http-headers / views / content-security-policy.php

content-security-policy.php in HTTP Headers trunk, at views/content-security-policy.php

123 lines 4.6 KB

Raw Download Zip

1	<?php
2	if (!defined('ABSPATH')) {
3	exit;
4	}
5	$http_headers_content_security_policy = get_option('hh_content_security_policy', 0);
6	?>
7	<tr valign="top">
8	<th scope="row">Content Security Policy
9	<p class="description"><?php esc_html_e('Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.', 'http-headers'); ?></p>
10
11	<p>
12	<label><input type="checkbox" class="http-header-value"
13	name="hh_content_security_policy_report_only" value="1"
14	<?php checked(get_option('hh_content_security_policy_report_only'), 1, true); ?>
15	<?php echo $http_headers_content_security_policy == 1 ? NULL : ' readonly'; ?> /> "Report-Only" (<?php esc_html_e('for reporting-only purposes', 'http-headers'); ?>)</label>
16	</p>
17	<hr>
18	<p class="description">Useful tools:</p>
19	<p class="description">
20	<a target="_blank" href="https://report-uri.com/home/sri_hash">SRI Hash Generator</a>
21	- generates subresource integrity hashes using a cryptographic algorithm.
22	</p>
23	<p class="description">
24	<a target="_blank" href="https://report-uri.com/home/hash">CSP Hash Generator</a>
25	- generates CSP hashes to use in script-src and style-src directives.
26	</p>
27	<hr>
28	<p class="description"><?php esc_html_e('Read more at', 'http-headers'); ?>
29	<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"><?php esc_html_e('MDN Web Docs', 'http-headers'); ?></a>
30	</p>
31	</th>
32	<td>
33	<fieldset>
34	<legend class="screen-reader-text">Content-Security-Policy</legend>
35	<?php
36	foreach ($http_headers_bools as $http_headers_k => $http_headers_v)
37	{
38	?><p><label><input type="radio" class="http-header" name="hh_content_security_policy" value="<?php echo esc_attr($http_headers_k); ?>"<?php checked($http_headers_content_security_policy, $http_headers_k, true); ?> /> <?php echo esc_html($http_headers_v); ?></label></p><?php
39	}
40	?>
41	</fieldset>
42	</td>
43	<td>
44	<?php settings_fields( 'http-headers-csp' ); ?>
45	<?php do_settings_sections( 'http-headers-csp' ); ?>
46	<table>
47	<tbody>
48	<tr>
49	<td><strong><?php esc_html_e('Directive', 'http-headers'); ?></strong></td>
50	<td><strong><?php esc_html_e('Value', 'http-headers'); ?></strong></td>
51	</tr>
52	<?php
53	$http_headers_directives = array(
54	'default-src',
55	'script-src',
56	'script-src-elem',
57	'script-src-attr',
58	'style-src',
59	'style-src-elem',
60	'style-src-attr',
61	'img-src',
62	'connect-src',
63	'font-src',
64	'media-src',
65	'report-uri',
66	'child-src',
67	'form-action',
68	'frame-ancestors',
69	'object-src',
70	'frame-src',
71	'worker-src',
72	'manifest-src',
73	'navigate-to',
74	'prefetch-src',
75	'base-uri',
76	'plugin-types',
77	'report-to',
78	'sandbox',
79	'require-sri-for',
80	'block-all-mixed-content',
81	'upgrade-insecure-requests',
82	);
83	$http_headers_csp_value = get_option('hh_content_security_policy_value', array());
84	$http_headers_csp_value = is_array($http_headers_csp_value) ? $http_headers_csp_value : array();
85	foreach ($http_headers_directives as $http_headers_item)
86	{
87	?>
88	<tr>
89	<td><?php echo esc_html($http_headers_item); ?></td>
90	<td>
91	<?php
92
93	if ($http_headers_item == 'sandbox')
94	{
95	include 'includes/csp-sandbox.inc.php';
96
97	} elseif (in_array($http_headers_item, array('block-all-mixed-content', 'upgrade-insecure-requests'))) {
98
99	include 'includes/csp-inc.inc.php';
100
101	} elseif (in_array($http_headers_item, array('report-to', 'plugin-types'))) {
102
103	include 'includes/csp-text.inc.php';
104
105	} elseif ($http_headers_item == 'require-sri-for') {
106
107	include 'includes/csp-sri.inc.php';
108
109	} else {
110
111	include 'includes/csp-src.inc.php';
112
113	}
114	?>
115	</td>
116	</tr>
117	<?php
118	}
119	?>
120	</tbody>
121	</table>
122	</td>
123	</tr>