http-headers / views / admin.php

admin.php in HTTP Headers 1.2.0, at views/admin.php

618 lines 30.9 KB

Raw Download Zip

1	<?php
2	$bools = array(0 => 'Off', 1 => 'On');
3	?>
4	<div class="wrap">
5	<h1>HTTP Headers</h1>
6
7	<section class="hh-panel">
8	<h2>Security Headers</h2>
9
10	<form method="post" action="options.php">
11	<?php settings_fields( 'http-headers-group' ); ?>
12	<?php do_settings_sections( 'http-headers-group' ); ?>
13	<table class="form-table hh-table">
14	<tbody>
15	<tr valign="top">
16	<th scope="row">X-Frame-Options
17	<p class="description">This header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Use this to avoid clickjacking attacks.</p>
18	</th>
19	<td>
20	<fieldset>
21	<legend class="screen-reader-text">X-Frame-Options</legend>
22	<?php
23	$x_frame_options = get_option('hh_x_frame_options', 0);
24	foreach ($bools as $k => $v)
25	{
26	?><p><label><input type="radio" class="http-header" name="hh_x_frame_options" value="<?php echo $k; ?>"<?php checked($x_frame_options, $k, true); ?> /> <?php echo $v; ?></label></p><?php
27	}
28	?>
29	</fieldset>
30	</td>
31	<td>
32	<select name="hh_x_frame_options_value" class="http-header-value"<?php disabled($x_frame_options, 0); ?>>
33	<?php
34	$items = array('deny', 'sameorigin', 'allow-from');
35	$x_frame_options_value = get_option('hh_x_frame_options_value');
36	foreach ($items as $item) {
37	?><option value="<?php echo $item; ?>"<?php selected($x_frame_options_value, $item); ?>><?php echo $item; ?></option><?php
38	}
39	?>
40	</select>
41	<input type="text" name="hh_x_frame_options_domain" placeholder="Domain" value="<?php echo esc_attr(get_option('hh_x_frame_options_domain')); ?>"<?php echo $x_frame_options == 1 && $x_frame_options_value == 'allow-from' ? NULL : ' disabled="disabled" style="display: none"'; ?> />
42	</td>
43	</tr>
44
45	<tr valign="top">
46	<th scope="row">X-XSS-Protection
47	<p class="description">This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. </p>
48	</th>
49	<td>
50	<fieldset>
51	<legend class="screen-reader-text">X-XSS-Protection</legend>
52	<?php
53	$x_xxs_protection = get_option('hh_x_xxs_protection', 0);
54	foreach ($bools as $k => $v)
55	{
56	?><p><label><input type="radio" class="http-header" name="hh_x_xxs_protection" value="<?php echo $k; ?>"<?php checked($x_xxs_protection, $k, true); ?> /> <?php echo $v; ?></label></p><?php
57	}
58	?>
59	</fieldset>
60	</td>
61	<td>
62	<select name="hh_x_xxs_protection_value" class="http-header-value"<?php disabled($x_xxs_protection, 0); ?>>
63	<?php
64	$items = array('0', '1', '1; mode=block');
65	$x_xxs_protection_value = get_option('hh_x_xxs_protection_value');
66	foreach ($items as $item) {
67	?><option value="<?php echo $item; ?>"<?php selected($x_xxs_protection_value, $item); ?>><?php echo $item; ?></option><?php
68	}
69	?>
70	</select>
71	</td>
72	</tr>
73
74	<tr valign="top">
75	<th scope="row">X-Content-Type-Options
76	<p class="description">Prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions. This reduces exposure to drive-by download attacks and sites serving user uploaded content that, by clever naming, could be treated by MSIE as executable or dynamic HTML files.</p>
77	</th>
78	<td>
79	<fieldset>
80	<legend class="screen-reader-text">X-Content-Type-Options</legend>
81	<?php
82	$x_content_type_options = get_option('hh_x_content_type_options', 0);
83	foreach ($bools as $k => $v)
84	{
85	?><p><label><input type="radio" class="http-header" name="hh_x_content_type_options" value="<?php echo $k; ?>"<?php checked($x_content_type_options, $k); ?> /> <?php echo $v; ?></label></p><?php
86	}
87	?>
88	</fieldset>
89	</td>
90	<td>
91	<select name="hh_x_content_type_options_value" class="http-header-value"<?php disabled($x_content_type_options, 0); ?>>
