get_model(); if ( ! $model->sh_xframe ) { return false; } if ( isset( $model->sh_xframe_mode ) && '' !== $model->sh_xframe_mode ) { return true; } $headers = $this->head_request( network_site_url(), self::$rule_slug ); if ( is_wp_error( $headers ) ) { $this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ), wd_internal_log() ); return false; } if ( isset( $headers['x-frame-options'] ) ) { $header_xframe = is_array( $headers['x-frame-options'] ) ? $headers['x-frame-options'][0] : $headers['x-frame-options']; $content = strtolower( trim( $header_xframe ) ); // If deprecated header directive is ALLOW-FROM then redirect to Sameorigin tab. if ( stristr( $content, 'allow-from' ) ) { $model->sh_xframe_mode = 'sameorigin'; } elseif ( in_array( strtolower( $content ), array( 'sameorigin', 'deny' ), true ) ) { $model->sh_xframe_mode = strtolower( $content ); } $model->save(); return true; } return false; } /** * Retrieves miscellaneous data related to the Policy. * * @return array Contains introductory text, mode, and values for the Policy. */ public function get_misc_data() { $model = $this->get_model(); return array( 'intro_text' => sprintf( /* translators: %s: HTML tags. */ esc_html__( 'The X-Frame-Options HTTP response header controls whether or not a browser can render a webpage inside a %1$s or %2$s tag. Websites can avoid clickjacking attacks by ensuring that their content isn`t embedded into other websites.', 'defender-security' ), ',