settings_firewall_policies.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.8.8

ninjafirewall / lib / settings_firewall_policies.php

ninjafirewall / lib Last commit date

settings_firewall_policies.php

1824 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n+ / sa / 2
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	// Block immediately if user is not allowed
23	nf_not_allowed( 'block', __LINE__ );
24
25	$yes = __('Yes', 'ninjafirewall');
26	$no = __('No', 'ninjafirewall');
27
28	$full_waf_msg = '<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span>'.
29	sprintf( __('To use this feature, please <a href="%s">go to the Dashboard page</a> and enable NinjaFirewall\'s Full WAF mode.', 'ninjafirewall'), '?page=NinjaFirewall' ) .'</p>';
30
31	if ( defined('NFW_WPWAF') ) {
32	$option_disabled = 1;
33	} else {
34	$option_disabled = 0;
35	}
36
37	$nfw_options = nfw_get_option( 'nfw_options' );
38	$nfw_rules = nfw_get_option( 'nfw_rules' );
39
40	// Tab and div display
41	if ( empty( $_REQUEST['tab'] ) ) { $_REQUEST['tab'] = 'basic'; }
42
43	if ( $_REQUEST['tab'] == 'intermediate' ) {
44	$basic_tab = ''; $basic_div = ' style="display:none"';
45	$intermediate_tab = ' nav-tab-active'; $intermediate_div = '';
46	$advanced_tab = ''; $advanced_div = ' style="display:none"';
47
48	} elseif ( $_REQUEST['tab'] == 'advanced' ) {
49	$basic_tab = ''; $basic_div = ' style="display:none"';
50	$intermediate_tab = ''; $intermediate_div = ' style="display:none"';
51	$advanced_tab = ' nav-tab-active'; $advanced_div = '';
52
53	} else {
54	$_REQUEST['tab'] = 'basic';
55	$basic_tab = ' nav-tab-active'; $basic_div = '';
56	$intermediate_tab = ''; $intermediate_div = ' style="display:none"';
57	$advanced_tab = ''; $advanced_div = ' style="display:none"';
58	}
59
60	?>
61	<div class="wrap">
62	<h1><img style="vertical-align:top;width:33px;height:33px;" src="<?php echo plugins_url( '/ninjafirewall/images/ninjafirewall_32.png' ) ?>"> <?php _e('Firewall Policies', 'ninjafirewall') ?></h1>
63	<?php
64
65	if ( isset( $_POST['nfw_options']) ) {
66	if ( empty($_POST['nfwnonce']) \|\| ! wp_verify_nonce($_POST['nfwnonce'], 'policies_save') ) {
67	wp_nonce_ays('policies_save');
68	}
69	if (! empty($_POST['Save']) ) {
70	nf_sub_policies_save();
71	echo '<div class="updated notice is-dismissible"><p>' . __('Your changes have been saved.', 'ninjafirewall') . '</p></div>';
72	} elseif (! empty($_POST['Default']) ) {
73	nf_sub_policies_default();
74	echo '<div class="updated notice is-dismissible"><p>' . __('Default values were restored.', 'ninjafirewall') . '</p></div>';
75	} else {
76	echo '<div class="error notice is-dismissible"><p>' . __('No action taken.', 'ninjafirewall') . '</p></div>';
77	}
78	$nfw_options = nfw_get_option( 'nfw_options' );
79	$nfw_rules = nfw_get_option( 'nfw_rules' );
80	}
81
82	?>
83	<br />
84	<h2 class="nav-tab-wrapper wp-clearfix" style="cursor:pointer">
85	<a id="tab-basic" class="nav-tab<?php echo $basic_tab ?>" onClick="nfwjs_switch_tabs('basic', 'basic:intermediate:advanced')"><?php _e( 'Basic Policies', 'ninjafirewall' ) ?></a>
86	<a id="tab-intermediate" class="nav-tab<?php echo $intermediate_tab ?>" onClick="nfwjs_switch_tabs('intermediate', 'basic:intermediate:advanced')"><?php _e( 'Intermediate Policies', 'ninjafirewall' ) ?></a>
87	<a id="tab-advanced" class="nav-tab<?php echo $advanced_tab ?>" onClick="nfwjs_switch_tabs('advanced', 'basic:intermediate:advanced')"><?php _e( 'Advanced Policies', 'ninjafirewall' ) ?></a>
88	<?php nfw_contextual_help() ?>
89	</h2>
90	<br />
91	<?php
92
93	echo '<form method="post" name="fwrules">';
94	wp_nonce_field('policies_save', 'nfwnonce', 0);
95
96	// ---------------------------------------------------------------------
97	// Basic options:
98	?>
99	<div id="basic-options"<?php echo $basic_div ?>>
100	<?php
101	if ( ( isset( $nfw_options['scan_protocol']) ) &&
102	( preg_match( '/^[123]$/', $nfw_options['scan_protocol']) ) ) {
103	$scan_protocol = $nfw_options['scan_protocol'];
104	} else {
105	$scan_protocol = 3;
106	}
107
108	?>
109	<h3>HTTP / HTTPS</h3>
110	<table class="form-table nfw-table">
111	<tr>
112	<th scope="row" class="row-med"><?php _e('Enable NinjaFirewall for', 'ninjafirewall') ?></th>
113	<td>
114	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="3"<?php checked($scan_protocol, 3 ) ?>> <?php _e('HTTP and HTTPS traffic (default)', 'ninjafirewall') ?></label></p>
115	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="1"<?php checked($scan_protocol, 1 ) ?>> <?php _e('HTTP traffic only', 'ninjafirewall') ?></label></p>
116	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="2"<?php checked($scan_protocol, 2 ) ?>> <?php _e('HTTPS traffic only', 'ninjafirewall') ?></label></p>
117	</td>
118	</tr>
119	</table>
120
121	<br />
122	<br />
123
124	<?php
125	if ( empty( $nfw_options['sanitise_fn']) ) {
126	$sanitise_fn = 0;
127	} else {
128	$sanitise_fn = 1;
129	}
130	if ( empty( $nfw_options['uploads']) ) {
131	$uploads = 0;
132	$sanitise_fn = 0;
133	} else {
134	$uploads = 1;
135	}
136	if ( empty( $nfw_options['substitute'] ) \|\| strlen( $nfw_options['substitute'] ) > 1 \|\| $nfw_options['substitute'] == '/' ) {
137	$substitute = 'X';
138	} else {
139	$substitute = htmlspecialchars( $nfw_options['substitute'] );
140	}
141	?>
142	<h3><?php _e('Uploads', 'ninjafirewall') ?></h3>
143	<table class="form-table nfw-table">
144	<tr>
145	<th scope="row" class="row-med"><?php _e('File Uploads', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can allow uploads while rejecting potentially dangerous files, even if they are compressed inside a ZIP archive: scripts (PHP, CGI, Ruby, Python, bash/shell), C/C++ source code, binaries (MZ/PE/NE and ELF formats), system files (.htaccess, .htpasswd and PHP INI) and SVG files containing Javascript/XML events. You can easily limit the size of each uploaded file too, without having to modify your PHP configuration.', 'ninjafirewall' ) ?>"></span></th>
146	<td>
147	<select name="nfw_options[uploads]" onchange="nfwjs_upload_onoff(this);">
148	<option value="1"<?php selected( $uploads, 1 ) ?>><?php echo __('Allow uploads', 'ninjafirewall') .' '. __('(default)', 'ninjafirewall') ?></option>
149	<option value="0"<?php selected( $uploads, 0 ) ?>><?php _e('Disallow uploads', 'ninjafirewall') ?></option>
150	</select>
151	<br />
152	<label><input type="checkbox" onclick='return nfwjs_sanitise(this);' name="nfw_options[sanitise_fn]"<?php checked( $sanitise_fn, 1 ); disabled( $uploads, 0 ) ?> id="san">