92	<?php
93	$items = array('nosniff');
94	$x_content_type_options_value = get_option('hh_x_content_type_options_value');
95	foreach ($items as $item) {
96	?><option value="<?php echo $item; ?>"<?php selected($x_content_type_options_value, $item); ?>><?php echo $item; ?></option><?php
97	}
98	?>
99	</select>
100	</td>
101	</tr>
102
103	<tr valign="top">
104	<th scope="row">Strict-Transport-Security
105	<p class="description">HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server. This reduces impact of bugs in web applications leaking session data through cookies and external links and defends against Man-in-the-middle attacks. HSTS also disables the ability for user's to ignore SSL negotiation warnings.</p>
106	</th>
107	<td>
108	<fieldset>
109	<legend class="screen-reader-text">Strict-Transport-Security</legend>
110	<?php
111	$strict_transport_security = get_option('hh_strict_transport_security', 0);
112	foreach ($bools as $k => $v)
113	{
114	?><p><label><input type="radio" class="http-header" name="hh_strict_transport_security" value="<?php echo $k; ?>"<?php checked($strict_transport_security, $k, true); ?> /> <?php echo $v; ?></label></p><?php
115	}
116	?>
117	</fieldset>
118	</td>
119	<td>
120	<table>
121	<tr>
122	<td>max-age:</td>
123	<td><select name="hh_strict_transport_security_max_age" class="http-header-value"<?php disabled($strict_transport_security, 0); ?>>
124	<?php
125	$items = array('0' => '0 (Delete entire HSTS Policy)', '3600' => '1 hour', '86400' => '1 day', '604800' => '7 days', '2592000' => '30 days', '5184000' => '60 days', '7776000' => '90 days', '31536000' => '1 year', '63072000' => '2 years');
126	$strict_transport_security_max_age = get_option('hh_strict_transport_security_max_age');
127	foreach ($items as $key => $item) {
128	?><option value="<?php echo $key; ?>"<?php selected($strict_transport_security_max_age, $key); ?>><?php echo $item; ?></option><?php
129	}
130	?>
131	</select></td>
132	</tr>
133	<tr>
134	<td>includeSubDomains:</td>
135	<td><input type="checkbox" class="http-header-value" name="hh_strict_transport_security_sub_domains" value="1"<?php checked(get_option('hh_strict_transport_security_sub_domains'), 1, true); ?><?php disabled($strict_transport_security, 0); ?> /></td>
136	</tr>
137	<tr>
138	<td>preload:</td>
139	<td><input type="checkbox" class="http-header-value" name="hh_strict_transport_security_preload" value="1"<?php checked(get_option('hh_strict_transport_security_preload'), 1, true); ?><?php disabled($strict_transport_security, 0); ?> /></td>
140	</tr>
141	</table>
142	</td>
143	</tr>
144
145	<tr valign="top">
146	<th scope="row">Public-Key-Pins
147	<p class="description">HTTP Public Key Pinning (HPKP) is a security mechanism which allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates.</p>
148	</th>
149	<td>
150	<fieldset>
151	<legend class="screen-reader-text">Public-Key-Pins</legend>
152	<?php
153	$public_key_pins = get_option('hh_public_key_pins', 0);
154	foreach ($bools as $k => $v)
155	{
156	?><p><label><input type="radio" class="http-header" name="hh_public_key_pins" value="<?php echo $k; ?>"<?php checked($public_key_pins, $k, true); ?> /> <?php echo $v; ?></label></p><?php
157	}
158	?>
159	</fieldset>
160	</td>
161	<td>
162	<table>
163	<tr>
164	<td>pin-sha256:</td>
165	<td><input type="text" class="http-header-value" name="hh_public_key_pins_sha256_1" value="<?php echo esc_attr(get_option('hh_public_key_pins_sha256_1')); ?>" placeholder="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM="<?php disabled($public_key_pins, 0); ?> /></td>
166	</tr>
167	<tr>
168	<td>pin-sha256:<br>(backup key)</td>
