gd-security-headers / core / plugin.php

plugin.php in GD Security Headers trunk, at core/plugin.php

155 lines 5.8 KB

Raw Download Zip

1	<?php
2
3	if ( ! defined( 'ABSPATH' ) ) {
4	exit;
5	}
6
7	class gdsih_core_plugin extends d4p_plugin_core {
8	public $svg_icon = 'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+CjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDMyIDMyIiB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHhtbDpzcGFjZT0icHJlc2VydmUiIHhtbG5zOnNlcmlmPSJodHRwOi8vd3d3LnNlcmlmLmNvbS8iIHN0eWxlPSJmaWxsLXJ1bGU6ZXZlbm9kZDtjbGlwLXJ1bGU6ZXZlbm9kZDtzdHJva2UtbGluZWpvaW46cm91bmQ7c3Ryb2tlLW1pdGVybGltaXQ6MjsiPgogICAgPHBhdGggZD0iTTE2LDBDMTQuMTAxLDAuNzMgMTEuOTI5LDEuMjkzIDkuNTk1LDEuNjE3QzcuMTk5LDEuOTUgNC44OTksMS45OTQgMi44MzMsMS43OTFDMi41OTMsMi44IDIuNDY2LDMuODUyIDIuNDY2LDQuOTMyTDIuNDY2LDE4LjQ2NkMyLjQ2NiwyNS45MzYgMTYsMzIgMTYsMzJDMTYsMzIgMjkuNTM0LDI1LjkzNiAyOS41MzQsMTguNDY2TDI5LjUzNCw0LjkzMkMyOS41MzQsMy44NTIgMjkuNDA3LDIuOCAyOS4xNjcsMS43OTFDMjcuMSwxLjk5NCAyNC44MDEsMS45NSAyMi40MDUsMS42MTdDMjAuMDcxLDEuMjkzIDE3Ljg5OSwwLjczIDE2LDBaTTE2LDIuNDY2QzE3LjYwNiwzLjA4MyAxOS40NDQsMy41NiAyMS40MTgsMy44MzRDMjMuNDQ0LDQuMTE1IDI1LjM4OSw0LjE1MiAyNy4xMzgsMy45ODFDMjcuMzQxLDQuODM0IDI3LjQ0OSw1LjcyNCAyNy40NDksNi42MzhMMjcuNDQ5LDE4LjA4NkMyNy40NDksMjQuNDA1IDE2LjAwMSwyOS41MzQgMTYuMDAxLDI5LjUzNEMxNi4wMDEsMjkuNTM0IDQuNTUzLDI0LjQwNCA0LjU1MywxOC4wODZMNC41NTMsNi42MzhDNC41NTMsNS43MjMgNC42Niw0LjgzNSA0Ljg2NCwzLjk4MUM2LjYxMiw0LjE1MiA4LjU1Nyw0LjExNSAxMC41ODQsMy44MzRDMTIuNTU4LDMuNTYgMTQuMzk2LDMuMDgzIDE2LjAwMiwyLjQ2NkwxNiwyLjQ2NlpNMTYsNC4wOUMxNC41ODcsNC42MzMgMTIuOTcsNS4wNTMgMTEuMjMyLDUuMjk0QzkuNDQ5LDUuNTQxIDcuNzM3LDUuNTc0IDYuMTk5LDUuNDI0QzYuMDIxLDYuMTc1IDUuOTI2LDYuOTU4IDUuOTI2LDcuNzYyTDUuOTI2LDE3LjgzNkM1LjkyNiwyMy4zOTcgMTYsMjcuOTExIDE2LDI3LjkxMUMxNiwyNy45MTEgMjYuMDc0LDIzLjM5NyAyNi4wNzQsMTcuODM2TDI2LjA3NCw3Ljc2MkMyNi4wNzQsNi45NTggMjUuOTc5LDYuMTc1IDI1LjgwMSw1LjQyNEMyNC4yNjMsNS41NzUgMjIuNTUxLDUuNTQyIDIwLjc2OCw1LjI5NEMxOS4wMyw1LjA1MiAxNy40MTMsNC42MzMgMTYsNC4wOVpNMTguODU3LDIwLjI4NUwxNiwxNy44MjhMMTMuMTQzLDIwLjI4NUwxMy4xNDMsMTEuNzE0TDE4Ljg1NywxMS43MTRMMTguODU3LDIwLjI4NVoiIHN0eWxlPSJmaWxsOnJnYigxNjcsMTcwLDE3Myk7ZmlsbC1ydWxlOm5vbnplcm87Ii8+Cjwvc3ZnPgo=';
9
10	public $enqueue = true;
11	public $cap = 'gd-security-headers-standard';
12	public $plugin = 'gd-security-headers';
13
14	/** @var d4p_datetime_core */
15	public $datetime;
16
17	private $_ip;
18	private $_ua;
19
20	/** @var bool\|gdsih_component_csp */
21	private $_csp = false;
22	/** @var bool\|gdsih_component_xxp */
23	private $_xxp = false;
24	/** @var bool\|gdsih_component_headers */
25	private $_hdr = false;
26	/** @var bool\|gdsih_component_feature_policy */
27	private $_fep = false;
28
29	public function __construct() {
30	parent::__construct();
31
32	if ( ! defined( 'GDSIH_HTACCESS_FILE_NAME' ) ) {
33	define( 'GDSIH_HTACCESS_FILE_NAME', '.htaccess' );
34	}
35
36	$this->url = GDSIH_URL;
37	$this->datetime = new d4p_datetime_core();
38	}
39
40	public function ip() {
41	return $this->_ip;
