http-headers / http-headers.php

http-headers.php in HTTP Headers 1.1.2, at http-headers.php

229 lines 9.4 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: HTTP Headers
4	Plugin URI: http://zinoui.com/blog/http-headers-for-wordpress
5	Description: This plugin adds CORS & security HTTP headers to your website. Improves your website overall security.
6	Version: 1.1.2
7	Author: Dimitar Ivanov
8	Author URI: http://zinoui.com
9	License: GPLv2 or later
10	Text Domain: http-headers
11	*/
12
13	/*
14	This program is free software; you can redistribute it and/or
15	modify it under the terms of the GNU General Public License
16	as published by the Free Software Foundation; either version 2
17	of the License, or (at your option) any later version.
18
19	This program is distributed in the hope that it will be useful,
20	but WITHOUT ANY WARRANTY; without even the implied warranty of
21	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	GNU General Public License for more details.
23
24	You should have received a copy of the GNU General Public License
25	along with this program. If not, see <http://www.gnu.org/copyleft/gpl.html>.
26
27	Copyright (c) 2016 Zino UI
28	*/
29
30	if (get_option('hh_strict_transport_security_max_age') === false) {
31	$value = get_option('hh_strict_transport_security_value');
32	$max_age = preg_match('/max-age=(\d+)/', $value, $match) ? $match[1] : 0;
33	$sub_domains = strpos($value, 'includeSubDomains') !== false ? 1 : 0;
34	add_option('hh_strict_transport_security_max_age', $max_age, null, 'yes');
35	add_option('hh_strict_transport_security_sub_domains', $sub_domains, null, 'yes');
36	add_option('hh_strict_transport_security_preload', 0, null, 'yes');
37	}
38
39	function http_headers() {
40
41	if (get_option('hh_x_frame_options') == 1) {
42	$x_frame_options_value = strtoupper(get_option('hh_x_frame_options_value'));
43	if ($x_frame_options_value == 'ALLOW-FROM') {
44	$x_frame_options_value .= ' ' . get_option('hh_x_frame_options_domain');
45	}
46	header("X-Frame-Options: " . $x_frame_options_value);
47	}
48	if (get_option('hh_x_xxs_protection') == 1) {
49	header("X-XSS-Protection: " . get_option('hh_x_xxs_protection_value'));
50	}
51	if (get_option('hh_x_content_type_options') == 1) {
52	header("X-Content-Type-Options: " . get_option('hh_x_content_type_options_value'));
53	}
54	if (get_option('hh_strict_transport_security') == 1) {
55	$hh_strict_transport_security = array();
56
57	$hh_strict_transport_security_max_age = get_option('hh_strict_transport_security_max_age');
58	if ($hh_strict_transport_security_max_age !== false)
59	{
60	$hh_strict_transport_security[] = sprintf('max-age=%u', get_option('hh_strict_transport_security_max_age'));
61	if (get_option('hh_strict_transport_security_sub_domains'))
62	{
63	$hh_strict_transport_security[] = 'includeSubDomains';
64	}
65	if (get_option('hh_strict_transport_security_preload'))
66	{
67	$hh_strict_transport_security[] = 'preload';
68	}
69	} else {
70	$hh_strict_transport_security = array(get_option('hh_strict_transport_security_value'));
71	}
72	header("Strict-Transport-Security: " . join('; ', $hh_strict_transport_security));
73	}
74	if (get_option('hh_x_ua_compatible') == 1) {
75	header("X-UA-Compatible: " . get_option('hh_x_ua_compatible_value'));
76	}
77	if (get_option('hh_public_key_pins') == 1) {
78	$public_key_pins_sha256_1 = get_option('hh_public_key_pins_sha256_1');
79	$public_key_pins_sha256_2 = get_option('hh_public_key_pins_sha256_2');
80	$public_key_pins_max_age = get_option('hh_public_key_pins_max_age');
81	$public_key_pins_sub_domains = get_option('hh_public_key_pins_sub_domains');
82	$public_key_pins_report_uri = get_option('hh_public_key_pins_report_uri');
83	if (!empty($public_key_pins_sha256_1) && !empty($public_key_pins_sha256_2) && !empty($public_key_pins_max_age)) {
84
85	$public_key_pins = array();
86	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_1);
87	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_2);
88	$public_key_pins[] = sprintf("max-age=%u", $public_key_pins_max_age);
89	if ($public_key_pins_sub_domains) {
90	$public_key_pins[] = "includeSubDomains";
91	}
92	if (!empty($public_key_pins_report_uri)) {
93	$public_key_pins[] = sprintf('report-uri="%s"', $public_key_pins_report_uri);
94	}
95	header(sprintf("Public-Key-Pins: %s", join('; ', $public_key_pins)));
96	}
97	}
98
99	# TODO
100	//header("Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
101
102	if (get_option('hh_access_control_allow_origin') == 1)
103	{
104	$value = get_option('hh_access_control_allow_origin_value');
105	switch ($value)
106	{
107	case 'HTTP_ORIGIN':
108	$value = @$_SERVER['HTTP_ORIGIN'];
109	break;
110	case 'origin':
111	$value = get_option('hh_access_control_allow_origin_url');
112	break;
113	}
114	if (!empty($value))
115	{
116	header("Access-Control-Allow-Origin: " . $value);
117	}
118	}
119	if (get_option('hh_access_control_allow_credentials') == 1)