169	<td><input type="text" class="http-header-value" name="hh_public_key_pins_sha256_2" value="<?php echo esc_attr(get_option('hh_public_key_pins_sha256_2')); ?>" placeholder="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="<?php disabled($public_key_pins, 0); ?> /></td>
170	</tr>
171	<tr>
172	<td>max-age:</td>
173	<td><select class="http-header-value" name="hh_public_key_pins_max_age"<?php disabled($public_key_pins, 0); ?>>
174	<?php
175	$items = array('3600' => '1 hour', '86400' => '1 day', '604800' => '7 days', '2592000' => '30 days', '5184000' => '60 days', '7776000' => '90 days', '31536000' => '1 year');
176	$public_key_pins_max_age = get_option('hh_public_key_pins_max_age');
177	foreach ($items as $key => $item) {
178	?><option value="<?php echo $key; ?>"<?php selected($public_key_pins_max_age, $key); ?>><?php echo $item; ?></option><?php
179	}
180	?>
181	</select></td>
182	</tr>
183	<tr>
184	<td>includeSubDomains:</td>
185	<td><input type="checkbox" class="http-header-value" name="hh_public_key_pins_sub_domains" value="1"<?php checked(get_option('hh_public_key_pins_sub_domains'), 1, true); ?><?php disabled($public_key_pins, 0); ?> /></td>
186	</tr>
187	<tr>
188	<td>report-uri:</td>
189	<td><input type="text" class="http-header-value" name="hh_public_key_pins_report_uri" value="<?php echo esc_attr(get_option('hh_public_key_pins_report_uri')); ?>" placeholder="http://example.com/pkp-report"<?php disabled($public_key_pins, 0); ?> /></td>
190	</tr>
191	</table>
192	</td>
193	</tr>
194
195	<tr valign="top">
196	<th scope="row">X-UA-Compatible
197	<p class="description">In some cases, it might be necessary to restrict a webpage to a document mode supported by an older version of Windows Internet Explorer. Here we look at the x-ua-compatible header, which allows a webpage to be displayed as if it were viewed by an earlier version of the browser.</p>
198	</th>
199	<td>
200	<fieldset>
201	<legend class="screen-reader-text">X-UA-Compatible</legend>
202	<?php
203	$x_ua_compatible = get_option('hh_x_ua_compatible', 0);
204	foreach ($bools as $k => $v)
205	{
206	?><p><label><input type="radio" class="http-header" name="hh_x_ua_compatible" value="<?php echo $k; ?>"<?php checked($x_ua_compatible, $k, true); ?> /> <?php echo $v; ?></label></p><?php
207	}
208	?>
209	</fieldset>
210	</td>
211	<td>
212	<select name="hh_x_ua_compatible_value" class="http-header-value"<?php disabled($x_ua_compatible, 0); ?>>
213	<?php
214	$items = array('IE=7', 'IE=8', 'IE=9', 'IE=10', 'IE=edge', 'IE=edge,chrome=1');
215	$x_ua_compatible_value = get_option('hh_x_ua_compatible_value');
216	foreach ($items as $item) {
217	?><option value="<?php echo $item; ?>"<?php selected($x_ua_compatible_value, $item); ?>><?php echo $item; ?></option><?php
218	}
219	?>
220	</select>
221	</td>
222	</tr>
223
224	<tr valign="top">
225	<th scope="row">P3P
226	<p class="description">The Platform for Privacy Preferences Project (P3P) is a protocol allowing websites to declare their intended use of information they collect about web browser users.</p>
227	</th>
228	<td>
229	<fieldset>
230	<legend class="screen-reader-text">P3P</legend>
231	<?php
232	$p3p = get_option('hh_p3p', 0);
233	foreach ($bools as $k => $v)
234	{
235	?><p><label><input type="radio" class="http-header" name="hh_p3p" value="<?php echo $k; ?>"<?php checked($p3p, $k); ?> /> <?php echo $v; ?></label></p><?php
236	}
237	?>
238	</fieldset>
239	</td>
240	<td>
241	<?php
242	$p3p_value = get_option('hh_p3p_value');
243	if (!$p3p_value)
244	{
245	$p3p_value = array();
246	}
247	$in_creq = array('ADM', 'DEV', 'TAI', 'PSA', 'PSD', 'IVA', 'IVD', 'CON', 'HIS', 'TEL', 'OTP', 'DEL', 'SAM', 'UNR', 'PUB', 'OTR',);
248	$creq = array('a', 'i', 'o');
249	?>
250	<table>
251	<tbody>
252	<tr>
