| 1 |
<?php |
| 2 |
|
| 3 |
if (!defined('ABSPATH')) { exit; } |
| 4 |
|
| 5 |
class gdsih_admin_settings { |
| 6 |
private $settings; |
| 7 |
|
| 8 |
function __construct() { |
| 9 |
$this->init(); |
| 10 |
} |
| 11 |
|
| 12 |
public function get($panel, $group = '') { |
| 13 |
if ($group == '') { |
| 14 |
return $this->settings[$panel]; |
| 15 |
} else { |
| 16 |
return $this->settings[$panel][$group]; |
| 17 |
} |
| 18 |
} |
| 19 |
|
| 20 |
public function settings($panel) { |
| 21 |
$list = array(); |
| 22 |
|
| 23 |
foreach ($this->settings[$panel] as $obj) { |
| 24 |
foreach ($obj['settings'] as $o) { |
| 25 |
$list[] = $o; |
| 26 |
} |
| 27 |
} |
| 28 |
|
| 29 |
return $list; |
| 30 |
} |
| 31 |
|
| 32 |
private function init() { |
| 33 |
$this->settings = apply_filters('gdsih_admin_internal_settings', array( |
| 34 |
'global' => array( |
| 35 |
'global_main' => array('name' => __("Adding Headers", "gd-security-headers"), 'settings' => array( |
| 36 |
new d4pSettingElement('settings', 'htaccess', __("To .HTACCESS", "gd-security-headers"), __("If enabled, plugin will add all security headers into .HTACCESS file. This is available only on Apache web servers.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('htaccess')) |
| 37 |
)) |
| 38 |
), |
| 39 |
'feature' => array( |
| 40 |
'feature_status' => array('name' => __("Add", "gd-security-headers").': Feature-Policy', 'settings' => array( |
| 41 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 42 |
'<p>'.__("Establishes rules for various features to be exposed by browser, limiting potentially malicious requests.", "gd-security-headers").'</p>' |
| 43 |
, d4pSettingType::INFO), |
| 44 |
new d4pSettingElement('feature', 'protection', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('protection', 'feature')), |
| 45 |
new d4pSettingElement('feature', 'variant', __("Header variant to generate", "gd-security-toolbox"), __("In early September 2020, 'Feature Policy' header has a new version called 'Permissions Policy'. With this option you can generate one or the other, or both.", "gd-security-toolbox"), d4pSettingType::SELECT, gdsih_settings()->get('variant', 'feature'), 'array', $this->get_variants()) |
| 46 |
)) |
| 47 |
), |
| 48 |
'csp' => array( |
| 49 |
'csp_mode' => array('name' => __("Mode", "gd-security-headers"), 'settings' => array( |
| 50 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), __("Before switching to live mode, make sure the CSP is working properly in report mode. Do not use this addon if you don't understand how it works!", "gd-security-headers"), d4pSettingType::INFO), |
| 51 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 52 |
new d4pSettingElement('csp', 'mode', __("Policy Mode", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('mode', 'csp'), 'array', $this->get_modes()) |
| 53 |
)), |
| 54 |
'csp_basic' => array('name' => __("Basics", "gd-security-headers"), 'settings' => array( |
| 55 |
new d4pSettingElement('csp', 'log', __("Log Reports", "gd-security-headers"), __("Plugin will store in events log every CSP report.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('log', 'csp')), |
| 56 |
new d4pSettingElement('csp', 'log_original_policy', __("Log Orginal Policy", "gd-security-headers"), __("Each report contains full original CSP policy that is not very useful to log, and it takes a lot of space. It is sent for reference purposes as a proof that CSP failed because of the element of that policy. You can log it to match it to your real policy as a method to discover eventual HTTP headers tampering.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('log_original_policy', 'csp')), |
| 57 |
new d4pSettingElement('csp', 'log_force_ssl', __("Force SSL for Report URL", "gd-security-headers"), __("In some cases, network home URL for the website might be generated with HTTP even if your website is set to use HTTPS. Enable this option, only if you use HTTPS URL and SSL.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('log_force_ssl', 'csp')) |
| 58 |
)), |
| 59 |
'csp_auto' => array('name' => __("Auto Source Rules", "gd-security-headers"), 'settings' => array( |
| 60 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), __("Due to the way WordPress works, it is highly reccommended to allow inline scripts and style and inline script eval. With these options, plugin will add these sources automatically. If you disable them here, you will need to create rules to cover them or add them manually where you need them.", "gd-security-headers"), d4pSettingType::INFO), |
| 61 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 62 |
