| 1 |
<?php |
| 2 |
if (!defined('ABSPATH')) { |
| 3 |
exit; |
| 4 |
} |
| 5 |
include dirname(__FILE__) . '/includes/config.inc.php'; |
| 6 |
include dirname(__FILE__) . '/includes/breadcrumbs.inc.php'; |
| 7 |
?> |
| 8 |
<table class="hh-index-table"> |
| 9 |
<thead> |
| 10 |
<tr> |
| 11 |
<th><?php _e('Header', 'http-headers'); ?></th> |
| 12 |
<th style="width: 45%"><?php _e('Value', 'http-headers'); ?></th> |
| 13 |
<th class="hh-status"><?php _e('Status', 'http-headers'); ?></th> |
| 14 |
<th></th> |
| 15 |
</tr> |
| 16 |
</thead> |
| 17 |
<tbody> |
| 18 |
<?php |
| 19 |
foreach ($headers as $index => $item) |
| 20 |
{ |
| 21 |
if (@$_GET['category'] != $item[2]) |
| 22 |
{ |
| 23 |
continue; |
| 24 |
} |
| 25 |
|
| 26 |
$key = $item[1]; |
| 27 |
|
| 28 |
$option = get_option($key, 0); |
| 29 |
$isOn = (int) $option === 1; |
| 30 |
$value = NULL; |
| 31 |
if ($isOn) |
| 32 |
{ |
| 33 |
$value = get_option($key .'_value'); |
| 34 |
switch ($key) |
| 35 |
{ |
| 36 |
case 'hh_age': |
| 37 |
$value = (int) $value; |
| 38 |
break; |
| 39 |
case 'hh_p3p': |
| 40 |
if (!empty($value)) |
| 41 |
{ |
| 42 |
$value = sprintf('CP="%s"', join(' ', array_keys($value))); |
| 43 |
} |
| 44 |
break; |
| 45 |
case 'hh_x_xxs_protection': |
| 46 |
if ($value == '1; report=') { |
| 47 |
$value .= get_option('hh_x_xxs_protection_uri'); |
| 48 |
} |
| 49 |
break; |
| 50 |
case 'hh_x_powered_by': |
| 51 |
if (get_option('hh_x_powered_by_option') == 'unset') { |
| 52 |
$value = '[Unset]'; |
| 53 |
} |
| 54 |
break; |
| 55 |
case 'hh_x_frame_options': |
| 56 |
$value = strtoupper($value); |
| 57 |
if ($value == 'ALLOW-FROM') |
| 58 |
{ |
| 59 |
$value .= ' ' . get_option('hh_x_frame_options_domain'); |
| 60 |
} |
| 61 |
break; |
| 62 |
case 'hh_strict_transport_security': |
| 63 |
$tmp = array(); |
| 64 |
$hh_strict_transport_security_max_age = get_option('hh_strict_transport_security_max_age'); |
| 65 |
if ($hh_strict_transport_security_max_age !== false) |
| 66 |
{ |
| 67 |
$tmp[] = sprintf('max-age=%u', $hh_strict_transport_security_max_age); |
| 68 |
if (get_option('hh_strict_transport_security_sub_domains')) |
| 69 |
{ |
| 70 |
$tmp[] = 'includeSubDomains'; |
| 71 |
} |
| 72 |
if (get_option('hh_strict_transport_security_preload')) |
| 73 |
{ |
| 74 |
$tmp[] = 'preload'; |
| 75 |
} |
| 76 |
} else { |
| 77 |
$tmp = array(get_option('hh_strict_transport_security_value')); |
| 78 |
} |
| 79 |
if (!empty($tmp)) |
| 80 |
{ |
| 81 |
$value = join('; ', $tmp); |
| 82 |
} |
| 83 |
break; |
| 84 |
case 'hh_public_key_pins': |
| 85 |
$public_key_pins_sha256_1 = get_option('hh_public_key_pins_sha256_1'); |
| 86 |
$public_key_pins_sha256_2 = get_option('hh_public_key_pins_sha256_2'); |
| 87 |
$public_key_pins_max_age = get_option('hh_public_key_pins_max_age'); |
| 88 |
$public_key_pins_sub_domains = get_option('hh_public_key_pins_sub_domains'); |
| 89 |
$public_key_pins_report_uri = get_option('hh_public_key_pins_report_uri'); |
| 90 |
if (!empty($public_key_pins_sha256_1) && !empty($public_key_pins_sha256_2) && !empty($public_key_pins_max_age)) { |
| 91 |
|
| 92 |
$public_key_pins = array(); |
| 93 |
$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_1); |
