HtmlEmailFooterView.php
5 years ago
HtmlReportEmailHeaderView.php
4 years ago
MethodCallExpression.php
5 years ago
OneClickDone.php
4 years ago
RenderTokenParser.php
5 years ago
SecurityPolicy.php
4 years ago
UIControl.php
5 years ago
ViewInterface.php
5 years ago
SecurityPolicy.php
125 lines
| 1 | <?php |
| 2 | /** |
| 3 | * Matomo - free/libre analytics platform |
| 4 | * |
| 5 | * @link https://matomo.org |
| 6 | * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later |
| 7 | * |
| 8 | */ |
| 9 | namespace Piwik\View; |
| 10 | |
| 11 | use Piwik\Config; |
| 12 | |
| 13 | /** |
| 14 | * Content Security Policy HTTP Header management class |
| 15 | * |
| 16 | */ |
| 17 | class SecurityPolicy |
| 18 | { |
| 19 | /* |
| 20 | * Commonly used rules |
| 21 | */ |
| 22 | const RULE_DEFAULT = "'self' 'unsafe-inline' 'unsafe-eval'"; |
| 23 | const RULE_IMG_DEFAULT = "'self' 'unsafe-inline' 'unsafe-eval' data:"; |
| 24 | const RULE_EMBEDDED_FRAME = "'self' 'unsafe-inline' 'unsafe-eval' data: https: http:"; |
| 25 | |
| 26 | /** |
| 27 | * The policies that will generate the CSP header. |
| 28 | * These are keyed by the directive. |
| 29 | * |
| 30 | * @var array |
| 31 | */ |
| 32 | private $policies = array(); |
| 33 | |
| 34 | private $cspEnabled; |
| 35 | private $reportOnly; |
| 36 | |
| 37 | /** |
| 38 | * Constructor. |
| 39 | */ |
| 40 | public function __construct(Config $config) { |
| 41 | $this->policies['default-src'] = self::RULE_DEFAULT; |
| 42 | $this->policies['img-src'] = self::RULE_IMG_DEFAULT; |
| 43 | |
| 44 | $generalConfig = $config->General; |
| 45 | $this->cspEnabled = $generalConfig['csp_enabled'] ?? true; |
| 46 | $this->reportOnly = $generalConfig['csp_report_only'] ?? false; |
| 47 | } |
| 48 | |
| 49 | /** |
| 50 | * Appends a policy to a directive. |
| 51 | * |
| 52 | * @api |
| 53 | */ |
| 54 | public function addPolicy($directive, $value) { |
| 55 | if (isset($this->policies[$directive])) { |
| 56 | $this->policies[$directive] .= ' ' . $value; |
| 57 | } else { |
| 58 | $this->policies[$directive] = $value; |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | /** |
| 63 | * Removes a directive. |
| 64 | * |
| 65 | * @api |
| 66 | */ |
| 67 | public function removeDirective($directive) { |
| 68 | if (isset($this->policies[$directive])) { |
| 69 | unset($this->policies[$directive]); |
| 70 | } |
| 71 | } |
| 72 | |
| 73 | /** |
| 74 | * Overrides a directive. |
| 75 | * |
| 76 | * @api |
| 77 | */ |
| 78 | public function overridePolicy($directive, $value) { |
| 79 | $this->policies[$directive] = $value; |
| 80 | } |
| 81 | |
| 82 | /** |
| 83 | * Disable CSP |
| 84 | * |
| 85 | * @api |
| 86 | */ |
| 87 | public function disable() { |
| 88 | $this->cspEnabled = false; |
| 89 | } |
| 90 | |
| 91 | /** |
| 92 | * Creates the Header String that can be inserted in the Content-Security-Policy header. |
| 93 | * |
| 94 | * @return string |
| 95 | */ |
| 96 | public function createHeaderString() { |
| 97 | if (!$this->cspEnabled) { |
| 98 | return ''; |
| 99 | } |
| 100 | |
| 101 | if ($this->reportOnly) { |
| 102 | $headerString = 'Content-Security-Policy-Report-Only: '; |
| 103 | } else { |
| 104 | $headerString = 'Content-Security-Policy: '; |
| 105 | } |
| 106 | foreach ($this->policies as $directive => $values) { |
| 107 | $headerString .= $directive . ' ' . $values . '; '; |
| 108 | } |
| 109 | |
| 110 | return $headerString; |
| 111 | } |
| 112 | |
| 113 | /** |
| 114 | * A less restrictive CSP which will allow embedding other sites with iframes |
| 115 | * (useful for heatmaps and session recordings) |
| 116 | * |
| 117 | * @api |
| 118 | */ |
| 119 | public function allowEmbedPage() { |
| 120 | $this->overridePolicy('default-src', self::RULE_EMBEDDED_FRAME); |
| 121 | $this->overridePolicy('img-src', self::RULE_EMBEDDED_FRAME); |
| 122 | $this->addPolicy('script-src', self::RULE_DEFAULT); |
| 123 | } |
| 124 | } |
| 125 |