| 1 |
<?php |
| 2 |
|
| 3 |
if (!defined('ABSPATH')) { exit; } |
| 4 |
|
| 5 |
class gdsih_admin_core extends d4p_admin_core { |
| 6 |
public $plugin = 'gd-security-headers'; |
| 7 |
|
| 8 |
function __construct() { |
| 9 |
parent::__construct(); |
| 10 |
|
| 11 |
$this->url = GDSIH_URL; |
| 12 |
|
| 13 |
add_action('gdsih_plugin_init', array($this, 'core')); |
| 14 |
} |
| 15 |
|
| 16 |
public function core() { |
| 17 |
parent::core(); |
| 18 |
|
| 19 |
add_action('network_admin_menu', array($this, 'admin_menu')); |
| 20 |
|
| 21 |
add_filter('set-screen-option', array($this, 'screen_options_grid_rows_save'), 10, 3); |
| 22 |
|
| 23 |
$this->init_ready(); |
| 24 |
|
| 25 |
if (gdsih_scope()->is_master_network_admin()) { |
| 26 |
if (gdsih_settings()->is_install()) { |
| 27 |
add_action('admin_notices', array($this, 'install_notice')); |
| 28 |
} |
| 29 |
|
| 30 |
if (gdsih_settings()->is_update()) { |
| 31 |
add_action('admin_notices', array($this, 'update_notice')); |
| 32 |
} |
| 33 |
} |
| 34 |
} |
| 35 |
|
| 36 |
public function screen_options_grid_rows_save($status, $option, $value) { |
| 37 |
if (in_array($option, array( |
| 38 |
'gdsih_rows_per_page_csp_reports', |
| 39 |
'gdsih_rows_per_page_xxp_reports'))) { |
| 40 |
return $value; |
| 41 |
} |
| 42 |
|
| 43 |
return $status; |
| 44 |
} |
| 45 |
|
| 46 |
public function screen_options_grid_rows_csp_reports() { |
| 47 |
$key = 'gdsih_rows_per_page_csp_reports'; |
| 48 |
|
| 49 |
$args = array( |
| 50 |
'label' => __("Rows", "gd-security-headers"), |
| 51 |
'default' => 25, 'option' => $key |
| 52 |
); |
| 53 |
|
| 54 |
add_screen_option('per_page', $args); |
| 55 |
|
| 56 |
require_once(GDSIH_PATH.'core/grids/csp.php'); |
| 57 |
|
| 58 |
new gdsih_csp_report_grid(); |
| 59 |
} |
| 60 |
|
| 61 |
public function screen_options_grid_rows_xxp_reports() { |
| 62 |
$key = 'gdsih_rows_per_page_xxp_reports'; |
| 63 |
|
| 64 |
$args = array( |
| 65 |
'label' => __("Rows", "gd-security-headers"), |
| 66 |
'default' => 25, 'option' => $key |
| 67 |
); |
| 68 |
|
| 69 |
add_screen_option('per_page', $args); |
| 70 |
|
| 71 |
require_once(GDSIH_PATH.'core/grids/xxp.php'); |
| 72 |
|
| 73 |
new gdsih_xxp_report_grid(); |
| 74 |
} |
| 75 |
|
| 76 |
public function install_notice() { |
| 77 |
if (current_user_can('install_plugins') && $this->page === false) { |
| 78 |
echo '<div class="updated"><p>'; |
| 79 |
echo __("GD Security Headers is activated and it needs to finish installation.", "gd-security-headers"); |
| 80 |
echo ' <a href="'.network_admin_url('admin.php?page=gd-security-headers-front').'">'.__("Click Here", "gd-security-headers").'</a>.'; |
| 81 |
echo '</p></div>'; |
| 82 |
} |
| 83 |
} |
| 84 |
|
| 85 |
public function update_notice() { |
| 86 |
if (current_user_can('install_plugins') && $this->page === false) { |
| 87 |
echo '<div class="updated"><p>'; |
| 88 |
echo __("GD Security Headers is updated and it needs to finish the update process.", "gd-security-headers"); |
| 89 |
echo ' <a href="'.network_admin_url('admin.php?page=gd-security-headers-front').'">'.__("Click Here", "gd-security-headers").'</a>.'; |
