defender-security / src / component / security-headers / class-sh-x-frame.php

class-sh-x-frame.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.4, at src/component/security-headers/class-sh-x-frame.php

125 lines 3.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles the implementation of the X-Frame header for security purposes.
4	*
5	* @package WP_Defender\Component\Security_Headers
6	*/
7
8	namespace WP_Defender\Component\Security_Headers;
9
10	use WP_Defender\Component\Security_Header;
11
12	/**
13	* Manages the X-Frame header which controls browser features.
14	*/
15	class Sh_X_Frame extends Security_Header {
16
17	/**
18	* Unique identifier for this security header rule.
19	*
20	* @var string
21	*/
22	public static $rule_slug = 'sh_xframe';
23
24	/**
25	* Checks if the Policy should be applied based on the current settings and site configuration.
26	*
27	* @return bool True if the header should be applied, false otherwise.
28	*/
29	public function check() {
30	$model = $this->get_model();
31
32	if ( ! $model->sh_xframe ) {
33	return false;
34	}
35	if ( isset( $model->sh_xframe_mode ) && '' !== $model->sh_xframe_mode ) {
36	return true;
37	}
38	$headers = $this->head_request( network_site_url(), self::$rule_slug );
39	if ( is_wp_error( $headers ) ) {
40	$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ), wd_internal_log() );
41
42	return false;
43	}
44
45	if ( isset( $headers['x-frame-options'] ) ) {
46	$header_xframe = is_array( $headers['x-frame-options'] ) ? $headers['x-frame-options'][0] : $headers['x-frame-options'];
47
48	$content = strtolower( trim( $header_xframe ) );
49	// If deprecated header directive is ALLOW-FROM then redirect to Sameorigin tab.
50	if ( stristr( $content, 'allow-from' ) ) {
51	$model->sh_xframe_mode = 'sameorigin';
52	} elseif ( in_array( strtolower( $content ), array( 'sameorigin', 'deny' ), true ) ) {
53	$model->sh_xframe_mode = strtolower( $content );
54	}
55	$model->save();
56
57	return true;
58	}
59
60	return false;
61	}
62
63	/**
64	* Retrieves miscellaneous data related to the Policy.
65	*
66	* @return array Contains introductory text, mode, and values for the Policy.
67	*/
68	public function get_misc_data() {
69	$model = $this->get_model();
70
71	return array(
72	'intro_text' => sprintf(
73	/* translators: %s: HTML tags. */
74	esc_html__( 'The X-Frame-Options HTTP response header controls whether or not a browser can render a webpage inside a %1$s or %2$s tag. Websites can avoid clickjacking attacks by ensuring that their content isn`t embedded into other websites.', 'defender-security' ),
75	'<frame>, <iframe>',
76	'<object>'
77	),
78	/**
79	* Directive ALLOW-FROM is deprecated.
80	*
81	* @since 2.5.0
82	*/
83	'mode' => ( isset( $model->sh_xframe_mode ) && 'allow-from' !== $model->sh_xframe_mode )
84	? $model->sh_xframe_mode
85	: 'sameorigin',
86	);
87	}
88
89	/**
90	* Registers hooks related to sending headers.
91	*/
92	public function add_hooks() {
93	add_action( 'send_headers', array( $this, 'append_header' ) );
94	}
95
96	/**
97	* Appends the header to the response.
98	*/
99	public function append_header() {
100	if ( headers_sent() ) {
101	return;
102	}
103
104	if ( ! $this->maybe_submit_header( 'X-Frame-Options', false ) ) {
105	return;
106	}
107
108	$model = $this->get_model();
109	$mode = $model->sh_xframe_mode;
110	if ( true === $model->sh_xframe && in_array( $mode, array( 'sameorigin', 'allow-from', 'deny' ), true ) ) {
111	$mode = 'allow-from' === $mode ? 'sameorigin' : $mode;
112	header( trim( 'X-Frame-Options: ' . $mode ) );
113	}
114	}
115
116	/**
117	* Retrieves the title of the Policy.
118	*
119	* @return string The title of the Policy.
120	*/
121	public function get_title() {
122	return esc_html__( 'X-Frame-Options', 'defender-security' );
123	}
124	}
125