new d4pSettingElement('csp', 'auto_inline_rule', __("Unsafe Inline Rule", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_inline_rule', 'csp')), |
| 63 |
new d4pSettingElement('csp', 'auto_eval_rule', __("Unsafe Eval Rule", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_eval_rule', 'csp')), |
| 64 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 65 |
new d4pSettingElement('csp', 'auto_data_rule', __("Data Rule", "gd-security-headers"), __("This might be needed for images or fonts. If you prefer, you can disable this option here, and manually add 'data:' as a custom rule where needed.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_data_rule', 'csp')), |
| 66 |
new d4pSettingElement('csp', 'auto_blob_rule', __("Blob Rule", "gd-security-headers"), __("This might be needed for media, objects or fonts. If you prefer, you can disable this option here, and manually add 'blob:' as a custom rule where needed.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_blob_rule', 'csp')), |
| 67 |
new d4pSettingElement('csp', 'auto_mediastream_rule', __("Mediastream Rule", "gd-security-headers"), __("This might be needed for media, objects or fonts. If you prefer, you can disable this option here, and manually add 'blob:' as a custom rule where needed.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_mediastream_rule', 'csp')), |
| 68 |
new d4pSettingElement('csp', 'auto_filesystem_rule', __("FileSystem Rule", "gd-security-headers"), __("This might be needed for media, objects or fonts. If you prefer, you can disable this option here, and manually add 'blob:' as a custom rule where needed.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('auto_filesystem_rule', 'csp')) |
| 69 |
)), |
| 70 |
'csp_additional' => array('name' => __("Additional CSP Settings", "gd-security-headers"), 'settings' => array( |
| 71 |
new d4pSettingElement('csp', 'upgrade_insecure_requests', __("Upgrade insecure requests", "gd-security-headers"), __("Use this only if your website is configured to use secure HTTPS.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('upgrade_insecure_requests', 'csp')), |
| 72 |
new d4pSettingElement('csp', 'block_all_mixed_content', __("Block all mixed content", "gd-security-headers"), __("Use this only if your website is configured to use secure HTTPS.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('block_all_mixed_content', 'csp')), |
| 73 |
new d4pSettingElement('csp', 'disown_opener', __("Disown Opener", "gd-security-headers"), __("This is not yet widely supported, it works only with some browsers.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('disown_opener', 'csp')) |
| 74 |
)), |
| 75 |
'csp_cdn' => array('name' => __("Automatic generate rules for CDN", "gd-security-toolbox"), 'settings' => array( |
| 76 |
new d4pSettingElement('csp', 'cdn', __("List of CDN domains", "gd-security-toolbox"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('cdn', 'csp'), '', '', array('label_button_add' => __("Add new CDN", "gd-security-toolbox"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 77 |
)), |
| 78 |
'csp_extra' => array('name' => __("Automatic rules for third party services", "gd-security-headers"), 'settings' => array( |
| 79 |
new d4pSettingElement('', '', __("Core Services", "gd-security-headers"), '', d4pSettingType::HR), |
| 80 |
new d4pSettingElement('csp', 'extra_wordpress', __("WordPress.org", "gd-security-headers"), __("WordPress loads various images from official website (thumbnails for plugins or themes, other images), and it should be enabled.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_wordpress', 'csp')), |
| 81 |
new d4pSettingElement('csp', 'extra_gravatar', __("Gravatar", "gd-security-headers"), __("If you are using Gravatar service for user avatars, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_gravatar', 'csp')), |
| 82 |
new d4pSettingElement('', '', __("Google Services", "gd-security-headers"), '', d4pSettingType::HR), |
| 83 |
new d4pSettingElement('csp', 'extra_google_adsense', __("Google Adsense", "gd-security-headers"), __("If you are using Google Adsense, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_adsense', 'csp')), |
| 84 |
new d4pSettingElement('csp', 'extra_google_analytics', __("Google Analytics", "gd-security-headers"), __("If you are using Google Analytics, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_analytics', 'csp')), |
| 85 |
new d4pSettingElement('csp', 'extra_google_fonts', __("Google Fonts", "gd-security-headers"), __("If you are using Google Fonts, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_fonts', 'csp')), |