| 90 |
echo '</p></div>'; |
| 91 |
} |
| 92 |
} |
| 93 |
|
| 94 |
public function init_ready() { |
| 95 |
$this->menu_items = array( |
| 96 |
'front' => array('title' => __("Overview", "gd-security-headers"), 'icon' => 'home'), |
| 97 |
'about' => array('title' => __("About", "gd-security-headers"), 'icon' => 'info-circle'), |
| 98 |
'csp-reports' => array('title' => __("CSP Reports", "gd-security-headers"), 'icon' => 'info-circle'), |
| 99 |
'xxp-reports' => array('title' => __("XXP Reports", "gd-security-headers"), 'icon' => 'info-circle'), |
| 100 |
'settings' => array('title' => __("Settings", "gd-security-headers"), 'icon' => 'cogs'), |
| 101 |
'tools' => array('title' => __("Tools", "gd-security-headers"), 'icon' => 'wrench') |
| 102 |
); |
| 103 |
} |
| 104 |
|
| 105 |
public function admin_init() { |
| 106 |
d4p_include('grid', 'admin', GDSIH_D4PLIB); |
| 107 |
|
| 108 |
do_action('gdsih_admin_init'); |
| 109 |
} |
| 110 |
|
| 111 |
public function title() { |
| 112 |
return 'GD Security Headers'; |
| 113 |
} |
| 114 |
|
| 115 |
public function admin_menu() { |
| 116 |
if (is_multisite() && is_blog_admin()) { |
| 117 |
return; |
| 118 |
} |
| 119 |
|
| 120 |
$parent = 'gd-security-headers-front'; |
| 121 |
|
| 122 |
$this->page_ids[] = add_menu_page( |
| 123 |
'GD Security Headers', |
| 124 |
'Security Headers', |
| 125 |
gdsih()->cap, |
| 126 |
$parent, |
| 127 |
array($this, 'panel_general'), |
| 128 |
gdsih()->svg_icon); |
| 129 |
|
| 130 |
foreach($this->menu_items as $item => $data) { |
| 131 |
$this->page_ids[] = add_submenu_page($parent, |
| 132 |
'GD Security Headers: '.$data['title'], |
| 133 |
$data['title'], |
| 134 |
gdsih()->cap, |
| 135 |
'gd-security-headers-'.$item, |
| 136 |
array($this, 'panel_general')); |
| 137 |
} |
| 138 |
|
| 139 |
$this->admin_load_hooks(); |
| 140 |
} |
| 141 |
|
| 142 |
public function enqueue_scripts($hook) { |
| 143 |
$load_admin_data = false; |
| 144 |
|
| 145 |
if ($this->page !== false) { |
| 146 |
d4p_admin_enqueue_defaults(); |
| 147 |
|
| 148 |
wp_enqueue_script('jquery-form'); |
| 149 |
|
| 150 |
wp_enqueue_style('fontawesome', GDSIH_URL.'d4plib/resources/fontawesome/css/font-awesome.min.css'); |
| 151 |
|
| 152 |
wp_enqueue_style('d4plib-font', $this->file('css', 'font', true), array(), D4P_VERSION); |
| 153 |
wp_enqueue_style('d4plib-shared', $this->file('css', 'shared', true), array(), D4P_VERSION); |
| 154 |
wp_enqueue_style('d4plib-admin', $this->file('css', 'admin', true), array('d4plib-shared'), D4P_VERSION); |
| 155 |
|
| 156 |
wp_enqueue_script('d4plib-shared', $this->file('js', 'shared', true), array('jquery', 'wp-color-picker'), D4P_VERSION, true); |
| 157 |
wp_enqueue_script('d4plib-admin', $this->file('js', 'admin', true), array('d4plib-shared'), D4P_VERSION, true); |
| 158 |
|
| 159 |
wp_enqueue_style('gdsih-plugin', $this->file('css', 'plugin'), array('d4plib-admin', 'wp-jquery-ui-dialog'), gdsih_settings()->file_version()); |
| 160 |
wp_enqueue_script('gdsih-plugin', $this->file('js', 'plugin'), array('d4plib-admin', 'wpdialogs'), gdsih_settings()->file_version(), true); |
