HtmlEmailFooterView.php
2 years ago
HtmlReportEmailHeaderView.php
2 years ago
MethodCallExpression.php
2 years ago
OneClickDone.php
2 years ago
RenderTokenParser.php
2 years ago
SecurityPolicy.php
2 years ago
UIControl.php
2 years ago
ViewInterface.php
2 years ago
SecurityPolicy.php
120 lines
| 1 | <?php |
| 2 | |
| 3 | /** |
| 4 | * Matomo - free/libre analytics platform |
| 5 | * |
| 6 | * @link https://matomo.org |
| 7 | * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later |
| 8 | * |
| 9 | */ |
| 10 | namespace Piwik\View; |
| 11 | |
| 12 | use Piwik\Config; |
| 13 | /** |
| 14 | * Content Security Policy HTTP Header management class |
| 15 | * |
| 16 | */ |
| 17 | class SecurityPolicy |
| 18 | { |
| 19 | /* |
| 20 | * Commonly used rules |
| 21 | */ |
| 22 | const RULE_DEFAULT = "'self' 'unsafe-inline' 'unsafe-eval'"; |
| 23 | const RULE_IMG_DEFAULT = "'self' 'unsafe-inline' 'unsafe-eval' data:"; |
| 24 | const RULE_EMBEDDED_FRAME = "'self' 'unsafe-inline' 'unsafe-eval' data: https: http:"; |
| 25 | /** |
| 26 | * The policies that will generate the CSP header. |
| 27 | * These are keyed by the directive. |
| 28 | * |
| 29 | * @var array |
| 30 | */ |
| 31 | private $policies = array(); |
| 32 | private $cspEnabled; |
| 33 | private $reportOnly; |
| 34 | /** |
| 35 | * Constructor. |
| 36 | */ |
| 37 | public function __construct(Config $config) |
| 38 | { |
| 39 | $this->policies['default-src'] = self::RULE_DEFAULT; |
| 40 | $this->policies['img-src'] = self::RULE_IMG_DEFAULT; |
| 41 | $generalConfig = $config->General; |
| 42 | $this->cspEnabled = $generalConfig['csp_enabled'] ?? true; |
| 43 | $this->reportOnly = $generalConfig['csp_report_only'] ?? false; |
| 44 | } |
| 45 | /** |
| 46 | * Appends a policy to a directive. |
| 47 | * |
| 48 | * @api |
| 49 | */ |
| 50 | public function addPolicy($directive, $value) |
| 51 | { |
| 52 | if (isset($this->policies[$directive])) { |
| 53 | $this->policies[$directive] .= ' ' . $value; |
| 54 | } else { |
| 55 | $this->policies[$directive] = $value; |
| 56 | } |
| 57 | } |
| 58 | /** |
| 59 | * Removes a directive. |
| 60 | * |
| 61 | * @api |
| 62 | */ |
| 63 | public function removeDirective($directive) |
| 64 | { |
| 65 | if (isset($this->policies[$directive])) { |
| 66 | unset($this->policies[$directive]); |
| 67 | } |
| 68 | } |
| 69 | /** |
| 70 | * Overrides a directive. |
| 71 | * |
| 72 | * @api |
| 73 | */ |
| 74 | public function overridePolicy($directive, $value) |
| 75 | { |
| 76 | $this->policies[$directive] = $value; |
| 77 | } |
| 78 | /** |
| 79 | * Disable CSP |
| 80 | * |
| 81 | * @api |
| 82 | */ |
| 83 | public function disable() |
| 84 | { |
| 85 | $this->cspEnabled = false; |
| 86 | } |
| 87 | /** |
| 88 | * Creates the Header String that can be inserted in the Content-Security-Policy header. |
| 89 | * |
| 90 | * @return string |
| 91 | */ |
| 92 | public function createHeaderString() |
| 93 | { |
| 94 | if (!$this->cspEnabled) { |
| 95 | return ''; |
| 96 | } |
| 97 | if ($this->reportOnly) { |
| 98 | $headerString = 'Content-Security-Policy-Report-Only: '; |
| 99 | } else { |
| 100 | $headerString = 'Content-Security-Policy: '; |
| 101 | } |
| 102 | foreach ($this->policies as $directive => $values) { |
| 103 | $headerString .= $directive . ' ' . $values . '; '; |
| 104 | } |
| 105 | return $headerString; |
| 106 | } |
| 107 | /** |
| 108 | * A less restrictive CSP which will allow embedding other sites with iframes |
| 109 | * (useful for heatmaps and session recordings) |
| 110 | * |
| 111 | * @api |
| 112 | */ |
| 113 | public function allowEmbedPage() |
| 114 | { |
| 115 | $this->overridePolicy('default-src', self::RULE_EMBEDDED_FRAME); |
| 116 | $this->overridePolicy('img-src', self::RULE_EMBEDDED_FRAME); |
| 117 | $this->addPolicy('script-src', self::RULE_DEFAULT); |
| 118 | } |
| 119 | } |
| 120 |