| 86 |
new d4pSettingElement('csp', 'extra_google_maps', __("Google Maps", "gd-security-headers"), __("If you are using Google Maps, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_maps', 'csp')), |
| 87 |
new d4pSettingElement('csp', 'extra_google_translate', __("Google Translate", "gd-security-headers"), __("If you are using Google Translate or you want to allow your users to use it, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_translate', 'csp')), |
| 88 |
new d4pSettingElement('csp', 'extra_google_youtube', __("Google Youtube", "gd-security-headers"), __("If you are embedding YouTube videos, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_youtube', 'csp')), |
| 89 |
new d4pSettingElement('csp', 'extra_google_tag_manager', __("Google Tag Manager", "gd-security-headers"), __("If you are using Google Tag Manager, this option will automatically append required rules. Also, make sure to enable support for other Google services you are including through Tag Manager.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_google_tag_manager', 'csp')), |
| 90 |
new d4pSettingElement('', '', __("More Services", "gd-security-headers"), '', d4pSettingType::HR), |
| 91 |
new d4pSettingElement('csp', 'extra_gleam', __("Gleam", "gd-security-headers"), __("If you are embedding Gleam based contest, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_gleam', 'csp')), |
| 92 |
new d4pSettingElement('csp', 'extra_vimeo', __("Vimeo", "gd-security-headers"), __("If you are embedding Vimeo videos, this option will automatically append required rules.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('extra_vimeo', 'csp')) |
| 93 |
)), |
| 94 |
'csp_level_1' => array('label' => __("CSP Level 1", "gd-security-toolbox"), 'type' => 'separator'), |
| 95 |
'csp_rules_default' => array('name' => __("Source Rules: Default", "gd-security-headers"), 'settings' => array( |
| 96 |
new d4pSettingElement('csp', 'default_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('default_basic', 'csp'), 'array', $this->get_sources()), |
| 97 |
new d4pSettingElement('csp', 'default_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('default_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 98 |
)), |
| 99 |
'csp_rules_script' => array('name' => __("Source Rules: Script", "gd-security-headers"), 'settings' => array( |
| 100 |
new d4pSettingElement('csp', 'script_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('script_basic', 'csp'), 'array', $this->get_sources()), |
| 101 |
new d4pSettingElement('csp', 'script_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('script_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 102 |
)), |
| 103 |
'csp_rules_style' => array('name' => __("Source Rules: Style", "gd-security-headers"), 'settings' => array( |
| 104 |
new d4pSettingElement('csp', 'style_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('style_basic', 'csp'), 'array', $this->get_sources()), |
| 105 |
new d4pSettingElement('csp', 'style_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('style_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 106 |
)), |
| 107 |
'csp_rules_img' => array('name' => __("Source Rules: Image", "gd-security-headers"), 'settings' => array( |
| 108 |
new d4pSettingElement('csp', 'img_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('img_basic', 'csp'), 'array', $this->get_sources()), |
| 109 |
new d4pSettingElement('csp', 'img_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('img_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 110 |
)), |
| 111 |
'csp_rules_font' => array('name' => __("Source Rules: Font", "gd-security-headers"), 'settings' => array( |
| 112 |
new d4pSettingElement('csp', 'font_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('font_basic', 'csp'), 'array', $this->get_sources()), |
| 113 |
new d4pSettingElement('csp', 'font_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('font_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 114 |
)), |
| 115 |
'csp_rules_object' => array('name' => __("Source Rules: Object", "gd-security-headers"), 'settings' => array( |
| 116 |
new d4pSettingElement('csp', 'object_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('object_basic', 'csp'), 'array', $this->get_sources()), |
| 117 |
new d4pSettingElement('csp', 'object_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('object_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 118 |
)), |
| 119 |
'csp_rules_connect' => array('name' => __("Source Rules: Connect", "gd-security-headers"), 'settings' => array( |
| 120 |
