http-headers / http-headers.php

http-headers.php in HTTP Headers 1.2.0, at http-headers.php

239 lines 9.8 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: HTTP Headers
4	Plugin URI: https://zinoui.com/blog/http-headers-for-wordpress
5	Description: This plugin adds CORS & security HTTP headers to your website. Improves your website overall security.
6	Version: 1.2.0
7	Author: Dimitar Ivanov
8	Author URI: https://zinoui.com
9	License: GPLv2 or later
10	Text Domain: http-headers
11	*/
12
13	/*
14	This program is free software; you can redistribute it and/or
15	modify it under the terms of the GNU General Public License
16	as published by the Free Software Foundation; either version 2
17	of the License, or (at your option) any later version.
18
19	This program is distributed in the hope that it will be useful,
20	but WITHOUT ANY WARRANTY; without even the implied warranty of
21	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	GNU General Public License for more details.
23
24	You should have received a copy of the GNU General Public License
25	along with this program. If not, see <http://www.gnu.org/copyleft/gpl.html>.
26
27	Copyright (c) 2017 Zino UI
28	*/
29
30	if (get_option('hh_strict_transport_security_max_age') === false) {
31	$value = get_option('hh_strict_transport_security_value');
32	$max_age = preg_match('/max-age=(\d+)/', $value, $match) ? $match[1] : 0;
33	$sub_domains = strpos($value, 'includeSubDomains') !== false ? 1 : 0;
34	add_option('hh_strict_transport_security_max_age', $max_age, null, 'yes');
35	add_option('hh_strict_transport_security_sub_domains', $sub_domains, null, 'yes');
36	add_option('hh_strict_transport_security_preload', 0, null, 'yes');
37	}
38
39	if (get_option('hh_referrer_policy') === false) {
40	add_option('hh_referrer_policy', 0, null, 'yes');
41	add_option('hh_referrer_policy_value', null, null, 'yes');
42	}
43
44	function http_headers() {
45
46	if (get_option('hh_x_frame_options') == 1) {
47	$x_frame_options_value = strtoupper(get_option('hh_x_frame_options_value'));
48	if ($x_frame_options_value == 'ALLOW-FROM') {
49	$x_frame_options_value .= ' ' . get_option('hh_x_frame_options_domain');
50	}
51	header("X-Frame-Options: " . $x_frame_options_value);
52	}
53	if (get_option('hh_x_xxs_protection') == 1) {
54	header("X-XSS-Protection: " . get_option('hh_x_xxs_protection_value'));
55	}
56	if (get_option('hh_x_content_type_options') == 1) {
57	header("X-Content-Type-Options: " . get_option('hh_x_content_type_options_value'));
58	}
59	if (get_option('hh_strict_transport_security') == 1) {
60	$hh_strict_transport_security = array();
61
62	$hh_strict_transport_security_max_age = get_option('hh_strict_transport_security_max_age');
63	if ($hh_strict_transport_security_max_age !== false)
64	{
65	$hh_strict_transport_security[] = sprintf('max-age=%u', get_option('hh_strict_transport_security_max_age'));
66	if (get_option('hh_strict_transport_security_sub_domains'))
67	{
68	$hh_strict_transport_security[] = 'includeSubDomains';
69	}
70	if (get_option('hh_strict_transport_security_preload'))
71	{
72	$hh_strict_transport_security[] = 'preload';
73	}
74	} else {
75	$hh_strict_transport_security = array(get_option('hh_strict_transport_security_value'));
76	}
77	header("Strict-Transport-Security: " . join('; ', $hh_strict_transport_security));
78	}
79	if (get_option('hh_x_ua_compatible') == 1) {
80	header("X-UA-Compatible: " . get_option('hh_x_ua_compatible_value'));
81	}
82	if (get_option('hh_public_key_pins') == 1) {
83	$public_key_pins_sha256_1 = get_option('hh_public_key_pins_sha256_1');
84	$public_key_pins_sha256_2 = get_option('hh_public_key_pins_sha256_2');
85	$public_key_pins_max_age = get_option('hh_public_key_pins_max_age');
86	$public_key_pins_sub_domains = get_option('hh_public_key_pins_sub_domains');
87	$public_key_pins_report_uri = get_option('hh_public_key_pins_report_uri');
88	if (!empty($public_key_pins_sha256_1) && !empty($public_key_pins_sha256_2) && !empty($public_key_pins_max_age)) {
89
90	$public_key_pins = array();
91	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_1);
92	$public_key_pins[] = sprintf('pin-sha256="%s"', $public_key_pins_sha256_2);
93	$public_key_pins[] = sprintf("max-age=%u", $public_key_pins_max_age);
94	if ($public_key_pins_sub_domains) {
95	$public_key_pins[] = "includeSubDomains";
96	}
97	if (!empty($public_key_pins_report_uri)) {
98	$public_key_pins[] = sprintf('report-uri="%s"', $public_key_pins_report_uri);
99	}
100	header(sprintf("Public-Key-Pins: %s", join('; ', $public_key_pins)));
101	}
102	}
103
104	# TODO
105	//header("Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
106
107	if (get_option('hh_access_control_allow_origin') == 1)
108	{
109	$value = get_option('hh_access_control_allow_origin_value');
110	switch ($value)
111	{
112	case 'HTTP_ORIGIN':
113	$value = @$_SERVER['HTTP_ORIGIN'];
114	break;
115	case 'origin':
116	$value = get_option('hh_access_control_allow_origin_url');
117	break;
118	}
119	if (!empty($value))
120	{
121	header("Access-Control-Allow-Origin: " . $value);
122	}
123	}
124	if (get_option('hh_access_control_allow_credentials') == 1)
125	{