| 161 |
|
| 162 |
if ($this->page == 'about') { |
| 163 |
wp_enqueue_style('d4plib-grid', $this->file('css', 'grid', true), array(), D4P_VERSION.'.'.D4P_BUILD); |
| 164 |
} |
| 165 |
|
| 166 |
$_data = array( |
| 167 |
'nonce' => wp_create_nonce('gdsih-admin-internal'), |
| 168 |
'wp_version' => GDSIH_WPV, |
| 169 |
'page' => $this->page, |
| 170 |
'panel' => $this->panel, |
| 171 |
'button_icon_ok' => '<i class="fa fa-check fa-fw" aria-hidden="true"></i> ', |
| 172 |
'button_icon_cancel' => '<i class="fa fa-times fa-fw" aria-hidden="true"></i> ', |
| 173 |
'button_icon_delete' => '<i class="fa fa-trash fa-fw" aria-hidden="true"></i> ', |
| 174 |
'dialog_button_ok' => __("OK", "gd-security-headers"), |
| 175 |
'dialog_button_cancel' => __("Cancel", "gd-security-headers"), |
| 176 |
'dialog_button_delete' => __("Delete", "gd-security-headers"), |
| 177 |
'dialog_button_remove' => __("Remove", "gd-security-headers"), |
| 178 |
'dialog_button_clear' => __("Clear", "gd-security-headers"), |
| 179 |
'dialog_title_areyousure' => __("Are you sure you want to do this?", "gd-security-headers"), |
| 180 |
'dialog_content_pleasewait' => __("Please Wait...", "gd-security-headers") |
| 181 |
); |
| 182 |
|
| 183 |
wp_localize_script('gdsih-plugin', 'gdsih_data', $_data); |
| 184 |
|
| 185 |
$load_admin_data = true; |
| 186 |
} |
| 187 |
|
| 188 |
if ($load_admin_data) { |
| 189 |
wp_localize_script('d4plib-shared', 'd4plib_admin_data', array( |
| 190 |
'string_media_image_title' => __("Select Image", "gd-security-headers"), |
| 191 |
'string_media_image_button' => __("Use Selected Image", "gd-security-headers"), |
| 192 |
'string_are_you_sure' => __("Are you sure you want to do this?", "gd-security-headers"), |
| 193 |
'string_image_not_selected' => __("Image not selected.", "gd-security-headers") |
| 194 |
)); |
| 195 |
} |
| 196 |
} |
| 197 |
|
| 198 |
public function admin_load_hooks() { |
| 199 |
foreach ($this->page_ids as $id) { |
| 200 |
add_action('load-'.$id, array($this, 'load_admin_page')); |
| 201 |
} |
| 202 |
|
| 203 |
add_action('load-security-headers_page_gd-security-headers-csp-reports', array($this, 'screen_options_grid_rows_csp_reports')); |
| 204 |
add_action('load-security-headers_page_gd-security-headers-xxp-reports', array($this, 'screen_options_grid_rows_xxp_reports')); |
| 205 |
} |
| 206 |
|
| 207 |
public function current_screen($screen) { |
| 208 |
if (isset($_GET['panel']) && $_GET['panel'] != '') { |
| 209 |
$this->panel = d4p_sanitize_slug($_GET['panel']); |
| 210 |
} |
| 211 |
|
| 212 |
$id = $screen->id; |
| 213 |
|
| 214 |
if (gdsih_scope()->is_network_admin()) { |
| 215 |
if ($id == 'toplevel_page_gd-security-headers-front-network') { |
| 216 |
$this->page = 'front'; |
| 217 |
} else if (substr($id, 0, 42) == 'security-headers_page_gd-security-headers-') { |
| 218 |
$this->page = substr($id, 42, strlen($id) - 50); |
| 219 |
} |
| 220 |
} else { |
| 221 |
if ($id == 'toplevel_page_gd-security-headers-front') { |
| 222 |
$this->page = 'front'; |
| 223 |