new d4pSettingElement('csp', 'connect_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('connect_basic', 'csp'), 'array', $this->get_sources()), |
| 121 |
new d4pSettingElement('csp', 'connect_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('connect_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 122 |
)), |
| 123 |
'csp_rules_media' => array('name' => __("Source Rules: Media", "gd-security-headers"), 'settings' => array( |
| 124 |
new d4pSettingElement('csp', 'media_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('media_basic', 'csp'), 'array', $this->get_sources()), |
| 125 |
new d4pSettingElement('csp', 'media_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('media_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 126 |
)), |
| 127 |
'csp_rules_frame' => array('name' => __("Obsolote Source Rules: Frame", "gd-security-headers"), 'settings' => array( |
| 128 |
new d4pSettingElement('csp', 'frame_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('frame_basic', 'csp'), 'array', $this->get_sources()), |
| 129 |
new d4pSettingElement('csp', 'frame_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('frame_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 130 |
)), |
| 131 |
'csp_level_2' => array('label' => __("CSP Level 2", "gd-security-toolbox"), 'type' => 'separator'), |
| 132 |
'csp_rules_child' => array('name' => __("Source Rules: Child", "gd-security-headers"), 'settings' => array( |
| 133 |
new d4pSettingElement('csp', 'child_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('child_basic', 'csp'), 'array', $this->get_sources()), |
| 134 |
new d4pSettingElement('csp', 'child_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('child_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 135 |
)), |
| 136 |
'csp_rules_frame-ancestors' => array('name' => __("Experimental Source Rules: Frame Ancestors", "gd-security-headers"), 'settings' => array( |
| 137 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), __("This is experimental CSP source, and is not used by all browsers.", "gd-security-headers"), d4pSettingType::INFO), |
| 138 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 139 |
new d4pSettingElement('csp', 'frame-ancestors_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('frame-ancestors_basic', 'csp'), 'array', $this->get_sources()), |
| 140 |
new d4pSettingElement('csp', 'frame-ancestors_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('frame-ancestors_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 141 |
)), |
| 142 |
'csp_rules_form-action' => array('name' => __("Experimental Source Rules: Form Action", "gd-security-headers"), 'settings' => array( |
| 143 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), __("This is experimental CSP source, and is not used by all browsers.", "gd-security-headers"), d4pSettingType::INFO), |
| 144 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 145 |
new d4pSettingElement('csp', 'form-action_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('form-action_basic', 'csp'), 'array', $this->get_sources()), |
| 146 |
new d4pSettingElement('csp', 'form-action_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('form-action_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 147 |
)), |
| 148 |
'csp_level_3' => array('label' => __("CSP Level 3", "gd-security-toolbox"), 'type' => 'separator'), |
| 149 |
'csp_rules_manifest' => array('name' => __("Source Rules: Manifest", "gd-security-headers"), 'settings' => array( |
| 150 |
new d4pSettingElement('', '', __("Information", "gd-security-toolbox"), __("This is experimental CSP source, and is not used by all browsers", "gd-security-toolbox"), d4pSettingType::INFO), |
| 151 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 152 |
new d4pSettingElement('csp', 'manifest_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('manifest_basic', 'csp'), 'array', $this->get_sources()), |
| 153 |
new d4pSettingElement('csp', 'manifest_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('manifest_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 154 |
)), |
| 155 |
'csp_rules_prefetch' => array('name' => __("Source Rules: Manifest", "gd-security-headers"), 'settings' => array( |
| 156 |
new d4pSettingElement('', '', __("Information", "gd-security-toolbox"), __("This is experimental CSP source, and is not used by all browsers", "gd-security-toolbox"), d4pSettingType::INFO), |
| 157 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 158 |
new d4pSettingElement('csp', 'prefetch_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('prefetch_basic', 'csp'), 'array', $this->get_sources()), |