126	header("Access-Control-Allow-Credentials: " . get_option('hh_access_control_allow_credentials_value'));
127	}
128	if (get_option('hh_access_control_max_age') == 1)
129	{
130	$value = get_option('hh_access_control_max_age_value');
131	if (!empty($value))
132	{
133	header("Access-Control-Max-Age: " . intval($value));
134	}
135	}
136	if (get_option('hh_access_control_allow_methods') == 1)
137	{
138	$value = get_option('hh_access_control_allow_methods_value');
139	if (!empty($value))
140	{
141	header("Access-Control-Allow-Methods: " . join(', ', array_keys($value)));
142	}
143	}
144	if (get_option('hh_access_control_allow_headers') == 1)
145	{
146	$value = get_option('hh_access_control_allow_headers_value');
147	if (!empty($value))
148	{
149	header("Access-Control-Allow-Headers: " . join(', ', array_keys($value)));
150	}
151	}
152	if (get_option('hh_access_control_expose_headers') == 1)
153	{
154	$value = get_option('hh_access_control_expose_headers_value');
155	if (!empty($value))
156	{
157	header("Access-Control-Expose-Headers: " . join(', ', array_keys($value)));
158	}
159	}
160	if (get_option('hh_p3p') == 1)
161	{
162	$value = get_option('hh_p3p_value');
163	if (!empty($value))
164	{
165	header('P3P: CP="' . join(' ', array_keys($value)) . '"');
166	}
167	}
168	if (get_option('hh_referrer_policy') == 1) {
169	header("Referrer-Policy: " . get_option('hh_referrer_policy_value'));
170	}
171	}
172
173	function http_headers_admin_add_page() {
174	add_options_page('HTTP Headers', 'HTTP Headers', 'manage_options', 'http-headers', 'http_headers_admin_page');
175	}
176
177	function http_headers_admin() {
178	register_setting('http-headers-group', 'hh_x_frame_options');
179	register_setting('http-headers-group', 'hh_x_frame_options_value');
180	register_setting('http-headers-group', 'hh_x_frame_options_domain');
181	register_setting('http-headers-group', 'hh_x_xxs_protection');
182	register_setting('http-headers-group', 'hh_x_xxs_protection_value');
183	register_setting('http-headers-group', 'hh_x_content_type_options');
184	register_setting('http-headers-group', 'hh_x_content_type_options_value');
185	register_setting('http-headers-group', 'hh_strict_transport_security');
186	register_setting('http-headers-group', 'hh_strict_transport_security_value'); //obsolete
187	register_setting('http-headers-group', 'hh_strict_transport_security_max_age');
188	register_setting('http-headers-group', 'hh_strict_transport_security_sub_domains');
189	register_setting('http-headers-group', 'hh_strict_transport_security_preload');
190	register_setting('http-headers-group', 'hh_public_key_pins');
191	register_setting('http-headers-group', 'hh_public_key_pins_sha256_1');
192	register_setting('http-headers-group', 'hh_public_key_pins_sha256_2');
193	register_setting('http-headers-group', 'hh_public_key_pins_max_age');
194	register_setting('http-headers-group', 'hh_public_key_pins_sub_domains');
195	register_setting('http-headers-group', 'hh_public_key_pins_report_uri');
196	register_setting('http-headers-group', 'hh_x_ua_compatible');
197	register_setting('http-headers-group', 'hh_x_ua_compatible_value');
198	register_setting('http-headers-group', 'hh_p3p');
199	register_setting('http-headers-group', 'hh_p3p_value');
200	register_setting('http-headers-group', 'hh_referrer_policy');
201	register_setting('http-headers-group', 'hh_referrer_policy_value');
202	register_setting('http-headers-cors', 'hh_access_control_allow_origin');
203	register_setting('http-headers-cors', 'hh_access_control_allow_origin_value');
204	register_setting('http-headers-cors', 'hh_access_control_allow_origin_url');
205	register_setting('http-headers-cors', 'hh_access_control_allow_credentials');
206	register_setting('http-headers-cors', 'hh_access_control_allow_credentials_value');
207	register_setting('http-headers-cors', 'hh_access_control_allow_methods');
208	register_setting('http-headers-cors', 'hh_access_control_allow_methods_value');
209	register_setting('http-headers-cors', 'hh_access_control_allow_headers');
210	register_setting('http-headers-cors', 'hh_access_control_allow_headers_value');
211	register_setting('http-headers-cors', 'hh_access_control_expose_headers');
212	register_setting('http-headers-cors', 'hh_access_control_expose_headers_value');
213	register_setting('http-headers-cors', 'hh_access_control_max_age');
214	register_setting('http-headers-cors', 'hh_access_control_max_age_value');
215	}
216
217	function http_headers_enqueue($hook) {
218	if ( 'http-headers.php' != $hook ) {
219	# FIXME
220	//return;
221	}
222
223	wp_enqueue_script('http_headers_admin_scripts', plugin_dir_url( __FILE__ ) . 'assets/scripts.js');
224	wp_enqueue_style('http_headers_admin_styles', plugin_dir_url( __FILE__ ) . 'assets/styles.css');
225	}
226
227
228	if ( is_admin() ){ // admin actions
229	add_action('admin_menu', 'http_headers_admin_add_page');
230	add_action('admin_init', 'http_headers_admin');
231	add_action('admin_enqueue_scripts', 'http_headers_enqueue');
232	} else {
233	// non-admin enqueues, actions, and filters
234	add_action('send_headers', 'http_headers');
235	}
236
237	function http_headers_admin_page() {
238	include 'views/admin.php';
239	}