153	<?php _e('Sanitise filenames', 'ninjafirewall') ?> (<?php _e('substitution character:', 'ninjafirewall') ?></label> <input id="subs" maxlength="1" size="1" value="<?php echo $substitute ?>" name="nfw_options[substitute]" type="text" <?php disabled( $uploads, 0 ) ?>/> )
154	</td>
155	</tr>
156	</table>
157
158	<br />
159	<br />
160
161	<?php
162	if (! isset( $nfw_options['wp_dir'] ) ) {
163	$nfw_options['wp_dir'] = '';
164	}
165	if ( strpos( $nfw_options['wp_dir'], 'wp-admin' ) !== FALSE ) {
166	$wp_admin = 1;
167	} else {
168	$wp_admin = 0;
169	}
170	if ( strpos( $nfw_options['wp_dir'], 'wp-includes' ) !== FALSE ) {
171	$wp_inc = 1;
172	} else {
173	$wp_inc = 0;
174	}
175	if ( strpos( $nfw_options['wp_dir'], 'uploads' ) !== FALSE ) {
176	$wp_upl = 1;
177	} else {
178	$wp_upl = 0;
179	}
180	if ( strpos( $nfw_options['wp_dir'], 'cache' ) !== FALSE ) {
181	$wp_cache = 1;
182	} else {
183	$wp_cache = 0;
184	}
185	if ( empty( $nfw_options['disallow_creation']) ) {
186	$disallow_creation = 0;
187	} else {
188	$disallow_creation = 1;
189	}
190	if ( empty( $nfw_options['disallow_deletion']) ) {
191	$disallow_deletion = 0;
192	} else {
193	$disallow_deletion = 1;
194	}
195	if ( empty( $nfw_options['disallow_privesc']) ) {
196	$disallow_privesc = 0;
197	} else {
198	$disallow_privesc = 1;
199	}
200	if ( empty( $nfw_options['disallow_privesc_mu']) ) {
201	$disallow_privesc_mu = 0;
202	} else {
203	$disallow_privesc_mu = 1;
204	}
205	if ( empty( $nfw_options['disallow_settings']) ) {
206	$disallow_settings = 0;
207	} else {
208	$disallow_settings = 1;
209	}
210	if ( empty( $nfw_options['enum_archives']) ) {
211	$enum_archives = 0;
212	} else {
213	$enum_archives = 1;
214	}
215	if ( empty( $nfw_options['enum_sitemap']) ) {
216	$enum_sitemap = 0;
217	} else {
218	$enum_sitemap = 1;
219	}
220	if ( empty( $nfw_options['enum_login']) ) {
221	$enum_login = 0;
222	} else {
223	$enum_login = 1;
224	}
225	if ( empty( $nfw_options['enum_restapi']) ) {
226	$enum_restapi = 0;
227	} else {
228	$enum_restapi = 1;
229	}
230	if ( empty( $nfw_options['enum_feed']) ) {
231	$enum_feed = 0;
232	} else {
233	$enum_feed = 1;
234	}
235	if ( empty( $nfw_options['no_appswd']) ) {
236	$no_appswd = 0;
237	} else {
238	$no_appswd = 1;
239	}
240	if ( empty( $nfw_options['no_restapi']) ) {
241	$no_restapi = 0;
242	} else {
243	$no_restapi = 1;
244	}
245	if ( empty( $nfw_options['restapi_loggedin']) \|\| $no_restapi == 0 ) {
246	$restapi_loggedin = 0;
247	} else {
248	$restapi_loggedin = 1;
249	}
250	if ( empty( $nfw_options['no_xmlrpc']) ) {
251	$no_xmlrpc = 0;
252	} else {
253	$no_xmlrpc = 1;
254	}
255	if ( empty( $nfw_options['no_xmlrpc_multi']) ) {
256	$no_xmlrpc_multi = 0;
257	} else {
258	$no_xmlrpc_multi = 1;
259	}
260	if ( empty( $nfw_options['no_xmlrpc_pingback']) ) {
261	$no_xmlrpc_pingback = 0;
262	} else {
263	$no_xmlrpc_pingback = 1;
264	}
265	if ( empty( $nfw_options['no_post_themes']) ) {
266	$no_post_themes = 0;
267	} else {
268	$no_post_themes = 1;
269	}
270
271	if ( empty( $nfw_options['force_ssl']) ) {
272	$force_ssl = 0;
273	} else {
274	$force_ssl = 1;
275	}
276	if ( empty( $nfw_options['disallow_edit']) ) {
277	$disallow_edit = 0;
278	} else {
279	$disallow_edit = 1;
280	}
281	if ( empty( $nfw_options['disallow_mods']) ) {
282	$disallow_mods = 0;
283	} else {
284	$disallow_mods = 1;
285	}
286	if ( empty( $nfw_options['disable_error_handler']) ) {
287	$disable_error_handler = 0;
288	} else {
289	$disable_error_handler = 1;
290	}
291	if ( empty( $nfw_options['disallow_publish']) ) {
292	$disallow_publish = 0;
293	} else {
294	$disallow_publish = 1;
295	}
296
297	$force_ssl_already_enabled = 0;
298	$disallow_edit_already_enabled = 0;
299	$disallow_mods_already_enabled = 0;
300	$disable_error_handler_already_enabled = 0;
301	if ( defined('DISALLOW_FILE_EDIT') && ! $disallow_edit ) {
302	$disallow_edit_already_enabled = 1;
303	}
304	if ( defined('DISALLOW_FILE_MODS') && ! $disallow_mods ) {
305	$disallow_mods_already_enabled = 1;
306	}
307	if ( defined('WP_DISABLE_FATAL_ERROR_HANDLER') && ! $disable_error_handler ) {
308	$disable_error_handler_already_enabled = 1;
309	}
310	if ( defined('FORCE_SSL_ADMIN') && FORCE_SSL_ADMIN == true && ! $force_ssl ) {
311	$force_ssl_already_enabled = 1;
312	}
313	?>
314	<h3>WordPress</h3>
315	<table class="form-table nfw-table">
316	<tr>
317	<th scope="row" class="row-med"><?php _e('Block direct access to any PHP file located in one of these directories', 'ninjafirewall') ?></th>
318	<td>
319	<?php
320	if ( defined('NFW_WPWAF') ) {
321	echo $full_waf_msg;
322	}
323	?>
324	<table class="form-table">
325	<tr style="border: solid 1px #DFDFDF;">
326	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_admin]" id="wp_01"<?php checked( $wp_admin, 1 ); disabled( $option_disabled, 1) ?>></td>
327	<td>
328	<label for="wp_01">
329	<p><code>/wp-admin/css/*</code></p>
330	<p><code>/wp-admin/images/*</code></p>
331	<p><code>/wp-admin/includes/*</code></p>
332	<p><code>/wp-admin/js/*</code></p>
333	</label>
334	</td>
335	</tr>
336	<tr style="border: solid 1px #DFDFDF;">
337	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_inc]" id="wp_02"<?php checked( $wp_inc, 1 ); disabled( $option_disabled, 1) ?>></td>
338	<td>
339	<label for="wp_02">
340	<p><code>/wp-includes/*.php</code></p>
341	<p><code>/wp-includes/css/*</code></p>
342	<p><code>/wp-includes/images/*</code></p>
343	<p><code>/wp-includes/js/*</code></p>
344	<p><code>/wp-includes/theme-compat/*</code></p>
345	</label>
346	<br />
347	<p class="description"><?php _e('NinjaFirewall will not block access to the TinyMCE WYSIWYG editor even if this option is enabled.', 'ninjafirewall') ?></p>
348	</td>
349	</tr>
350	<tr style="border: solid 1px #DFDFDF;">
351	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_upl]" id="wp_03"<?php checked( $wp_upl, 1 ); disabled( $option_disabled, 1) ?>></td>
352	<td><label for="wp_03">
353	<p><code>/<?php echo basename(WP_CONTENT_DIR); ?>/uploads/*</code></p>
354	<p><code>/<?php echo basename(WP_CONTENT_DIR); ?>/blogs.dir/*</code></p>
355	</label></td>
356	</tr>
357	<tr style="border: solid 1px #DFDFDF;">
358	<td align="center" style="vertical-align:top" width="10"><input type="checkbox" name="nfw_options[wp_cache]" id="wp_04"<?php checked( $wp_cache, 1 ); disabled( $option_disabled, 1) ?>></td>
359	<td style="vertical-align:top"><label for="wp_04"><code>/cache/</code></label>
360	<br />
361	<br />