| 159 |
new d4pSettingElement('csp', 'prefetch_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('prefetch_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 160 |
)), |
| 161 |
'csp_rules_worker' => array('name' => __("Source Rules: Worker", "gd-security-headers"), 'settings' => array( |
| 162 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), __("This is experimental CSP source, and is not used by all browsers", "gd-security-headers"), d4pSettingType::INFO), |
| 163 |
new d4pSettingElement('', '', '', '', d4pSettingType::HR), |
| 164 |
new d4pSettingElement('csp', 'worker_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('worker_basic', 'csp'), 'array', $this->get_sources()), |
| 165 |
new d4pSettingElement('csp', 'worker_custom', __("Custom", "gd-security-headers"), '', d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get('worker_custom', 'csp'), '', '', array('label_button_add' => __("Add new rule", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 166 |
)) |
| 167 |
), |
| 168 |
'xxp' => array( |
| 169 |
'xxp_xss' => array('name' => __("Add", "gd-security-headers").': X-XSS-Protection', 'settings' => array( |
| 170 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 171 |
'<p>'.__("Prevents various types of cross site scripting. It also can log the XXS reportes some browsers can send.", "gd-security-headers").'</p>' |
| 172 |
, d4pSettingType::INFO), |
| 173 |
new d4pSettingElement('xxp','x_xss_protection', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('x_xss_protection', 'xxp')) |
| 174 |
)), |
| 175 |
'xxp_log' => array('name' => __("Log reports", "gd-security-headers"), 'settings' => array( |
| 176 |
new d4pSettingElement('xxp', 'log', __("Log Reports", "gd-security-headers"), __("Plugin will store in events log every CSP report.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('log', 'xxp')), |
| 177 |
new d4pSettingElement('xxp', 'log_force_ssl', __("Force SSL for Report URL", "gd-security-headers"), __("In some cases, network home URL for the website might be generated with HTTP even if your website is set to use HTTPS. Enable this option, only if you use HTTPS URL and SSL.", "gd-security-headers"), d4pSettingType::BOOLEAN, gdsih_settings()->get('log_force_ssl', 'xxp')) |
| 178 |
)) |
| 179 |
), |
| 180 |
'msh' => array( |
| 181 |
'msh_nosniff' => array('name' => __("Add", "gd-security-headers").': X-Content-Type-Options', 'settings' => array( |
| 182 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 183 |
'<ul> |
| 184 |
<li>'.__("Prevents some browsers from MIME sniffing a response away from declared content type. Reduces exposure to some types of attacks.", "gd-security-headers").'</li> |
| 185 |
</ul>' |
| 186 |
, d4pSettingType::INFO), |
| 187 |
new d4pSettingElement('headers','x_content_type_nosniff', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('x_content_type_nosniff', 'headers')) |
| 188 |
)), |
| 189 |
'msh_stricttransportsecurity' => array('name' => __("Add", "gd-security-headers").': Strict-Transport-Security', 'settings' => array( |
| 190 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 191 |
'<ul> |
| 192 |
<li>'.__("This header should strengthen secure connection implementation by forcing user agent to use HTTPS.", "gd-security-headers").'</li> |
| 193 |
<li>'.__("Use only if you use HTTPS on your website!", "gd-security-headers").'</li> |
| 194 |
</ul>' |
| 195 |
, d4pSettingType::INFO), |
| 196 |
new d4pSettingElement('headers','strict_transport_security', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('strict_transport_security', 'headers')), |
| 197 |
new d4pSettingElement('headers','strict_transport_security_max_age', __("Max Age", "gd-security-headers"), '', d4pSettingType::ABSINT, gdsih_settings()->get('strict_transport_security_max_age', 'headers')), |
| 198 |
new d4pSettingElement('headers','strict_transport_security_extra', __("Extras", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('strict_transport_security_extra', 'headers'), 'array', gdsih_strict_transport_security_list()) |
| 199 |
)), |
| 200 |
'msh_referrer_policy' => array('name' => __("Add", "gd-security-headers").': Referrer-Policy', 'settings' => array( |
| 201 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 202 |
'<ul> |
| 203 |
<li>'.__("This header allows website to control how much information browser includes when it navigates away from your website.", "gd-security-headers").'</li> |
| 204 |
</ul>' |
| 205 |
, d4pSettingType::INFO), |
| 206 |
new d4pSettingElement('headers','referrer_policy', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('referrer_policy', 'headers')), |