| 94 |
$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_2); |
| 95 |
$public_key_pins[] = sprintf("max-age=%u", $public_key_pins_max_age); |
| 96 |
if ($public_key_pins_sub_domains) { |
| 97 |
$public_key_pins[] = "includeSubDomains"; |
| 98 |
} |
| 99 |
if (!empty($public_key_pins_report_uri)) { |
| 100 |
$public_key_pins[] = sprintf('report-uri="%s"', $public_key_pins_report_uri); |
| 101 |
} |
| 102 |
$value = join('; ', $public_key_pins); |
| 103 |
if (get_option('hh_public_key_pins_report_only')) { |
| 104 |
$item[0] .= '-Report-Only'; |
| 105 |
} |
| 106 |
} |
| 107 |
break; |
| 108 |
case 'hh_timing_allow_origin': |
| 109 |
if ($value == 'origin') |
| 110 |
{ |
| 111 |
$value = get_option('hh_timing_allow_origin_url'); |
| 112 |
} |
| 113 |
break; |
| 114 |
case 'hh_access_control_allow_origin': |
| 115 |
if ($value == 'origin') |
| 116 |
{ |
| 117 |
$value = join('<br>', get_option('hh_access_control_allow_origin_url', array())); |
| 118 |
} |
| 119 |
break; |
| 120 |
case 'hh_access_control_expose_headers': |
| 121 |
case 'hh_access_control_allow_headers': |
| 122 |
case 'hh_access_control_allow_methods': |
| 123 |
$value = join(', ', array_keys($value)); |
| 124 |
break; |
| 125 |
case 'hh_content_security_policy': |
| 126 |
$value = build_csp_value($value); |
| 127 |
if (get_option('hh_content_security_policy_report_only')) { |
| 128 |
$item[0] .= '-Report-Only'; |
| 129 |
} |
| 130 |
break; |
| 131 |
case 'hh_content_encoding': |
| 132 |
$value = !$value ? null : join(', ', array_keys($value)); |
| 133 |
|
| 134 |
$ext = get_option('hh_content_encoding_ext'); |
| 135 |
if (!empty($ext)) { |
| 136 |
$ext = join(', ', array_keys($ext)); |
| 137 |
$value .= (!empty($value) ? '<br>' : null) . $ext; |
| 138 |
} |
| 139 |
$value = !empty($value) ? sprintf('gzip (%s)', $value) : 'gzip'; |
| 140 |
break; |
| 141 |
case 'hh_vary': |
| 142 |
$value = !$value ? null : join(', ', array_keys($value)); |
| 143 |
break; |
| 144 |
case 'hh_www_authenticate': |
| 145 |
$value = get_option('hh_www_authenticate_type'); |
| 146 |
break; |
| 147 |
case 'hh_cache_control': |
| 148 |
$tmp = array(); |
| 149 |
foreach ($value as $k => $v) { |
| 150 |
if (in_array($k, array('max-age', 's-maxage'))) { |
| 151 |
if (strlen($v) > 0) { |
| 152 |
$tmp[] = sprintf("%s=%u", $k, $v); |
| 153 |
} |
| 154 |
} else { |
| 155 |
$tmp[] = $k; |
| 156 |
} |
| 157 |
} |
| 158 |
$value = join(', ', $tmp); |
| 159 |
break; |
| 160 |
case 'hh_expires': |
| 161 |
$tmp = array(); |
| 162 |
$types = get_option('hh_expires_type', array()); |
| 163 |
foreach ($types as $type => $whatever) { |
| 164 |
list($base, $period, $suffix) = explode('_', $value[$type]); |
| 165 |
if (in_array($base, array('access', 'modification'))) { |
| 166 |
$tmp[] = $type != 'default' |
| 167 |
? sprintf('%s = "%s plus %u %s"', $type, $base, $period, $suffix) |
| 168 |
: sprintf('default = "%s plus %u %s"', $base, $period, $suffix); |
| 169 |
} elseif ($base == 'invalid') { |
| 170 |
$tmp[] = $type != 'default' |
| 171 |
? sprintf('%s = A0', $type) |
| 172 |
: sprintf('default = A0'); |
| 173 |
} |
| 174 |
} |
| 175 |
$value = join('<br>', $tmp); |