253	<td>Compact ACCESS</td>
254	<td class="hh-td-inner">
255	<table><tbody><tr><?php
256	$items = array('NOI', 'ALL', 'CAO', 'IDC', 'OTI', 'NON');
257	foreach ($items as $i => $item) {
258	if ($i > 0 && $i % 4 === 0) {
259	?></tr><tr><?php
260	}
261	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
262	}
263	?></tr></tbody></table>
264	</td>
265	</tr>
266	<tr>
267	<td>Compact DISPUTES</td>
268	<td class="hh-td-inner">
269	<table><tbody><tr><?php
270	$items = array('DSP');
271	foreach ($items as $i => $item) {
272	if ($i > 0 && $i % 4 === 0) {
273	?></tr><tr><?php
274	}
275	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
276	}
277	?></tr></tbody></table>
278	</td>
279	</tr>
280	<tr>
281	<td>Compact REMEDIES</td>
282	<td class="hh-td-inner">
283	<table><tbody><tr><?php
284	$items = array('COR', 'MON', 'LAW');
285	foreach ($items as $i => $item) {
286	if ($i > 0 && $i % 4 === 0) {
287	?></tr><tr><?php
288	}
289	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
290	}
291	?></tr></tbody></table>
292	</td>
293	</tr>
294	<tr>
295	<td>Compact NON-IDENTIFIABLE</td>
296	<td class="hh-td-inner">
297	<table><tbody><tr><?php
298	$items = array('NID');
299	foreach ($items as $i => $item) {
300	if ($i > 0 && $i % 4 === 0) {
301	?></tr><tr><?php
302	}
303	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
304	}
305	?></tr></tbody></table>
306	</td>
307	</tr>
308	<tr>
309	<td>Compact PURPOSE</td>
310	<td class="hh-td-inner">
311	<table><tbody><tr><?php
312	$items = array('CUR', 'ADM', 'DEV', 'TAI', 'PSA', 'PSD', 'IVA', 'IVD', 'CON', 'HIS', 'TEL', 'OTP');
313	foreach ($items as $i => $item) {
314	if ($i > 0 && $i % 4 === 0) {
315	?></tr><tr><?php
316	}
317	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
318	}
319	?></tr></tbody></table>
320	</td>
321	</tr>
322	<tr>
323	<td>Compact RECIPIENT</td>
324	<td class="hh-td-inner">
325	<table><tbody><tr><?php
326	$items = array('OUR', 'DEL', 'SAM', 'UNR', 'PUB', 'OTR');
327	foreach ($items as $i => $item) {
328	if ($i > 0 && $i % 4 === 0) {
329	?></tr><tr><?php
330	}
331	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
332	}
333	?></tr></tbody></table>
334	</td>
335	</tr>
336	<tr>
337	<td>Compact RETENTION</td>
338	<td class="hh-td-inner">
339	<table><tbody><tr><?php
340	$items = array('NOR', 'STP', 'LEG', 'BUS', 'IND');
341	foreach ($items as $i => $item) {
342	if ($i > 0 && $i % 4 === 0) {
343	?></tr><tr><?php
344	}
345	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
346	}
347	?></tr></tbody></table>
348	</td>
349	</tr>
350	<tr>
351	<td>Compact CATEGORIES</td>
352	<td class="hh-td-inner">
353	<table><tbody><tr><?php
354	$items = array('PHY', 'ONL', 'UNI', 'PUR', 'FIN', 'COM', 'NAV', 'INT', 'DEM', 'CNT', 'STA', 'POL', 'HEA', 'PRE', 'LOC', 'GOV', 'OTC');
355	foreach ($items as $i => $item) {
356	if ($i > 0 && $i % 4 === 0) {
357	?></tr><tr><?php
358	}
359	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
360	}
361	?></tr></tbody></table>
362	</td>
363	</tr>
364	<tr>
365	<td>Compact TEST</td>
366	<td class="hh-td-inner">
367	<table><tbody><tr><?php
368	$items = array('TST');
369	foreach ($items as $i => $item) {
370	if ($i > 0 && $i % 4 === 0) {
371	?></tr><tr><?php
372	}
373	?><td><label><input type="checkbox" class="http-header-value" name="hh_p3p_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $p3p_value) ? NULL : ' checked="checked"'; ?><?php disabled($p3p, 0); ?> /> <?php echo $item; ?></label></td><?php
374	}
375	?></tr></tbody></table>
376	</td>
377	</tr>
378	</tbody>
379	</table>
380
381	</td>
382	</tr>
383
384	<tr valign="top">
385	<th scope="row">Referrer-Policy
386	<p class="description">The Referrer-Policy HTTP header governs which referrer information, sent in the Referer header, should be included with requests made.</p>