} else if (substr($id, 0, 42) == 'security-headers_page_gd-security-headers-') { |
| 224 |
$this->page = substr($id, 42); |
| 225 |
} |
| 226 |
} |
| 227 |
|
| 228 |
if (is_super_admin()) { |
| 229 |
if (isset($_POST['gdsih_handler']) && $_POST['gdsih_handler'] == 'postback') { |
| 230 |
require_once(GDSIH_PATH.'core/admin/postback.php'); |
| 231 |
|
| 232 |
new gdsih_admin_postback(); |
| 233 |
} else if (isset($_GET['gdsih_handler']) && $_GET['gdsih_handler'] == 'getback') { |
| 234 |
require_once(GDSIH_PATH.'core/admin/getback.php'); |
| 235 |
|
| 236 |
new gdsih_admin_getback(); |
| 237 |
} |
| 238 |
} |
| 239 |
} |
| 240 |
|
| 241 |
public function help_tab_getting_help() { |
| 242 |
if ($this->panel == 'csp') { |
| 243 |
get_current_screen()->add_help_tab( |
| 244 |
array( |
| 245 |
'id' => 'gdsec-help-settings-csp-header', |
| 246 |
'title' => __("CSP Header", "gd-security-headers"), |
| 247 |
'content' => $this->help_csp_header() |
| 248 |
) |
| 249 |
); |
| 250 |
|
| 251 |
get_current_screen()->add_help_tab( |
| 252 |
array( |
| 253 |
'id' => 'gdsih-help-settings-csp-res', |
| 254 |
'title' => __("CSP Resources", "gd-security-headers"), |
| 255 |
'content' => $this->help_csp_resources() |
| 256 |
) |
| 257 |
); |
| 258 |
} |
| 259 |
|
| 260 |
get_current_screen()->add_help_tab( |
| 261 |
array( |
| 262 |
'id' => 'd4p-help-info', |
| 263 |
'title' => __("Getting Help", "gd-security-headers"), |
| 264 |
'content' => '<p>'.__("To get help with this plugin, you can start with Knowledge Base list of frequently asked questions and articles. If you have any questions, or you want to report a bug, or you have a suggestion, you can use support forum. All important links for this are on the right side of this help dialog.", "gd-security-headers").'</p>' |
| 265 |
) |
| 266 |
); |
| 267 |
} |
| 268 |
|
| 269 |
public function help_csp_header() { |
| 270 |
$render = '<p>'.__("There are few more things you need to think about when setting up this rating addon.", "gd-security-headers").'</p>'; |
| 271 |
$render.= '<ul>'; |
| 272 |
$render.= '<li>'.__("Do not switch to the Live policy mode before you make all the tests with the Report policy mode.", "gd-security-headers").'</li>'; |
| 273 |
$render.= '<li>'.__("During the testing phase, it is best to disable Log option, or you will end up with a lot of reports logged. Use Log feature when you switch to Live policy mode.", "gd-security-headers").'</li>'; |
| 274 |
$render.= '<li>'.__("To test CSP, use Google Chrome or Mozilla Firefox with Firebug. But will display detailed information in the Console about each CSP issue.", "gd-security-headers").'</li>'; |
| 275 |
$render.= '</ul>'; |
| 276 |
$render.= '<p>'.__("To make sure you add valid sources to all source rules, here are few examples on what is accepted by the browsers. You can use '*' character as wildcard.", "gd-security-headers").'</p>'; |
| 277 |
$render.= '<ul>'; |
| 278 |
$render.= '<li><strong>https:</strong> - '.__("Matches any url over HTTPS scheme.", "gd-security-headers").'</li>'; |
| 279 |
$render.= '<li><strong>example.com</strong> - '.__("Matches both HTTP and HTTPS version of the URL.", "gd-security-headers").'</li>'; |