362	<p class="description"><?php _e('Unless you have PHP scripts in a "/cache/" folder that need to be accessed by your visitors, we recommend to enable this option.', 'ninjafirewall') ?></p>
363	</td>
364	</tr>
365	</table>
366	<br />
367	</td>
368	</tr>
369
370	<?php
371	if ( defined('NFW_DISABLE_PRVESC2') ) {
372	$msg = '<p class="description">'. sprintf( __('To enable this option, please remove the %s constant from your wp-config.php or .htninja script.', 'ninjafirewall'), '<code>NFW_DISABLE_PRVESC2</code>' ) .'</p>';
373	$disabled = 1;
374	$disabled_mu = 1;
375	$disallow_privesc = 0;
376	$disallow_privesc_mu = 0;
377	} else {
378	$msg ='';
379	$disabled = 0;
380	$disabled_mu = 0;
381	}
382	$reg_user = ''; $res_user_msg = ' onclick="return nfwjs_reguserwarning(this)"';
383	$reg_site = ''; $res_site_msg = ' onclick="return nfwjs_regsitewarning(this)"';
384	// Multisite
385	if ( is_multisite() ) {
386	// 'none', 'user', 'blog' or 'all'
387	$reg = get_site_option( 'registration' );
388	if ( in_array( $reg, array('user', 'blog', 'all') ) ) {
389	if ( $reg != 'blog' ) {
390	$reg_user = $res_user_msg;
391	}
392	if ( $reg != 'user' ) {
393	$reg_site = $res_site_msg;
394	}
395	}
396	$main_site = ' '.__('(main site only)', 'ninjafirewall');
397	$network_only = ' '.__('(not recommended if you allow sites registration)', 'ninjafirewall');
398	// Single site
399	} else {
400	$reg = get_option( 'users_can_register' );
401	if (! empty( $reg ) ) {
402	$reg_user = $res_user_msg;
403	}
404	// Disable policy on a non-multisite installation
405	$disabled_mu = 1;
406	$main_site = '';
407	$network_only = ' '.__('(multisite installation only)', 'ninjafirewall');
408	}
409	if ( class_exists( 'woocommerce' ) ) {
410	$reg_user = ' onclick="return nfwjs_woowarning(this)"';
411	}
412	?>
413	<tr>
414	<th scope="row" class="row-med"><?php _e('Permissions', 'ninjafirewall') ?></th>
415	<td>
416	<p><label><input type="checkbox" name="nfw_options[disallow_settings]" value="1"<?php checked( $disallow_settings, 1 ) ?>> <?php echo _e('Block attempts to modify important WordPress settings', 'ninjafirewall') ?></label></p>
417	<p><label><input<?php echo $reg_user ?> type="checkbox" name="nfw_options[disallow_creation]" value="1"<?php checked( $disallow_creation, 1 ) ?>> <?php _e('Block user accounts creation', 'ninjafirewall') ?></label></p>
418	<p><label><input type="checkbox" name="nfw_options[disallow_deletion]" value="1"<?php checked( $disallow_deletion, 1 ) ?>> <?php _e('Block user accounts deletion', 'ninjafirewall') ?></label></p>
419	<p><label><input <?php disabled( $disabled, 1 ) ?>type="checkbox" name="nfw_options[disallow_privesc]" value="1"<?php checked( $disallow_privesc, 1 ) ?>> <?php _e('Block attempts to gain administrative privileges', 'ninjafirewall'); echo $main_site; ?></label></p>
420	<?php echo $msg ?>
421	<p style="margin-left:20px"><label><input<?php echo $reg_site ?> <?php disabled( $disabled_mu, 1 ) ?> type="checkbox" name="nfw_options[disallow_privesc_mu]" value="1"<?php checked( $disallow_privesc_mu, 1 ) ?>> <?php _e('Apply to all subsites in the network', 'ninjafirewall'); echo $network_only; ?></label></p>
422
423	<p><label><input type="checkbox" name="nfw_options[disallow_publish]" value="1"<?php checked( $disallow_publish, 1 ) ?>> <?php echo _e('Block attempts to publish, edit or delete a published post by users who do not have the right capabilities', 'ninjafirewall') ?> <?php _e('(recommended)', 'ninjafirewall') ?></label></p>
424	</td>
425	</tr>
426
427	<?php
428	if ( empty( $nfw_options['admin_ajax'] ) ) {
429	$admin_ajax = 0;
430	} else {
431	$admin_ajax = 1;
432	}
433	?>
434	<tr>
435	<th scope="row" class="row-med"><?php _e('WordPress AJAX', 'ninjafirewall') ?></th>
436	<td>
437	<p><label><input type="checkbox" name="nfw_options[admin_ajax]" value="1"<?php checked( $admin_ajax, 1 ) ?>> <?php _e('Protect <code>admin-ajax.php</code> against bots', 'ninjafirewall') ?></label></p>
438	<p class="description"><?php printf( __('Your server IP (%s), localhost and private IP addresses will not be affected by this policy.', 'ninjafirewall'), htmlspecialchars( $_SERVER['SERVER_ADDR'] ) ) ?></p>
439	</td>
440	</tr>
441
442	<tr>
443	<th scope="row" class="row-med"><?php _e('Protect against username enumeration', 'ninjafirewall') ?></th>
444	<td>
445	<p><label><input type="checkbox" name="nfw_options[enum_archives]" value="1"<?php checked( $enum_archives, 1 ) ?>> <?php _e('Through the author archives', 'ninjafirewall') ?></label></p>
446	<p><label><input type="checkbox" name="nfw_options[enum_sitemap]" value="1"<?php checked( $enum_sitemap, 1 ) ?>> <?php _e('Through the author sitemap', 'ninjafirewall') ?></label></p>
447	<p><label><input type="checkbox" name="nfw_options[enum_login]" value="1"<?php checked( $enum_login, 1 ) ?>> <?php _e('Through the login page', 'ninjafirewall') ?></label></p>
448	<p><label><input type="checkbox" name="nfw_options[enum_feed]" value="1"<?php checked( $enum_feed, 1 ) ?>> <?php _e('Through the blog feed', 'ninjafirewall') ?></label></p>
449	<p><label><input type="checkbox" name="nfw_options[enum_restapi]" value="1"<?php checked( $enum_restapi, 1 ) ?>> <?php _e('Through the WordPress REST API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
450	</td>
451	</tr>
452
453	<tr>
454	<th scope="row" class="row-med"><?php _e('WordPress REST API', 'ninjafirewall') ?></th>
455	<td>
456	<p><label><input type="checkbox" onClick="nfwjs_no_restapi(this);" name="nfw_options[no_restapi]" value="1"<?php checked( $no_restapi, 1 ) ?>> <?php _e('Block any access to the API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
457	<p style="margin-left:20px"><label><input type="checkbox"<?php disabled($no_restapi, 0) ?> name="nfw_options[restapi_loggedin]" value="1"<?php checked( $restapi_loggedin, 1 ) ?>> <?php _e('Allow logged-in users to access the API', 'ninjafirewall') ?></label></p>
458	</td>
459	</tr>
460	<tr>
461	<th scope="row" class="row-med"><?php _e('WordPress XML-RPC API', 'ninjafirewall') ?></th>
462	<td>
463	<p><label><input type="checkbox" onClick="nfwjs_no_xmlrpc(this);" name="nfw_options[no_xmlrpc]" value="1"<?php checked( $no_xmlrpc, 1 ) ?>> <?php _e('Block any access to the API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
464	<p><label><input type="checkbox"<?php disabled($no_xmlrpc, 1) ?> name="nfw_options[no_xmlrpc_multi]" value="1"<?php checked( $no_xmlrpc_multi, 1 ) ?>> <?php _e('Block <code>system.multicall</code> method', 'ninjafirewall') ?></label> <font color="red">*</font></p>