387	</th>
388	<td>
389	<fieldset>
390	<legend class="screen-reader-text">Referrer-Policy</legend>
391	<?php
392	$referrer_policy = get_option('hh_referrer_policy', 0);
393	foreach ($bools as $k => $v)
394	{
395	?><p><label><input type="radio" class="http-header" name="hh_referrer_policy" value="<?php echo $k; ?>"<?php checked($referrer_policy, $k, true); ?> /> <?php echo $v; ?></label></p><?php
396	}
397	?>
398	</fieldset>
399	</td>
400	<td>
401	<select name="hh_referrer_policy_value" class="http-header-value"<?php disabled($referrer_policy, 0); ?>>
402	<?php
403	$items = array("", "no-referrer", "no-referrer-when-downgrade", "same-origin", "origin", "strict-origin", "origin-when-cross-origin", "strict-origin-when-cross-origin", "unsafe-url");
404	$referrer_policy_value = get_option('hh_referrer_policy_value');
405	foreach ($items as $item) {
406	?><option value="<?php echo $item; ?>"<?php selected($referrer_policy_value, $item); ?>><?php echo !empty($item) ? $item : '(empty string)'; ?></option><?php
407	}
408	?>
409	</select>
410	</td>
411	</tr>
412	</tbody>
413	</table>
414
415	<?php submit_button(); ?>
416
417	</form>
418	</section>
419
420	<section class="hh-panel">
421	<h2>Cross-domain headers</h2>
422
423	<form method="post" action="options.php">
424	<?php settings_fields('http-headers-cors'); ?>
425	<?php do_settings_sections('http-headers-cors'); ?>
426	<table class="form-table hh-table">
427	<tbody>
428	<tr>
429	<th scope="row">Access-Control-Allow-Origin
430	<p class="description">The Access-Control-Allow-Origin header indicates whether a resource can be shared.</p>
431	</th>
432	<td>
433	<fieldset>
434	<legend class="screen-reader-text">Access-Control-Allow-Credentials</legend>
435	<?php
436	$access_control_allow_origin = get_option('hh_access_control_allow_origin', 0);
437	foreach ($bools as $k => $v)
438	{
439	?><p><label><input type="radio" class="http-header" name="hh_access_control_allow_origin" value="<?php echo $k; ?>"<?php checked($access_control_allow_origin, $k); ?> /> <?php echo $v; ?></label></p><?php
440	}
441	?>
442	</fieldset>
443	</td>
444	<td>
445	<select name="hh_access_control_allow_origin_value" class="http-header-value"<?php disabled($access_control_allow_origin, 0); ?>>
446	<?php
447	$items = array('*', 'HTTP_ORIGIN', 'origin');
448	$access_control_allow_origin_value = get_option('hh_access_control_allow_origin_value');
449	foreach ($items as $item) {
450	?><option value="<?php echo $item; ?>"<?php selected($access_control_allow_origin_value, $item); ?>><?php echo $item; ?></option><?php
451	}
452	?>
453	</select>
454	<input type="text" name="hh_access_control_allow_origin_url" placeholder="http://domain.com" value="<?php echo esc_attr(get_option('hh_access_control_allow_origin_url')); ?>"<?php echo $access_control_allow_origin == 1 && $access_control_allow_origin_value == 'origin' ? NULL : ' disabled="disabled" style="display: none"'; ?> />
455	</td>
456	</tr>
457
458	<tr>
459	<th scope="row">Access-Control-Allow-Credentials
460	<p class="description">The Access-Control-Allow-Credentials header indicates whether the response to request can be exposed when the credentials flag is true.</p>
461	</th>
462	<td>
463	<fieldset>
464	<legend class="screen-reader-text">Access-Control-Allow-Credentials</legend>
465	<?php
466	$access_control_allow_credentials = get_option('hh_access_control_allow_credentials', 0);
467	foreach ($bools as $k => $v)
468	{
469	?><p><label><input type="radio" class="http-header" name="hh_access_control_allow_credentials" value="<?php echo $k; ?>"<?php checked($access_control_allow_credentials, $k); ?> /> <?php echo $v; ?></label></p><?php
470	}
471	?>
472	</fieldset>