120	{
121	header("Access-Control-Allow-Credentials: " . get_option('hh_access_control_allow_credentials_value'));
122	}
123	if (get_option('hh_access_control_max_age') == 1)
124	{
125	$value = get_option('hh_access_control_max_age_value');
126	if (!empty($value))
127	{
128	header("Access-Control-Max-Age: " . intval($value));
129	}
130	}
131	if (get_option('hh_access_control_allow_methods') == 1)
132	{
133	$value = get_option('hh_access_control_allow_methods_value');
134	if (!empty($value))
135	{
136	header("Access-Control-Allow-Methods: " . join(', ', array_keys($value)));
137	}
138	}
139	if (get_option('hh_access_control_allow_headers') == 1)
140	{
141	$value = get_option('hh_access_control_allow_headers_value');
142	if (!empty($value))
143	{
144	header("Access-Control-Allow-Headers: " . join(', ', array_keys($value)));
145	}
146	}
147	if (get_option('hh_access_control_expose_headers') == 1)
148	{
149	$value = get_option('hh_access_control_expose_headers_value');
150	if (!empty($value))
151	{
152	header("Access-Control-Expose-Headers: " . join(', ', array_keys($value)));
153	}
154	}
155	if (get_option('hh_p3p') == 1)
156	{
157	$value = get_option('hh_p3p_value');
158	if (!empty($value))
159	{
160	header('P3P: CP="' . join(' ', array_keys($value)) . '"');
161	}
162	}
163	}
164
165	function http_headers_admin_add_page() {
166	add_options_page('HTTP Headers', 'HTTP Headers', 'manage_options', 'http-headers', 'http_headers_admin_page');
167	}
168
169	function http_headers_admin() {
170	register_setting('http-headers-group', 'hh_x_frame_options');
171	register_setting('http-headers-group', 'hh_x_frame_options_value');
172	register_setting('http-headers-group', 'hh_x_frame_options_domain');
173	register_setting('http-headers-group', 'hh_x_xxs_protection');
174	register_setting('http-headers-group', 'hh_x_xxs_protection_value');
175	register_setting('http-headers-group', 'hh_x_content_type_options');
176	register_setting('http-headers-group', 'hh_x_content_type_options_value');
177	register_setting('http-headers-group', 'hh_strict_transport_security');
178	register_setting('http-headers-group', 'hh_strict_transport_security_value'); //obsolete
179	register_setting('http-headers-group', 'hh_strict_transport_security_max_age');
180	register_setting('http-headers-group', 'hh_strict_transport_security_sub_domains');
181	register_setting('http-headers-group', 'hh_strict_transport_security_preload');
182	register_setting('http-headers-group', 'hh_public_key_pins');
183	register_setting('http-headers-group', 'hh_public_key_pins_sha256_1');
184	register_setting('http-headers-group', 'hh_public_key_pins_sha256_2');
185	register_setting('http-headers-group', 'hh_public_key_pins_max_age');
186	register_setting('http-headers-group', 'hh_public_key_pins_sub_domains');
187	register_setting('http-headers-group', 'hh_public_key_pins_report_uri');
188	register_setting('http-headers-group', 'hh_x_ua_compatible');
189	register_setting('http-headers-group', 'hh_x_ua_compatible_value');
190	register_setting('http-headers-group', 'hh_p3p');
191	register_setting('http-headers-group', 'hh_p3p_value');
192	register_setting('http-headers-cors', 'hh_access_control_allow_origin');
193	register_setting('http-headers-cors', 'hh_access_control_allow_origin_value');
194	register_setting('http-headers-cors', 'hh_access_control_allow_origin_url');
195	register_setting('http-headers-cors', 'hh_access_control_allow_credentials');
196	register_setting('http-headers-cors', 'hh_access_control_allow_credentials_value');
197	register_setting('http-headers-cors', 'hh_access_control_allow_methods');
198	register_setting('http-headers-cors', 'hh_access_control_allow_methods_value');
199	register_setting('http-headers-cors', 'hh_access_control_allow_headers');
200	register_setting('http-headers-cors', 'hh_access_control_allow_headers_value');
201	register_setting('http-headers-cors', 'hh_access_control_expose_headers');
202	register_setting('http-headers-cors', 'hh_access_control_expose_headers_value');
203	register_setting('http-headers-cors', 'hh_access_control_max_age');
204	register_setting('http-headers-cors', 'hh_access_control_max_age_value');
205	}
206
207	function http_headers_enqueue($hook) {
208	if ( 'http-headers.php' != $hook ) {
209	# FIXME
210	//return;
211	}
212
213	wp_enqueue_script('http_headers_admin_scripts', plugin_dir_url( __FILE__ ) . 'assets/scripts.js');
214	wp_enqueue_style('http_headers_admin_styles', plugin_dir_url( __FILE__ ) . 'assets/styles.css');
215	}
216
217
218	if ( is_admin() ){ // admin actions
219	add_action('admin_menu', 'http_headers_admin_add_page');
220	add_action('admin_init', 'http_headers_admin');
221	add_action('admin_enqueue_scripts', 'http_headers_enqueue');
222	} else {
223	// non-admin enqueues, actions, and filters
224	add_action('send_headers', 'http_headers');
225	}
226
227	function http_headers_admin_page() {
228	include 'views/admin.php';
229	}