465	<p><label><input type="checkbox"<?php disabled($no_xmlrpc, 1) ?> name="nfw_options[no_xmlrpc_pingback]" value="1"<?php checked( $no_xmlrpc_pingback, 1 ) ?>> <?php _e('Block Pingbacks', 'ninjafirewall') ?></label></p>
466	<br />
467	<p class="description" style="font-size:14px"><font color="red">*</font> <?php _e('Disabling access to the REST or XML-RPC API may break some functionality on your blog, its themes or plugins (e.g., Gutenberg editor, Jetpack, Contact Form 7 etc).', 'ninjafirewall') ?></p>
468	</td>
469	</tr>
470
471	<tr>
472	<th scope="row" class="row-med"><?php _e('Application Passwords', 'ninjafirewall') ?></th>
473	<td>
474	<p><label><input type="checkbox" name="nfw_options[no_appswd]" value="1"<?php checked( $no_appswd, 1 ) ?>> <?php printf( __('Disable <a %s>Application Passwords</a>', 'ninjafirewall'), 'href="https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/" target="_blank" rel="noreferrer noopener"') ?></label></p>
475	</td>
476	</tr>
477
478	<tr valign="top">
479	<th scope="row" class="row-med" style="vertical-align:top"><?php _e('Block <code>POST</code> requests in the themes folder', 'ninjafirewall') ?> <code>/<?php echo basename(WP_CONTENT_DIR); ?>/themes</code></th>
480	<td>
481	<?php nfw_toggle_switch( 'info', 'nfw_options[no_post_themes]', $yes, $no, 'small', $no_post_themes, $option_disabled );
482	if ( defined('NFW_WPWAF') ) {
483	echo $full_waf_msg;
484	}
485	?>
486	</td>
487	</tr>
488	<tr valign="top">
489	<th scope="row" class="row-med"><a name="builtinconstants"></a><?php _e('Force HTTPS for admin and logins', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#require-ssl-for-admin-and-logins" target="_blank" rel="noreferrer noopener">FORCE_SSL_ADMIN</a></code></th>
490	<td>
491	<?php nfw_toggle_switch( 'info', 'nfw_options[force_ssl]', $yes, $no, 'small', $force_ssl, $force_ssl_already_enabled, 'onclick="return nfwjs_ssl_warn(this,'. NFW_IS_HTTPS .');"' ) ?>
492	</td>
493	</tr>
494	<tr valign="top">
495	<th scope="row" class="row-med"><?php _e('Disable the plugin and theme editor', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#disable-the-plugin-and-theme-editor" target="_blank" rel="noreferrer noopener">DISALLOW_FILE_EDIT</a></code></th>
496	<td>
497	<?php nfw_toggle_switch( 'info', 'nfw_options[disallow_edit]', $yes, $no, 'small', $disallow_edit, $disallow_edit_already_enabled ) ?>
498	</td>
499	</tr>
500	<tr valign="top">
501	<th scope="row" class="row-med"><?php _e('Disable plugin and theme update/installation', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#disable-plugin-and-theme-update-and-installation" target="_blank" rel="noreferrer noopener">DISALLOW_FILE_MODS</a></code></th>
502	<td>
503	<?php nfw_toggle_switch( 'info', 'nfw_options[disallow_mods]', $yes, $no, 'small', $disallow_mods, $disallow_mods_already_enabled ) ?>
504	</td>
505	</tr>
506	<tr valign="top">
507	<th scope="row" class="row-med"><?php _e('Disable the fatal error handler', 'ninjafirewall') ?> <code><a href="https://make.wordpress.org/core/2019/01/14/php-site-health-mechanisms-in-5-1/" target="_blank" rel="noreferrer noopener">WP_DISABLE_FATAL_ERROR_HANDLER</a></code></th>
508	<td>
509	<?php nfw_toggle_switch( 'info', 'nfw_options[disable_error_handler]', $yes, $no, 'small', $disable_error_handler, $disable_error_handler_already_enabled ) ?>
510	</td>
511	</tr>
512
513	</table>
514	<a name="donotblockadmin"></a>
515	<br />
516	<br />
517
518	<?php
519	if ( empty( $nfw_options['wl_admin']) ) {
520	$wl_admin = 0;
521	} elseif ( $nfw_options['wl_admin'] == 2 ) {
522	$wl_admin = 2;
523	} else {
524	$wl_admin = 1;
525	}
526	?>
527	<table class="form-table nfw-table">
528	<tr style="background-color:#F9F9F9;border: solid 1px #DFDFDF;">
529	<th scope="row" class="row-med"><?php _e('Users Whitelist', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, the Access Control section allows you to whitelist WordPress users depending on their role.', 'ninjafirewall' ) ?>"></span></th>
530	<td>
531	<p><label><input type="radio" name="nfw_options[wl_admin]" value="1"<?php checked( $wl_admin, 1 ) ?>> <?php _e('Add the Administrator to the whitelist (default).', 'ninjafirewall') ?></label></p>
532	<p><label><input type="radio" name="nfw_options[wl_admin]" value="2"<?php checked( $wl_admin, 2 ) ?>> <?php _e('Add all logged in users to the whitelist (users must log out and log in back again to apply changes).', 'ninjafirewall') ?></label></p>
533	<p><label><input type="radio" name="nfw_options[wl_admin]" value="0"<?php checked( $wl_admin, 0 ) ?>> <?php _e('Disable users whitelist.', 'ninjafirewall') ?></label></p>
534	<p class="description"><?php _e('Note: This feature does not apply to <code>FORCE_SSL_ADMIN</code>, <code>DISALLOW_FILE_EDIT</code>, <code>DISALLOW_FILE_MODS</code> and <code>WP_DISABLE_FATAL_ERROR_HANDLER</code> options which, if enabled, are always enforced.', 'ninjafirewall') ?></p>
535	</td>
536	</tr>
537	</table>
538
539	</div>
540
541
542	<?php
543	// ---------------------------------------------------------------------
544	// Intermediate options:
545	?>
546	<div id="intermediate-options"<?php echo $intermediate_div ?>>
547	<?php
548	if ( empty( $nfw_options['get_scan']) ) {
549	$get_scan = 0;
550	} else {
551	$get_scan = 1;
552	}
553	if ( empty( $nfw_options['get_sanitise']) ) {
554	$get_sanitise = 0;
555	} else {
556	$get_sanitise = 1;
557	}
558	?>
559	<h3><?php _e('HTTP GET variable', 'ninjafirewall') ?></h3>
560	<table class="form-table nfw-table">
561	<tr>
562	<th scope="row" class="row-med"><?php _e('Scan <code>GET</code> variable', 'ninjafirewall') ?></th>
563	<td>
564	<?php nfw_toggle_switch( 'info', 'nfw_options[get_scan]', $yes, $no, 'small', $get_scan ) ?>
565	</td>
566	</tr>
567	<tr>
568	<th scope="row" class="row-med"><?php _e('Sanitise <code>GET</code> variable', 'ninjafirewall') ?></th>
569	<td>
570	<?php nfw_toggle_switch( 'info', 'nfw_options[get_sanitise]', $yes, $no, 'small', $get_sanitise ) ?>
571	</td>
572	</tr>
573	</table>
574
575	<br /><br />
576
577	<?php
578	if ( empty( $nfw_options['post_scan']) ) {
579	$post_scan = 0;
580	} else {
581	$post_scan = 1;
582	}
583	if ( empty( $nfw_options['post_sanitise']) ) {
584	$post_sanitise = 0;
585	} else {
586	$post_sanitise = 1;
587	}
588	if ( empty( $nfw_options['post_b64']) ) {
589	$post_b64 = 0;
590	} else {
591	$post_b64 = 1;
592	}
593	?>
594	<h3><?php _e('HTTP POST variable', 'ninjafirewall') ?></h3>
595	<table class="form-table nfw-table">
596	<tr valign="top">