473	</td>
474	<td>
475	<select name="hh_access_control_allow_credentials_value" class="http-header-value"<?php disabled($access_control_allow_credentials, 0); ?>>
476	<?php
477	$items = array('true', 'false');
478	$access_control_allow_credentials_value = get_option('hh_access_control_allow_credentials_value');
479	foreach ($items as $item) {
480	?><option value="<?php echo $item; ?>"<?php selected($access_control_allow_credentials_value, $item); ?>><?php echo $item; ?></option><?php
481	}
482	?>
483	</select>
484	</td>
485	</tr>
486
487	<tr>
488	<th scope="row">Access-Control-Expose-Headers
489	<p class="description">The Access-Control-Expose-Headers response header brings information about headers that browsers could allow accessing.</p>
490	</th>
491	<td>
492	<fieldset>
493	<legend class="screen-reader-text">Access-Control-Expose-Headers</legend>
494	<?php
495	$access_control_expose_headers = get_option('hh_access_control_expose_headers', 0);
496	foreach ($bools as $k => $v)
497	{
498	?><p><label><input type="radio" class="http-header" name="hh_access_control_expose_headers" value="<?php echo $k; ?>"<?php checked($access_control_expose_headers, $k); ?> /> <?php echo $v; ?></label></p><?php
499	}
500	?>
501	</fieldset>
502	</td>
503	<td>
504	<table><tbody><tr>
505	<?php
506	$items = array('Accept', 'Accept-Charset', 'Accept-Encoding', 'Accept-Language', 'Accept-Datetime', 'Authorization', 'Cache-Control', 'Connection', 'Permanent', 'Cookie', 'Content-Length', 'Content-MD5', 'Content-Type', 'Date', 'Expect', 'Forwarded', 'From', 'Host', 'Permanent', 'If-Match', 'If-Modified-Since', 'If-None-Match', 'If-Range', 'If-Unmodified-Since', 'Max-Forwards', 'Origin', 'Pragma', 'Proxy-Authorization', 'Range', 'Referer', 'TE', 'User-Agent', 'Upgrade', 'Via', 'Warning', 'X-Requested-With', 'DNT', 'X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto', 'Front-End-Https', 'X-Http-Method-Override', 'X-ATT-DeviceId', 'X-Wap-Profile', 'Proxy-Connection', 'X-UIDH', 'X-Csrf-Token', 'X-PINGOTHER');
507	$access_control_expose_headers_value = get_option('hh_access_control_expose_headers_value');
508	if (!$access_control_expose_headers_value)
509	{
510	$access_control_expose_headers_value = array();
511	}
512	foreach ($items as $i => $item) {
513	if ($i % 3 === 0) {
514	?></tr><tr><?php
515	}
516	?><td><label><input type="checkbox" class="http-header-value" name="hh_access_control_expose_headers_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $access_control_expose_headers_value) ? NULL : ' checked="checked"'; ?><?php disabled($access_control_expose_headers, 0); ?> /> <?php echo $item; ?></label></td><?php
517	}
518	?>
519	</tr></tbody></table>
520	</td>
521	</tr>
522
523	<tr>
524	<th scope="row">Access-Control-Max-Age
525	<p class="description">The Access-Control-Max-Age header indicates how much time, the result of a preflight request, can be cached.</p>
526	</th>
527	<td>
528	<fieldset>
529	<legend class="screen-reader-text">Access-Control-Max-Age</legend>
530	<?php
531	$access_control_max_age = get_option('hh_access_control_max_age', 0);
532	foreach ($bools as $k => $v)
533	{
534	?><p><label><input type="radio" class="http-header" name="hh_access_control_max_age" value="<?php echo $k; ?>"<?php checked($access_control_max_age, $k); ?> /> <?php echo $v; ?></label></p><?php
535	}
536	?>
537	</fieldset>
538	</td>
539	<td>
540	<input type="text" name="hh_access_control_max_age_value" class="http-header-value" value="<?php echo esc_attr(get_option('hh_access_control_max_age_value')); ?>"<?php disabled($access_control_max_age, 0); ?>>
541	</td>
542	</tr>
543
544	<tr>
545	<th scope="row">Access-Control-Allow-Methods