| 176 |
break; |
| 177 |
case 'hh_cookie_security': |
| 178 |
$value = is_array($value) ? join(', ', array_keys($value)) : NULL; |
| 179 |
break; |
| 180 |
case 'hh_expect_ct': |
| 181 |
$tmp = array(); |
| 182 |
$tmp[] = sprintf('max-age=%u', get_option('hh_expect_ct_max_age')); |
| 183 |
if (get_option('hh_expect_ct_enforce') == 1) { |
| 184 |
$tmp[] = 'enforce'; |
| 185 |
} |
| 186 |
$tmp[] = sprintf('report-uri="%s"', get_option('hh_expect_ct_report_uri')); |
| 187 |
$value = join(', ', $tmp); |
| 188 |
break; |
| 189 |
case 'hh_custom_headers': |
| 190 |
$_names = array($item[0]); |
| 191 |
$_values = array(' '); |
| 192 |
foreach ($value['name'] as $key => $name) |
| 193 |
{ |
| 194 |
if (!empty($name) && !empty($value['value'][$key])) |
| 195 |
{ |
| 196 |
$_names[] = '<p class="hh-p"> '.$name.'</p>'; |
| 197 |
$_values[] = '<p class="hh-p">'.$value['value'][$key].'</p>'; |
| 198 |
} |
| 199 |
} |
| 200 |
$item[0] = join('', $_names); |
| 201 |
$value = join('', $_values); |
| 202 |
break; |
| 203 |
case 'hh_report_to': |
| 204 |
$tmp = array(); |
| 205 |
foreach ($value as $a_item) |
| 206 |
{ |
| 207 |
$tmp[] = sprintf('{"url": "%s", "group": "%s", "max-age": %u%s}', |
| 208 |
$a_item['url'], $a_item['group'], $a_item['max-age'], isset($a_item['includeSubDomains']) ? ', includeSubDomains' : NULL); |
| 209 |
} |
| 210 |
$value = join(', ', $tmp); |
| 211 |
break; |
| 212 |
case 'hh_feature_policy': |
| 213 |
$fp = array(); |
| 214 |
$features = get_option('hh_feature_policy_feature'); |
| 215 |
if (!$features) |
| 216 |
{ |
| 217 |
$features = array(); |
| 218 |
} |
| 219 |
$origins = get_option('hh_feature_policy_origin'); |
| 220 |
foreach ($features as $key => $whatever) |
| 221 |
{ |
| 222 |
switch ($value[$key]) |
| 223 |
{ |
| 224 |
case '*': |
| 225 |
case "'none'": |
| 226 |
$fp[] = sprintf("%s %s", $key, $value[$key]); |
| 227 |
break; |
| 228 |
case "'self'": |
| 229 |
$fp[] = sprintf("%s %s%s", $key, $value[$key], !empty($origins[$key]) ? " " . $origins[$key] : NULL); |
| 230 |
break; |
| 231 |
case 'origin(s)': |
| 232 |
$fp[] = sprintf("%s %s", $key, $origins[$key]); |
| 233 |
break; |
| 234 |
} |
| 235 |
} |
| 236 |
if (!empty($fp)) |
| 237 |
{ |
| 238 |
$value = join('; ', $fp); |
| 239 |
} else { |
| 240 |
$value = ""; |
| 241 |
} |
| 242 |
break; |
| 243 |
case 'hh_clear_site_data': |
| 244 |
$value = '"' . join('", "', array_keys($value)) . '"'; |
| 245 |
break; |
| 246 |
default: |
| 247 |
$value = !is_array($value) ? $value : join(', ', $value); |
| 248 |
} |
| 249 |
} |
| 250 |
$status = $isOn ? __('On', 'http-headers') : __('Off', 'http-headers'); |
| 251 |
?> |
| 252 |
<tr<?php echo $isOn ? ' class="active"' : NULL; ?>> |
| 253 |
<td><?php echo $item[0]; ?></td> |
| 254 |
<td><?php echo $value; ?></td> |
| 255 |
<td class="hh-status hh-status-<?php echo $isOn ? 'on' : 'off'; ?>"><span><?php echo $status; ?></span></td> |
| 256 |
<td><a href="<?php echo get_admin_url(); ?>options-general.php?page=http-headers&header=<?php |
| 257 |
echo $index; ?>"><?php _e('Edit', 'http-headers'); ?></a></td> |
| 258 |
</tr> |
| 259 |
<?php |
| 260 |
} |
| 261 |
?> |
| 262 |
</tbody> |
| 263 |
</table> |
