http-headers / http-headers.php

http-headers.php in HTTP Headers 1.1.0, at http-headers.php

200 lines 8.0 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: HTTP Headers
4	Plugin URI: http://zinoui.com/blog/http-headers-for-wordpress
5	Description: This plugin adds CORS & security HTTP headers to your website. Improves your website overall security.
6	Version: 1.1.0
7	Author: Dimitar Ivanov
8	Author URI: http://zinoui.com
9	License: GPLv2 or later
10	Text Domain: http-headers
11	*/
12
13	/*
14	This program is free software; you can redistribute it and/or
15	modify it under the terms of the GNU General Public License
16	as published by the Free Software Foundation; either version 2
17	of the License, or (at your option) any later version.
18
19	This program is distributed in the hope that it will be useful,
20	but WITHOUT ANY WARRANTY; without even the implied warranty of
21	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	GNU General Public License for more details.
23
24	You should have received a copy of the GNU General Public License
25	along with this program. If not, see <http://www.gnu.org/copyleft/gpl.html>.
26
27	Copyright (c) 2016 Zino UI
28	*/
29
30	function http_headers() {
31
32	if (get_option('hh_x_frame_options') == 1) {
33	$x_frame_options_value = get_option('hh_x_frame_options_value');
34	if ($x_frame_options_value == 'allow-from') {
35	$x_frame_options_value .= ': ' . get_option('hh_x_frame_options_domain');
36	}
37	header("X-Frame-Options: " . $x_frame_options_value);
38	}
39	if (get_option('hh_x_xxs_protection') == 1) {
40	header("X-XSS-Protection: " . get_option('hh_x_xxs_protection_value'));
41	}
42	if (get_option('hh_x_content_type_options') == 1) {
43	header("X-Content-Type-Options: " . get_option('hh_x_content_type_options_value'));
44	}
45	if (get_option('hh_strict_transport_security') == 1) {
46	header("Strict-Transport-Security: " . get_option('hh_strict_transport_security_value'));
47	}
48	if (get_option('hh_x_ua_compatible') == 1) {
49	header("X-UA-Compatible: " . get_option('hh_x_ua_compatible_value'));
50	}
51	if (get_option('hh_public_key_pins') == 1) {
52	$public_key_pins_sha256_1 = get_option('hh_public_key_pins_sha256_1');
53	$public_key_pins_sha256_2 = get_option('hh_public_key_pins_sha256_2');
54	$public_key_pins_max_age = get_option('hh_public_key_pins_max_age');
55	$public_key_pins_sub_domains = get_option('hh_public_key_pins_sub_domains');
56	$public_key_pins_report_uri = get_option('hh_public_key_pins_report_uri');
57	if (!empty($public_key_pins_sha256_1) && !empty($public_key_pins_sha256_2) && !empty($public_key_pins_max_age)) {
58
59	$public_key_pins = array();
60	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_1);
61	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_2);
62	$public_key_pins[] = sprintf("max-age=%u", $public_key_pins_max_age);
63	if ($public_key_pins_sub_domains) {
64	$public_key_pins[] = "includeSubDomains";
65	}
66	if (!empty($public_key_pins_report_uri)) {
67	$public_key_pins[] = sprintf('report-uri="%s"', $public_key_pins_report_uri);
68	}
69	header(sprintf("Public-Key-Pins: %s", join('; ', $public_key_pins)));
70	}
71	}
72
73	# TODO
74	//header("Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
75
76	if (get_option('hh_access_control_allow_origin') == 1)
77	{
78	$value = get_option('hh_access_control_allow_origin_value');
79	switch ($value)
80	{
81	case 'HTTP_ORIGIN':
82	$value = @$_SERVER['HTTP_ORIGIN'];
83	break;
84	case 'origin':
85	$value = get_option('hh_access_control_allow_origin_url');
86	break;
87	}
88	if (!empty($value))
89	{
90	header("Access-Control-Allow-Origin: " . $value);
91	}
92	}
93	if (get_option('hh_access_control_allow_credentials') == 1)
94	{
95	header("Access-Control-Allow-Credentials: " . get_option('hh_access_control_allow_credentials_value'));
96	}
97	if (get_option('hh_access_control_max_age') == 1)
98	{
99	$value = get_option('hh_access_control_max_age_value');
100	if (!empty($value))
101	{
102	header("Access-Control-Max-Age: " . intval($value));
103	}
104	}
105	if (get_option('hh_access_control_allow_methods') == 1)
106	{
107	$value = get_option('hh_access_control_allow_methods_value');