| 280 |
$render.= '<li><strong>https://*.example.com</strong> - '.__("Matches HTTPS subdomains for the URL, but now the main domain.", "gd-security-headers").'</li>'; |
| 281 |
$render.= '<li><strong>www.example.com:443</strong> - '.__("Matches exact domain URL, with the specified port.", "gd-security-headers").'</li>'; |
| 282 |
$render.= '<li><strong>*://*.example.com:*</strong> - '.__("Matches any scheme for subdomain and any port, but not the main domain.", "gd-security-headers").'</li>'; |
| 283 |
$render.= '<li><strong>www.example.com</strong> - '.__("Matches exact domain URL, no other subdomains.", "gd-security-headers").'</li>'; |
| 284 |
$render.= '</ul>'; |
| 285 |
|
| 286 |
return $render; |
| 287 |
} |
| 288 |
|
| 289 |
public function help_csp_resources() { |
| 290 |
$render = '<p>'.__("To get more information about the Content Security Policy, check out these online resources.", "gd-security-headers").'</p>'; |
| 291 |
$render.= '<ul>'; |
| 292 |
$render.= '<li><a href="https://content-security-policy.com/" target="_blank">Content Security Policy (CSP) Quick Reference Guide</a></li>'; |
| 293 |
$render.= '<li><a href="https://www.w3.org/TR/CSP/" target="_blank">W3C - Content Security Policy</a></li>'; |
| 294 |
$render.= '</ul>'; |
| 295 |
|
| 296 |
return $render; |
| 297 |
} |
| 298 |
|
| 299 |
public function load_admin_page() { |
| 300 |
$this->help_tab_sidebar(); |
| 301 |
|
| 302 |
do_action('gdsih_load_admin_page_'.$this->page); |
| 303 |
|
| 304 |
if ($this->panel !== false && $this->panel != '') { |
| 305 |
do_action('gdsih_load_admin_page_'.$this->page.'_'.$this->panel); |
| 306 |
} |
| 307 |
|
| 308 |
$this->help_tab_getting_help(); |
| 309 |
} |
| 310 |
|
| 311 |
public function install_or_update() { |
| 312 |
$install = gdsih_settings()->is_install(); |
| 313 |
$update = gdsih_settings()->is_update(); |
| 314 |
|
| 315 |
if ($install) { |
| 316 |
include(GDSIH_PATH.'forms/install.php'); |
| 317 |
} else if ($update) { |
| 318 |
include(GDSIH_PATH.'forms/update.php'); |
| 319 |
} |
| 320 |
|
| 321 |
return $install || $update; |
| 322 |
} |
| 323 |
|
| 324 |
public function panel_general() { |
| 325 |
if (!$this->install_or_update()) { |
| 326 |
$path = GDSIH_PATH.'forms/'.$this->page.'.php'; |
| 327 |
|
| 328 |
$path = apply_filters('gdsih_admin_panel_'.$this->page, $path); |
| 329 |
|
| 330 |
include($path); |
| 331 |
} |
| 332 |
} |
| 333 |
|
| 334 |
public function current_url($with_panel = true) { |
| 335 |
$page = 'admin.php?page=gd-security-headers-'; |
| 336 |
|
| 337 |
$page.= $this->page; |
| 338 |
|
| 339 |
if ($with_panel && $this->panel !== false && $this->panel != '') { |
| 340 |
$page.= '&panel='.$this->panel; |
| 341 |
} |
| 342 |
|
| 343 |
return self_admin_url($page); |
| 344 |
} |
| 345 |
} |
| 346 |
|
| 347 |
global $_gdsih_core_admin; |
| 348 |
$_gdsih_core_admin = new gdsih_admin_core(); |
| 349 |
|
| 350 |
function gdsih_admin() { |
| 351 |
global $_gdsih_core_admin; |
| 352 |
return $_gdsih_core_admin; |
| 353 |
} |
| 354 |
|