597	<th scope="row" class="row-med"><?php _e('Scan <code>POST</code> variable', 'ninjafirewall') ?></th>
598	<td>
599	<?php nfw_toggle_switch( 'info', 'nfw_options[post_scan]', $yes, $no, 'small', $post_scan ) ?>
600	</td>
601	</tr>
602	<tr valign="top">
603	<th scope="row" class="row-med"><?php _e('Sanitise <code>POST</code> variable', 'ninjafirewall') ?></th>
604	<td>
605	<?php nfw_toggle_switch( 'warning', 'nfw_options[post_sanitise]', $yes, $no, 'small', $post_sanitise ) ?>
606	<p class="description"> <?php _e('Do not enable this option unless you know what you are doing!', 'ninjafirewall') ?></p>
607	</td>
608	</tr>
609	<tr valign="top">
610	<th scope="row" class="row-med"><?php _e('Decode Base64-encoded <code>POST</code> variable', 'ninjafirewall') ?></th>
611	<td>
612	<?php nfw_toggle_switch( 'info', 'nfw_options[post_b64]', $yes, $no, 'small', $post_b64 ) ?>
613	</td>
614	</tr>
615	</table>
616	<br /><br />
617
618	<?php
619	if ( empty( $nfw_options['request_sanitise']) ) {
620	$request_sanitise = 0;
621	} else {
622	$request_sanitise = 1;
623	}
624	?>
625	<h3><?php _e('HTTP REQUEST variable', 'ninjafirewall') ?></h3>
626	<table class="form-table nfw-table">
627	<tr>
628	<th scope="row" class="row-med"><?php _e('Sanitise <code>REQUEST</code> variable', 'ninjafirewall') ?></th>
629	<td>
630	<?php nfw_toggle_switch( 'warning', 'nfw_options[request_sanitise]', $yes, $no, 'small', $request_sanitise ) ?>
631	<p class="description"> <?php _e('Do not enable this option unless you know what you are doing!', 'ninjafirewall') ?></p>
632	</td>
633	</tr>
634	</table>
635
636	<br /><br />
637
638	<?php
639	if ( empty( $nfw_options['cookies_scan']) ) {
640	$cookies_scan = 0;
641	} else {
642	$cookies_scan = 1;
643	}
644	if ( empty( $nfw_options['cookies_sanitise']) ) {
645	$cookies_sanitise = 0;
646	} else {
647	$cookies_sanitise = 1;
648	}
649	?>
650	<h3><?php _e('Cookies', 'ninjafirewall') ?></h3>
651	<table class="form-table nfw-table">
652	<tr>
653	<th scope="row" class="row-med"><?php _e('Scan cookies', 'ninjafirewall') ?></th>
654	<td>
655	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_scan]', $yes, $no, 'small', $cookies_scan ) ?>
656	</td>
657	</tr>
658	<tr>
659	<th scope="row" class="row-med"><?php _e('Sanitise cookies', 'ninjafirewall') ?></th>
660	<td>
661	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_sanitise]', $yes, $no, 'small', $cookies_sanitise ) ?>
662	</td>
663	</tr>
664	</table>
665
666	<br /><br />
667
668	<?php
669	if ( empty( $nfw_options['ua_scan']) ) {
670	$ua_scan = 0;
671	} else {
672	$ua_scan = 1;
673	}
674	if ( empty( $nfw_options['ua_sanitise']) ) {
675	$ua_sanitise = 0;
676	} else {
677	$ua_sanitise = 1;
678	}
679	if ( empty( $nfw_rules[NFW_SCAN_BOTS]['ena']) ) {
680	$block_bots = 0;
681	} else {
682	$block_bots = 1;
683	}
684	?>
685	<h3><?php _e('HTTP_USER_AGENT server variable', 'ninjafirewall') ?></h3>
686	<table class="form-table nfw-table">
687	<tr>
688	<th scope="row" class="row-med"><?php _e('Scan <code>HTTP_USER_AGENT</code>', 'ninjafirewall') ?></th>
689	<td>
690	<?php nfw_toggle_switch( 'info', 'nfw_options[ua_scan]', $yes, $no, 'small', $ua_scan ) ?>
691	</td>
692	</tr>
693	<tr>
694	<th scope="row" class="row-med"><?php _e('Sanitise <code>HTTP_USER_AGENT</code>', 'ninjafirewall') ?></th>
695	<td>
696	<?php nfw_toggle_switch( 'info', 'nfw_options[ua_sanitise]', $yes, $no, 'small', $ua_sanitise ) ?>
697	</td>
698	</tr>
699	<tr>
700	<th scope="row" class="row-med"><?php _e('Block suspicious bots/scanners', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, the Bot Access Control section allows you to select, edit, add and remove bots.', 'ninjafirewall' ) ?>"></span></th>
701	<td>
702	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_bots]', $yes, $no, 'small', $block_bots ) ?>
703	</td>
704	</tr>
705	</table>
706
707	<br /><br />
708
709	<?php
710	if ( empty( $nfw_options['referer_scan']) ) {
711	$referer_scan = 0;
712	} else {
713	$referer_scan = 1;
714	}
715	if ( empty( $nfw_options['referer_sanitise']) ) {
716	$referer_sanitise = 0;
717	} else {
718	$referer_sanitise = 1;
719	}
720	if ( empty( $nfw_options['referer_post']) ) {
721	$referer_post = 0;
722	} else {
723	$referer_post = 1;
724	}
725	?>
726	<h3><?php _e('HTTP_REFERER server variable', 'ninjafirewall') ?></h3>
727	<table class="form-table nfw-table">
728	<tr>
729	<th scope="row" class="row-med"><?php _e('Scan <code>HTTP_REFERER</code>', 'ninjafirewall') ?></th>
730	<td>
731	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_scan]', $yes, $no, 'small', $referer_scan ) ?>
732	</td>
733	</tr>
734	<tr>
735	<th scope="row" class="row-med"><?php _e('Sanitise <code>HTTP_REFERER</code>', 'ninjafirewall') ?></th>
736	<td>
737	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_sanitise]', $yes, $no, 'small', $referer_sanitise ) ?>
738	</td>
739	</tr>
740	<tr valign="top">
741	<th scope="row" class="row-med"><?php _e('Block <code>POST</code> requests that do not have an <code>HTTP_REFERER</code> header', 'ninjafirewall') ?></th>
742	<td>
743	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_post]', $yes, $no, 'small', $referer_post ) ?>
744	<p class="description"> <?php _e('Keep this option disabled if you are using scripts like Paypal IPN, WordPress WP-Cron etc', 'ninjafirewall') ?>.</p>
745	</td>
746	</tr>
747	</table>
748
749	<br /><br />
750
751	<?php
752	if ( empty( $nfw_rules[NFW_LOOPBACK]['ena']) ) {
753	$no_localhost_ip = 0;
754	} else {
755	$no_localhost_ip = 1;
756	}
757	if ( empty( $nfw_options['no_host_ip']) ) {
758	$no_host_ip = 0;
759	} else {
760	$no_host_ip = 1;
761	}
762	if ( empty( $nfw_options['allow_local_ip']) ) {
763	$allow_local_ip = 0;
764	} else {
765	$allow_local_ip = 1;
766	}
767	?>
768	<h3>IP <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can use the IP Access Control section to easily configure all IP address related options (source, whitelist, blacklist, rate limiting etc).', 'ninjafirewall' ) ?>"></span></h3>
769	<table class="form-table nfw-table" border=0>
770	<tr>
771	<th scope="row" class="row-med"><?php _e('Block localhost IP in <code>GET/POST</code> request', 'ninjafirewall') ?></th>
772	<td>
773	<?php nfw_toggle_switch( 'info', 'nfw_rules[no_localhost_ip]', $yes, $no, 'small', $no_localhost_ip ) ?>
774	</td>
775	</tr>
776	<tr>
777	<th scope="row" class="row-med"><?php _e('Block HTTP requests with an IP in the <code>HTTP_HOST</code> header', 'ninjafirewall') ?></th>
778	<td>
779	<?php nfw_toggle_switch( 'info', 'nfw_options[no_host_ip]', $yes, $no, 'small', $no_host_ip ) ?>