| 207 |
new d4pSettingElement('headers','referrer_policy_value', __("Policy", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('referrer_policy_value', 'headers'), 'array', gdsih_referrer_policies_list()) |
| 208 |
)), |
| 209 |
'msh_sameorgin' => array('name' => __("Add", "gd-security-headers").': X-Frame-Options', 'settings' => array( |
| 210 |
new d4pSettingElement('', '', __("Information", "gd-security-headers"), |
| 211 |
'<ul> |
| 212 |
<li>'.__("This header controls loading of the website inside the IFRAME. By default, SAMEORIGIN will allow loading of your website in IFRAME that originated from your website. You can disable IFRAME support, or limit it to listed domains.", "gd-security-headers").'</li> |
| 213 |
<li>'.__("This header can be replaced with CSP policy 'frame-src' or 'child-src' directives. If you use that, you don't need X-Frame-Options header.", "gd-security-headers").'</li> |
| 214 |
</ul>' |
| 215 |
, d4pSettingType::INFO), |
| 216 |
new d4pSettingElement('headers','x_frame_options_sameorigin', __("Add Header", "gd-security-headers"), '', d4pSettingType::BOOLEAN, gdsih_settings()->get('x_frame_options_sameorigin', 'headers')), |
| 217 |
new d4pSettingElement('headers','x_frame_options_sameorigin_value', __("Value", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get('x_frame_options_sameorigin_value', 'headers'), 'array', gdsih_x_frame_options_list()), |
| 218 |
new d4pSettingElement('headers','x_frame_options_sameorigin_domains', __("Domains", "gd-security-headers"), '', d4pSettingType::TEXT, gdsih_settings()->get('x_frame_options_sameorigin_domains', 'headers')) |
| 219 |
)) |
| 220 |
|
| 221 |
) |
| 222 |
)); |
| 223 |
|
| 224 |
foreach (gdsih_settings()->features as $feature => $label) { |
| 225 |
$this->settings['feature']['fp_rules_'.$feature] = array('name' => sprintf(__("Rules: %s", "gd-security-headers"), $label), 'settings' => array( |
| 226 |
new d4pSettingElement('feature', $feature.'_basic', __("Basic", "gd-security-headers"), '', d4pSettingType::SELECT, gdsih_settings()->get($feature.'_basic', 'feature'), 'array', $this->get_feature_sources()), |
| 227 |
new d4pSettingElement('feature', $feature.'_custom', __("Custom URL's", "gd-security-headers"), __("Fully qualified URL's with the protocol specified.", "gd-security-headers"), d4pSettingType::EXPANDABLE_TEXT, gdsih_settings()->get($feature.'_custom', 'feature'), '', '', array('label_button_add' => __("Add new URL", "gd-security-headers"), 'width_button_remove' => 40, 'label_buttom_remove' => '<i class="fa fa-minus"></i>')) |
| 228 |
)); |
| 229 |
} |
| 230 |
} |
| 231 |
|
| 232 |
public function get_feature_sources() { |
| 233 |
return array( |
| 234 |
'no' => __("Disabled", "gd-security-headers"), |
| 235 |
'none' => __("None", "gd-security-headers"), |
| 236 |
'all' => __("All", "gd-security-headers"), |
| 237 |
'self' => __("Self", "gd-security-headers"), |
| 238 |
'custom_self' => __("Self and Custom URL's", "gd-security-headers"), |
| 239 |
'custom' => __("Custom URL's Only", "gd-security-headers") |
| 240 |
); |
| 241 |
} |
| 242 |
|
| 243 |
public function get_variants() { |
| 244 |
return array( |
| 245 |
'feature-policy' => __("Only 'Feature Policy'", "gd-security-toolbox"), |
| 246 |
'permissions-policy' => __("Only 'Permissions Policy'", "gd-security-toolbox"), |
| 247 |
'both' => __("Both policies", "gd-security-toolbox") |
| 248 |
); |
| 249 |
} |
| 250 |
|
| 251 |
public function get_modes() { |
| 252 |
return array( |
| 253 |
'disable' => __("Disabled", "gd-security-headers"), |
| 254 |
'report' => __("Report", "gd-security-headers"), |
| 255 |
'live' => __("Live", "gd-security-headers") |
| 256 |
); |
| 257 |
} |
| 258 |
|
| 259 |
public function get_refferrer() { |
| 260 |
return array( |
| 261 |
'no' => __("Disabled", "gd-security-headers"), |
| 262 |
'no-referrer' => __("No referrer", "gd-security-headers"), |
| 263 |
'no-referrer-when-downgrade' => __("No referrer when downgrade", "gd-security-headers"), |
| 264 |
'origin' => __("Origin", "gd-security-headers"), |
| 265 |
'origin-when-cross-origin' => __("Origin when cross origin", "gd-security-headers"), |
| 266 |
'unsafe-url' => __("Unsafe URL", "gd-security-headers") |
| 267 |
); |
| 268 |
} |
| 269 |
|
| 270 |
public function get_sources() { |
| 271 |
return array( |
| 272 |
'no' => __("Disabled", "gd-security-headers"), |
| 273 |
'none' => __("None", "gd-security-headers"), |
| 274 |
'all' => __("All", "gd-security-headers"), |
| 275 |
'self' => __("Self", "gd-security-headers") |
| 276 |
); |
| 277 |
} |
| 278 |
} |
| 279 |
|