546	<p class="description">The Access-Control-Allow-Methods header is returned by the server in a response to a preflight request and informs the browser about the HTTP methods that can be used in the actual request.</p>
547	</th>
548	<td>
549	<fieldset>
550	<legend class="screen-reader-text">Access-Control-Allow-Methods</legend>
551	<?php
552	$access_control_allow_methods = get_option('hh_access_control_allow_methods', 0);
553	foreach ($bools as $k => $v)
554	{
555	?><p><label><input type="radio" class="http-header" name="hh_access_control_allow_methods" value="<?php echo $k; ?>"<?php checked($access_control_allow_methods, $k); ?> /> <?php echo $v; ?></label></p><?php
556	}
557	?>
558	</fieldset>
559	</td>
560	<td>
561	<?php
562	$items = array('GET', 'POST', 'OPTIONS', 'HEAD', 'PUT', 'DELETE', 'TRACE', 'CONNECT', 'PATCH');
563	$access_control_allow_methods_value = get_option('hh_access_control_allow_methods_value');
564	if (!$access_control_allow_methods_value)
565	{
566	$access_control_allow_methods_value = array();
567	}
568	foreach ($items as $item)
569	{
570	?><p><label><input type="checkbox" class="http-header-value" name="hh_access_control_allow_methods_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $access_control_allow_methods_value) ? NULL : ' checked="checked"'; ?><?php disabled($access_control_allow_methods, 0); ?> /> <?php echo $item; ?></label></p><?php
571	}
572	?>
573	</td>
574	</tr>
575
576	<tr>
577	<th scope="row">Access-Control-Allow-Headers
578	<p class="description">The Access-Control-Allow-Headers header is returned by the server in a response to a preflight request and informs the browser about the HTTP headers that can be used in the actual request.</p>
579	</th>
580	<td>
581	<fieldset>
582	<legend class="screen-reader-text">Access-Control-Allow-Credentials</legend>
583	<?php
584	$access_control_allow_headers = get_option('hh_access_control_allow_headers', 0);
585	foreach ($bools as $k => $v)
586	{
587	?><p><label><input type="radio" class="http-header" name="hh_access_control_allow_headers" value="<?php echo $k; ?>"<?php checked($access_control_allow_headers, $k); ?> /> <?php echo $v; ?></label></p><?php
588	}
589	?>
590	</fieldset>
591	</td>
592	<td>
593	<table><tbody><tr>
594	<?php
595	$items = array('Accept', 'Accept-Charset', 'Accept-Encoding', 'Accept-Language', 'Accept-Datetime', 'Authorization', 'Cache-Control', 'Connection', 'Permanent', 'Cookie', 'Content-Length', 'Content-MD5', 'Content-Type', 'Date', 'Expect', 'Forwarded', 'From', 'Host', 'Permanent', 'If-Match', 'If-Modified-Since', 'If-None-Match', 'If-Range', 'If-Unmodified-Since', 'Max-Forwards', 'Origin', 'Pragma', 'Proxy-Authorization', 'Range', 'Referer', 'TE', 'User-Agent', 'Upgrade', 'Via', 'Warning', 'X-Requested-With', 'DNT', 'X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto', 'Front-End-Https', 'X-Http-Method-Override', 'X-ATT-DeviceId', 'X-Wap-Profile', 'Proxy-Connection', 'X-UIDH', 'X-Csrf-Token', 'X-PINGOTHER');
596	$access_control_allow_headers_value = get_option('hh_access_control_allow_headers_value');
597	if (!$access_control_allow_headers_value)
598	{
599	$access_control_allow_headers_value = array();
600	}
601	foreach ($items as $i => $item) {
602	if ($i % 3 === 0) {
603	?></tr><tr><?php
604	}
605	?><td><label><input type="checkbox" class="http-header-value" name="hh_access_control_allow_headers_value[<?php echo $item; ?>]" value="1"<?php echo !array_key_exists($item, $access_control_allow_headers_value) ? NULL : ' checked="checked"'; ?><?php disabled($access_control_allow_headers, 0); ?> /> <?php echo $item; ?></label></td><?php
606	}
607	?>
608	</tr></tbody></table>
609	</td>
610	</tr>
611	</tbody>
612	</table>
613
614	<?php submit_button(); ?>
615
616	</form>
617	</section>
618	</div>