780	</td>
781	</tr>
782	<tr>
783	<th scope="row" class="row-med"><?php _e('Scan traffic coming from localhost and private IP address spaces', 'ninjafirewall') ?></th>
784	<td>
785	<?php nfw_toggle_switch( 'info', 'nfw_options[allow_local_ip]', $yes, $no, 'small', $allow_local_ip ) ?>
786	</td>
787	</tr>
788	</table>
789
790	</div>
791
792	<?php
793	// ---------------------------------------------------------------------
794	// Advanced options:
795	?>
796	<div id="advanced-options"<?php echo $advanced_div ?>>
797
798	<?php
799	if (! isset( $nfw_options['response_headers'][0]) ) { $nfw_options['response_headers'][0] = 0; }
800	if (! isset( $nfw_options['response_headers'][1]) ) { $nfw_options['response_headers'][1] = 0; }
801	if (! isset( $nfw_options['response_headers'][2]) ) { $nfw_options['response_headers'][2] = 0; }
802	if (! isset( $nfw_options['response_headers'][3]) ) { $nfw_options['response_headers'][3] = 3; }
803	if (! isset( $nfw_options['response_headers'][4]) ) { $nfw_options['response_headers'][4] = 0; }
804	if (! isset( $nfw_options['response_headers'][5]) ) { $nfw_options['response_headers'][5] = 0; }
805	if (! isset( $nfw_options['response_headers'][6]) ) { $nfw_options['response_headers'][6] = 0; }
806	if (! isset( $nfw_options['response_headers'][7]) ) { $nfw_options['response_headers'][7] = 0; }
807	if (! isset( $nfw_options['response_headers'][8]) ) { $nfw_options['response_headers'][8] = 0; }
808	if (! isset( $nfw_options['response_headers'][9]) ) { $nfw_options['response_headers'][9] = 0; }
809	$err_msg = ''; $err = 0;
810	// Some compatibility checks:
811	// 1. header_register_callback(): requires PHP >=5.4
812	// 2. headers_list() and header_remove(): some hosts may disable them.
813	$tpl = __('The "HTTP response headers" options below are disabled because the %s PHP function is not available on your server.', 'ninjafirewall');
814	if (! function_exists( 'header_register_callback' ) ) {
815	$err_msg = sprintf( $tpl, 'header_register_callback()' );
816	$err = 1;
817
818	} elseif (! function_exists( 'headers_list' ) ) {
819	$err_msg = sprintf( $tpl, 'headers_list()' );
820	$err = 1;
821
822	} elseif (! function_exists( 'header_remove' ) ) {
823	$err_msg = sprintf( $tpl, 'header_remove()' );
824	$err = 1;
825	}
826	if ( empty( $nfw_options['response_headers'] ) \|\| ! empty( $err_msg ) \|\|
827	! preg_match( '/^\d+$/', $nfw_options['response_headers'] ) ) {
828
829	$nfw_options['response_headers'] = '0000000000';
830	}
831	?>
832
833	<h3><?php _e('HTTP response headers', 'ninjafirewall') ?></h3>
834	<?php
835	if (! empty( $err_msg ) ) {
836	echo '<p class="description" style="color:red;font-size:14px">'. $err_msg .'</p>';
837	}
838	?>
839	<table class="form-table nfw-table">
840	<tr>
841	<th scope="row" class="row-med"><?php printf( __('Set %s to protect against MIME type confusion attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-Content-Type-Options</a>') ?></th>
842	<td>
843	<?php nfw_toggle_switch( 'info', 'nfw_options[x_content_type_options]', $yes, $no, 'small', $nfw_options['response_headers'][1], $err ) ?>
844	</td>
845	</tr>
846	<tr>
847	<th scope="row" class="row-med"><?php printf( __('Set %s to protect against clickjacking attempts', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-Frame-Options</a>') ?></th>
848	<td>
849	<select name="nfw_options[x_frame_options]" <?php disabled( $err, 1 ) ?>>
850	<option value="0"<?php selected( $nfw_options['response_headers'][2], 0 ) ?>><?php echo $no; ?></option>
851	<option value="1"<?php selected( $nfw_options['response_headers'][2], 1 ) ?>>SAMEORIGIN</option>
852	<option value="2"<?php selected( $nfw_options['response_headers'][2], 2 ) ?>>DENY</option>
853	</select>
854	<p class="description"><?php _e('Setting this option to <code>DENY</code> may break some functionality on your blog, its themes or plugins.', 'ninjafirewall') ?></p>
855	</td>
856	</tr>
857	<tr>
858	<th scope="row" class="row-med"><?php printf( __('Set %s', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-XSS-Protection</a>') ?></th>
859	<td>
860	<select name="nfw_options[x_xss_protection]" <?php disabled( $err, 1 ) ?>>
861	<option value="3"<?php selected( $nfw_options['response_headers'][3], 3 ) ?>><?php echo $no; ?></option>
862	<option value="0"<?php selected( $nfw_options['response_headers'][3], 0 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"0"'); ?></option>
863	<option value="2"<?php selected( $nfw_options['response_headers'][3], 2 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"1"'); ?></option>
864	<option value="1"<?php selected( $nfw_options['response_headers'][3], 1 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"1; mode=block"') ?></option>
865	</select>
866	<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span><?php esc_html_e('This header is deprecated and most browsers phased out support for it. Consider using Content-Security-Policy instead.', 'ninjafirewall') ?></p>
867	</td>
868	</tr>
869	<tr>
870	<th scope="row" class="row-med"><?php printf( __('Force %s flag on all cookies to mitigate CSRF attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">SameSite</a>' ) ?></th>
871	<td>
872	<select name="nfw_options[cookies_samesite]" <?php disabled( $err, 1 ) ?>>
873	<option value="0"<?php selected( $nfw_options['response_headers'][9], 0 ) ?>><?php echo $no; ?></option>
874	<option value="1"<?php selected( $nfw_options['response_headers'][9], 1 ) ?>>SameSite=Lax</option>
875	<option value="2"<?php selected( $nfw_options['response_headers'][9], 2 ) ?>>SameSite=Strict</option>
876	</select>
877	</td>
878	</tr>
879	<tr>
880	<th scope="row" class="row-med"><?php printf( __('Force %s flag on all cookies to mitigate XSS attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">HttpOnly</a>') ?></th>
881	<td>
882	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_httponly]', $yes, $no, 'small', $nfw_options['response_headers'][0], $err ) ?>
883	<p class="description"><?php _e('If your PHP scripts use cookies that need to be accessed from JavaScript, you should not enable this option.', 'ninjafirewall') ?></p>
884	</td>
885	</tr>
886	<?php
887	// We don't send HSTS headers over HTTP (only display this message if there
888	// is no other warning to display, $err==0 ):
889	$hsts_err = 0;
890	if ( NFW_IS_HTTPS == false && ! $err ) {
891	$hsts_err = 1;
892	$hsts_msg = __('HSTS headers can only be set when you are accessing your site over HTTPS.', 'ninjafirewall');