42	}
43
44	public function ua() {
45	return $this->_ua;
46	}
47
48	public function plugins_loaded() {
49	parent::plugins_loaded();
50
51	$this->_ip = d4p_visitor_ip();
52	$this->_ua = $this->make_serialized_invalid( sanitize_text_field( d4p_user_agent() ) );
53
54	define( 'GDSIH_WPV', intval( $this->wp_version ) );
55	define( 'GDSIH_WPV_MAJOR', substr( $this->wp_version, 0, 3 ) );
56	define( 'GDSIH_WP_VERSION', $this->wp_version_real );
57
58	do_action( 'gdsih_load_settings' );
59
60	do_action( 'gdsih_plugin_init' );
61
62	$this->load();
63	}
64
65	public function load() {
66	add_action( 'gdsih_saved_the_settings', array( $this, 'htaccess' ) );
67
68	if ( gdsih_settings()->get( 'mode', 'csp' ) != 'disable' ) {
69	require_once( GDSIH_PATH . 'core/objects/core.csp.build.php' );
70	require_once( GDSIH_PATH . 'core/objects/core.csp.php' );
71
72	$this->_csp = new gdsih_component_csp();
73	}
74
75	if ( gdsih_settings()->get( 'x_xss_protection', 'xxp' ) ) {
76	require_once( GDSIH_PATH . 'core/objects/core.xxp.php' );
77
78	$this->_xxp = new gdsih_component_xxp();
79	}
80
81	if ( gdsih_settings()->get( 'protection', 'feature' ) ) {
82	require_once( GDSIH_PATH . 'core/objects/core.feature.build.php' );
83	require_once( GDSIH_PATH . 'core/objects/core.feature.php' );
84
85	$this->_fep = new gdsih_component_feature_policy();
86	}
87
88	require_once( GDSIH_PATH . 'core/objects/core.headers.php' );
89
90	$this->_hdr = new gdsih_component_headers();
91	}
92
93	public function htaccess() {
94	require_once( GDSIH_PATH . 'core/objects/core.htaccess.php' );
95
96	$htaccess = new gdsih_core_htaccess();
97	$status = $htaccess->check();
98
99	if ( $status['automatic'] ) {
100	gdsih_settings()->set( 'htaccess_available', true, 'core' );
101
102	if ( gdsih_settings()->get( 'htaccess' ) ) {
103	gdsih_settings()->set( 'htaccess_added', true, 'core' );
104
105	$htaccess->write();
106	} else {
107	gdsih_settings()->set( 'htaccess_added', false, 'core' );
108
109	$htaccess->reset();
110	}
111
112	gdsih_settings()->save( 'core' );
113	}
114	}
115
116	public function build_headers_to_array() : array {
117	$list = array();
118
119	if ( $this->_csp !== false ) {
120	$list['content-security-policy'] = $this->_csp->csp->build( true );
121	}
122
123	if ( $this->_xxp !== false ) {
124	$list['x-xss-protection'] = $this->_xxp->build( true );
125	}
126
127	if ( $this->_fep !== false ) {
128	$headers = $this->_fep->fep->build( true );
129
130	if ( ! empty( $headers ) ) {
131	foreach ( $headers as $header ) {
132	$parts = explode( ' ', $header, 2 );
133	$list[ strtolower( $parts[0] ) ] = $header;
134	}
135	}
136	}
137
138	$list += $this->_hdr->build( true );
139
140	return $list;
141	}
142
143	private function make_serialized_invalid( $input ) {
144	if ( ! is_string( $input ) \|\| empty( $input ) ) {
145	return $input;
146	}
147
148	if ( is_serialized( $input ) ) {
149	return 'INVALID__' . $input;
150	}
151
152	return $input;
153	}
154	}
155