: HTML tags. */ |
| 74 |
esc_html__( 'The X-Frame-Options HTTP response header controls whether or not a browser can render a webpage inside a %1$s or %2$s tag. Websites can avoid clickjacking attacks by ensuring that their content isn`t embedded into other websites.', 'defender-security' ), |
| 75 |
'<frame>, <iframe>', |
| 76 |
'<object>' |
| 77 |
), |
| 78 |
/** |
| 79 |
* Directive ALLOW-FROM is deprecated. |
| 80 |
* |
| 81 |
* @since 2.5.0 |
| 82 |
*/ |
| 83 |
'mode' => ( isset( $model->sh_xframe_mode ) && 'allow-from' !== $model->sh_xframe_mode ) |
| 84 |
? $model->sh_xframe_mode |
| 85 |
: 'sameorigin', |
| 86 |
); |
| 87 |
} |
| 88 |
|
| 89 |
/** |
| 90 |
* Registers hooks related to sending headers. |
| 91 |
*/ |
| 92 |
public function add_hooks() { |
| 93 |
add_action( 'send_headers', array( $this, 'append_header' ) ); |
| 94 |
} |
| 95 |
|
| 96 |
/** |
| 97 |
* Appends the header to the response. |
| 98 |
*/ |
| 99 |
public function append_header() { |
| 100 |
if ( headers_sent() ) { |
| 101 |
return; |
| 102 |
} |
| 103 |
|
| 104 |
if ( ! $this->maybe_submit_header( 'X-Frame-Options', false ) ) { |
| 105 |
return; |
| 106 |
} |
| 107 |
|
| 108 |
$model = $this->get_model(); |
| 109 |
$mode = $model->sh_xframe_mode; |
| 110 |
if ( true === $model->sh_xframe && in_array( $mode, array( 'sameorigin', 'allow-from', 'deny' ), true ) ) { |
| 111 |
$mode = 'allow-from' === $mode ? 'sameorigin' : $mode; |
| 112 |
header( trim( 'X-Frame-Options: ' . $mode ) ); |
| 113 |
} |
| 114 |
} |
| 115 |
|
| 116 |
/** |
| 117 |
* Retrieves the title of the Policy. |
| 118 |
* |
| 119 |
* @return string The title of the Policy. |
| 120 |
*/ |
| 121 |
public function get_title() { |
| 122 |
return esc_html__( 'X-Frame-Options', 'defender-security' ); |
| 123 |
} |
| 124 |
} |
| 125 |
|