893	} else {
894	$hsts_msg = '';
895	$hsts_err = 0;
896	}
897	if ( $err == 1 ) { $hsts_err = 1; }
898	?>
899	<tr>
900	<th scope="row" class="row-med"><?php printf( __('Set %s (HSTS) to enforce secure connections to the server', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Strict-Transport-Security</a>') ?></th>
901	<td>
902	<select name="nfw_options[strict_transport]" <?php disabled( $hsts_err, 1 ) ?>>
903	<option value="0"<?php selected( $nfw_options['response_headers'][4], 0 ) ?>><?php echo $no; ?></option>
904	<option value="4"<?php selected( $nfw_options['response_headers'][4], 4 ) ?>><?php _e('Set "max-age" to 0', 'ninjafirewall') ?></option>
905	<option value="1"<?php selected( $nfw_options['response_headers'][4], 1 ) ?>><?php _e('1 month', 'ninjafirewall') ?></option>
906	<option value="2"<?php selected( $nfw_options['response_headers'][4], 2 ) ?>><?php _e('6 months', 'ninjafirewall') ?></option>
907	<option value="3"<?php selected( $nfw_options['response_headers'][4], 3 ) ?>><?php _e('1 year', 'ninjafirewall') ?></option>
908	<option value="5"<?php selected( $nfw_options['response_headers'][4], 5 ) ?>><?php _e('2 years', 'ninjafirewall') ?></option>
909	</select>
910	<?php
911	// includeSubDomains=1, preload=2, both=3
912	$preload = 0; $subdom = 0;
913	if ( $nfw_options['response_headers'][5] == 3 ) {
914	$preload = 1;
915	$subdom = 1;
916	} elseif ( $nfw_options['response_headers'][5] == 2 ) {
917	$preload = 1;
918	} elseif ( $nfw_options['response_headers'][5] == 1 ) {
919	$subdom = 1;
920	}
921	?>
922	<p><label><input type="checkbox" name="nfw_options[strict_transport_sub]" value="1"<?php checked( $subdom, 1 );disabled($hsts_err, 1) ?>> <?php _e('Apply to subdomains', 'ninjafirewall') ?></label>  <label><input type="checkbox" name="nfw_options[strict_transport_preload]" value="1"<?php checked( $preload, 1 );disabled($hsts_err, 1) ?>> <?php _e('Preload', 'ninjafirewall') ?></label></p>
923	<?php
924	if (! empty( $hsts_msg ) ) {
925	echo '<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span>'. $hsts_msg .'</p>';
926	}
927	?>
928	</td>
929	</tr>
930
931	<?php
932	if (! isset( $nfw_options['csp_frontend_data'] ) ) {
933	$nfw_options['csp_frontend_data'] = '';
934	}
935	if (! isset( $nfw_options['csp_backend_data'] ) ) {
936	$nfw_options['csp_backend_data'] = '';
937	}
938	if (! isset( $nfw_options['response_headers'][6] ) ) {
939	$nfw_options['response_headers'][6] = 0;
940	}
941	if (! isset( $nfw_options['response_headers'][7] ) ) {
942	$nfw_options['response_headers'][7] = 0;
943	}
944	?>
945	<tr>
946	<th scope="row" class="row-med"><?php printf( __('Set %s for the website frontend', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Content-Security-Policy</a>') ?></th>
947	<td>
948	<?php nfw_toggle_switch( 'info', 'nfw_options[csp_frontend]', $yes, $no, 'small', $nfw_options['response_headers'][6], $err, 'onclick="nfwjs_csp_onoff(\'csp1_switch\',\'csp1\');"', 'csp1_switch' ) ?>
949	<br />
950	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[csp_frontend_data]" id="csp1" class="large-text code" rows="8"<?php wp_readonly( $err, 1 ); wp_readonly( $nfw_options['response_headers'][6], 0 ) ?>><?php echo htmlspecialchars( $nfw_options['csp_frontend_data'] ) ?></textarea>
951	<p class="description"><?php _e('This CSP header will apply to the website frontend only.', 'ninjafirewall') ?></p>
952	</td>
953	</tr>
954	<tr>
955	<th scope="row" class="row-med"><?php printf( __('Set %s for the WordPress admin dashboard', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Content-Security-Policy</a>') ?></th>
956	<td>
957	<?php nfw_toggle_switch( 'info', 'nfw_options[csp_backend]', $yes, $no, 'small', $nfw_options['response_headers'][7], $err, 'onclick="nfwjs_csp_onoff(\'csp2_switch\',\'csp2\');"', 'csp2_switch' ) ?>
958	<br />
959	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[csp_backend_data]" id="csp2" class="large-text code" rows="8"<?php wp_readonly( $err, 1 ); wp_readonly( $nfw_options['response_headers'][7], 0 ) ?>><?php echo htmlspecialchars( $nfw_options['csp_backend_data'] ) ?></textarea>
960	<p class="description"><?php _e('This CSP header will apply to the WordPress admin dashboard only.', 'ninjafirewall') ?></p>
961	<?php echo $err_msg ?>
962	</td>
963	</tr>
964
965	<?php
966	if (! isset( $nfw_options['response_headers'][8] ) ) {
967	$nfw_options['response_headers'][8] = 0;
968	}
969	if ( empty( $nfw_options['referrer_policy_enabled'] ) ) {
970	$nfw_options['referrer_policy_enabled'] = 0;
971	} else {
972	$nfw_options['referrer_policy_enabled'] = 1;
973	}
974	?>
975	<tr>
976	<th scope="row"><?php printf( __("Set %s (Chrome, Opera and Firefox browsers)", 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Referrer-Policy</a>') ?></th>
977	<td>
978	<?php nfw_toggle_switch( 'info', 'nfw_options[referrer_policy_enabled]', $yes, $no, 'small', $nfw_options['referrer_policy_enabled'], $err, 'onclick="nfwjs_referrer_onoff();"', 'referrer_switch' ) ?>
979	<br />
980	<select id="rp_select" name="nfw_options[referrer_policy]"<?php disabled($nfw_options['referrer_policy_enabled'], 0) ?>>
981	<option value="1"<?php selected($nfw_options['response_headers'][8], 1) ?>>no-referrer</option>
982	<option value="2"<?php selected($nfw_options['response_headers'][8], 2) ?>>no-referrer-when-downgrade</option>
983	<option value="3"<?php selected($nfw_options['response_headers'][8], 3) ?>>origin</option>
984	<option value="4"<?php selected($nfw_options['response_headers'][8], 4) ?>>origin-when-cross-origin</option>
985	<option value="5"<?php selected($nfw_options['response_headers'][8], 5) ?>>strict-origin</option>
986	<option value="6"<?php selected($nfw_options['response_headers'][8], 6) ?>>strict-origin-when-cross-origin</option>
987	<option value="7"<?php selected($nfw_options['response_headers'][8], 7) ?>>same-origin</option>
988	<option value="8"<?php selected($nfw_options['response_headers'][8], 8) ?>>unsafe-url</option>
989	</select>
990	</td>
991	</tr>
992
993	<?php
994	$custom_headers = '';
995	if (! empty( $nfw_options['custom_headers'] ) ) {
996	$headers = json_decode( $nfw_options['custom_headers'], true );
997	if (! empty( $headers ) ) {
998	foreach( $headers as $key => $value ) {
999	$custom_headers .= "$key: $value\n";
1000	}
1001	}
1002	}
1003	?>
1004	<tr>
1005	<th scope="row" class="row-med"><?php esc_html_e('Custom HTTP headers', 'ninjafirewall'); ?></th>
1006	<td>
1007	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[custom_headers]" class="large-text code" rows="8"><?php echo esc_textarea( $custom_headers ) ?></textarea>