108	if (!empty($value))
109	{
110	header("Access-Control-Allow-Methods: " . join(', ', array_keys($value)));
111	}
112	}
113	if (get_option('hh_access_control_allow_headers') == 1)
114	{
115	$value = get_option('hh_access_control_allow_headers_value');
116	if (!empty($value))
117	{
118	header("Access-Control-Allow-Headers: " . join(', ', array_keys($value)));
119	}
120	}
121	if (get_option('hh_access_control_expose_headers') == 1)
122	{
123	$value = get_option('hh_access_control_expose_headers_value');
124	if (!empty($value))
125	{
126	header("Access-Control-Expose-Headers: " . join(', ', array_keys($value)));
127	}
128	}
129	if (get_option('hh_p3p') == 1)
130	{
131	$value = get_option('hh_p3p_value');
132	if (!empty($value))
133	{
134	header('P3P: CP="' . join(' ', array_keys($value)) . '"');
135	}
136	}
137	}
138
139	function http_headers_admin_add_page() {
140	add_options_page('HTTP Headers', 'HTTP Headers', 'manage_options', 'http-headers', 'http_headers_admin_page');
141	}
142
143	function http_headers_admin() {
144	register_setting('http-headers-group', 'hh_x_frame_options');
145	register_setting('http-headers-group', 'hh_x_frame_options_value');
146	register_setting('http-headers-group', 'hh_x_frame_options_domain');
147	register_setting('http-headers-group', 'hh_x_xxs_protection');
148	register_setting('http-headers-group', 'hh_x_xxs_protection_value');
149	register_setting('http-headers-group', 'hh_x_content_type_options');
150	register_setting('http-headers-group', 'hh_x_content_type_options_value');
151	register_setting('http-headers-group', 'hh_strict_transport_security');
152	register_setting('http-headers-group', 'hh_strict_transport_security_value');
153	register_setting('http-headers-group', 'hh_public_key_pins');
154	register_setting('http-headers-group', 'hh_public_key_pins_sha256_1');
155	register_setting('http-headers-group', 'hh_public_key_pins_sha256_2');
156	register_setting('http-headers-group', 'hh_public_key_pins_max_age');
157	register_setting('http-headers-group', 'hh_public_key_pins_sub_domains');
158	register_setting('http-headers-group', 'hh_public_key_pins_report_uri');
159	register_setting('http-headers-group', 'hh_x_ua_compatible');
160	register_setting('http-headers-group', 'hh_x_ua_compatible_value');
161	register_setting('http-headers-group', 'hh_p3p');
162	register_setting('http-headers-group', 'hh_p3p_value');
163	register_setting('http-headers-cors', 'hh_access_control_allow_origin');
164	register_setting('http-headers-cors', 'hh_access_control_allow_origin_value');
165	register_setting('http-headers-cors', 'hh_access_control_allow_origin_url');
166	register_setting('http-headers-cors', 'hh_access_control_allow_credentials');
167	register_setting('http-headers-cors', 'hh_access_control_allow_credentials_value');
168	register_setting('http-headers-cors', 'hh_access_control_allow_methods');
169	register_setting('http-headers-cors', 'hh_access_control_allow_methods_value');
170	register_setting('http-headers-cors', 'hh_access_control_allow_headers');
171	register_setting('http-headers-cors', 'hh_access_control_allow_headers_value');
172	register_setting('http-headers-cors', 'hh_access_control_expose_headers');
173	register_setting('http-headers-cors', 'hh_access_control_expose_headers_value');
174	register_setting('http-headers-cors', 'hh_access_control_max_age');
175	register_setting('http-headers-cors', 'hh_access_control_max_age_value');
176	}
177
178	function http_headers_enqueue($hook) {
179	if ( 'http-headers.php' != $hook ) {
180	# FIXME
181	//return;
182	}
183
184	wp_enqueue_script('http_headers_admin_scripts', plugin_dir_url( __FILE__ ) . 'assets/scripts.js');
185	wp_enqueue_style('http_headers_admin_styles', plugin_dir_url( __FILE__ ) . 'assets/styles.css');
186	}
187
188
189	if ( is_admin() ){ // admin actions
190	add_action('admin_menu', 'http_headers_admin_add_page');
191	add_action('admin_init', 'http_headers_admin');
192	add_action('admin_enqueue_scripts', 'http_headers_enqueue');
193	} else {
194	// non-admin enqueues, actions, and filters
195	add_action('send_headers', 'http_headers');
196	}
197
198	function http_headers_admin_page() {
199	include 'views/admin.php';
200	}