1008	<p class="description"><?php _e('You can enter one or more custom HTTP headers. The format is <code>header: value</code>, one per line.', 'ninjafirewall') ?></p>
1009	</td>
1010	</tr>
1011
1012	<tr>
1013	<th scope="row" class="row-med"><?php esc_html_e('HTTP headers test', 'ninjafirewall'); ?></th>
1014	<td>
1015	<button type="button" class="button-secondary" onClick="nfwjs_test_headers('<?php echo esc_attr( home_url( '/' ) ) ?>');" /><?php esc_html_e('View your website\'s HTTP response headers', 'ninjafirewall' )?></button>
1016
1017	<img style="vertical-align:middle;display:none" id="progress-gif" src="<?php echo plugins_url('/images/progress.gif', dirname (__FILE__ ) ) ?>" />
1018	<p class="description"><?php _e('Make sure to save your changes before running the test.', 'ninjafirewall') ?></p>
1019	</td>
1020	</tr>
1021	</table>
1022
1023	<br /><br />
1024
1025	<?php
1026	if ( empty( $nfw_rules[NFW_WRAPPERS]['ena']) ) {
1027	$php_wrappers = 0;
1028	} else {
1029	$php_wrappers = 1;
1030	}
1031	if ( empty( $nfw_options['php_errors']) ) {
1032	$php_errors = 0;
1033	} else {
1034	$php_errors = 1;
1035	}
1036	if ( empty( $nfw_options['php_self']) ) {
1037	$php_self = 0;
1038	} else {
1039	$php_self = 1;
1040	}
1041	if ( empty( $nfw_options['php_path_t']) ) {
1042	$php_path_t = 0;
1043	} else {
1044	$php_path_t = 1;
1045	}
1046	if ( empty( $nfw_options['php_path_i']) ) {
1047	$php_path_i = 0;
1048	} else {
1049	$php_path_i = 1;
1050	}
1051	if ( empty( $nfw_options['php_superglobals']) ) {
1052	$php_superglobals = 0;
1053	} else {
1054	$php_superglobals = 1;
1055	}
1056	?>
1057	<h3>PHP</h3>
1058	<table class="form-table nfw-table">
1059	<tr>
1060	<th scope="row" class="row-med"><?php _e('Block PHP built-in wrappers in <code>GET</code>, <code>POST</code>, <code>HTTP_USER_AGENT</code>, <code>HTTP_REFERER</code> and cookies', 'ninjafirewall') ?></th>
1061	<td>
1062	<?php nfw_toggle_switch( 'info', 'nfw_rules[php_wrappers]', $yes, $no, 'small', $php_wrappers ) ?>
1063	</td>
1064	</tr>
1065
1066	<?php
1067	if (! empty( $nfw_rules[NFW_OBJECTS]['ena'] ) ) {
1068	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'GET' ) !== FALSE) {
1069	$NFW_OBJECTS_GET = ' checked="checked"';
1070	} else {
1071	$NFW_OBJECTS_GET = '';
1072	}
1073	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'POST' ) !== FALSE) {
1074	$NFW_OBJECTS_POST = ' checked="checked"';
1075	} else {
1076	$NFW_OBJECTS_POST = '';
1077	}
1078	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'COOKIE' ) !== FALSE) {
1079	$NFW_OBJECTS_COOKIE = ' checked="checked"';
1080	} else {
1081	$NFW_OBJECTS_COOKIE = '';
1082	}
1083	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'HTTP_USER_AGENT' ) !== FALSE) {
1084	$NFW_OBJECTS_HTTP_USER_AGENT = ' checked="checked"';
1085	} else {
1086	$NFW_OBJECTS_HTTP_USER_AGENT = '';
1087	}
1088	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'HTTP_REFERER' ) !== FALSE) {
1089	$NFW_OBJECTS_HTTP_REFERER = ' checked="checked"';
1090	} else {
1091	$NFW_OBJECTS_HTTP_REFERER = '';
1092	}
1093	} else {
1094	$NFW_OBJECTS_GET = ''; $NFW_OBJECTS_POST = ''; $NFW_OBJECTS_COOKIE = '';
1095	$NFW_OBJECTS_HTTP_USER_AGENT = ''; $NFW_OBJECTS_HTTP_REFERER = '';
1096	}
1097	?>
1098	<tr>
1099	<th scope="row" class="row-mid"><?php _e('Block serialized PHP objects in the following global variables', 'ninjafirewall') ?></th>
1100	<td>
1101	<p><label><input type="checkbox" name="nfw_rules[php_objects_get]" value="1"<?php echo $NFW_OBJECTS_GET ?>><code>GET</code></label><p>
1102	<p><label><input type="checkbox" name="nfw_rules[php_objects_post]" value="1"<?php echo $NFW_OBJECTS_POST ?>><code>POST</code></label><p>
1103	<p><label><input type="checkbox" name="nfw_rules[php_objects_cookie]" value="1"<?php echo $NFW_OBJECTS_COOKIE ?>><code>COOKIE</code></label><p>
1104	<p><label><input type="checkbox" name="nfw_rules[php_objects_http_user_agent]" value="1"<?php echo $NFW_OBJECTS_HTTP_USER_AGENT ?>><code>HTTP_USER_AGENT</code></label><p>
1105	<p><label><input type="checkbox" name="nfw_rules[php_objects_http_referer]" value="1"<?php echo $NFW_OBJECTS_HTTP_REFERER ?>><code>HTTP_REFERER</code></label><p>
1106	</td>
1107	</tr>
1108	<tr>
1109	<th scope="row" class="row-mid"><?php _e('Block attempts to override PHP Superglobals', 'ninjafirewall') ?></th>
1110	<td>
1111	<?php nfw_toggle_switch( 'info', 'nfw_options[php_superglobals]', $yes, $no, 'small', $php_superglobals ) ?>
1112	</td>
1113	</tr>
1114	<tr>
1115	<th scope="row" class="row-mid"><?php _e('Hide PHP notice and error messages', 'ninjafirewall') ?></th>
1116	<td>
1117	<?php nfw_toggle_switch( 'info', 'nfw_options[php_errors]', $yes, $no, 'small', $php_errors ) ?>
1118	</td>
1119	</tr>
1120	<tr>
1121	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PHP_SELF</code>', 'ninjafirewall') ?></th>
1122	<td>
1123	<?php nfw_toggle_switch( 'info', 'nfw_options[php_self]', $yes, $no, 'small', $php_self ) ?>
1124	</td>
1125	</tr>
1126	<tr>
1127	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PATH_TRANSLATED</code>', 'ninjafirewall') ?></th>
1128	<td>
1129	<?php nfw_toggle_switch( 'info', 'nfw_options[php_path_t]', $yes, $no, 'small', $php_path_t ) ?>
1130	</td>
1131	</tr>
1132	<tr>
1133	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PATH_INFO</code>', 'ninjafirewall') ?></th>
1134	<td>
1135	<?php nfw_toggle_switch( 'info', 'nfw_options[php_path_i]', $yes, $no, 'small', $php_path_i ) ?>
1136	</td>
1137	</tr>
1138	</table>
1139
1140	<br /><br />
1141
1142	<?php
1143	// If the document root is < 5 characters, disable the option
1144	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) < 5 ) {
1145	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1146	$disabled_msg = '<p class="description">' .
1147	__('This option is not compatible with your actual configuration.', 'ninjafirewall') .
1148	'</p>';
1149	} else {
1150	$disabled_msg = '';
1151	}
1152
1153	if ( empty( $nfw_rules[NFW_DOC_ROOT]['ena']) ) {
1154	$block_doc_root = 0;
1155	} else {
1156	$block_doc_root = 1;
1157	}
1158	if ( empty( $nfw_rules[NFW_NULL_BYTE]['ena']) ) {
1159	$block_null_byte = 0;
1160	} else {
1161	$block_null_byte = 1;
1162	}
1163	if ( empty( $nfw_rules[NFW_ASCII_CTRL]['ena']) ) {
1164	$block_ctrl_chars = 0;
1165	} else {
1166	$block_ctrl_chars = 1;
1167	}
1168	?>
1169	<h3><?php _e('Various', 'ninjafirewall') ?></h3>
1170	<table class="form-table nfw-table">
1171	<tr>
1172	<th scope="row" class="row-med"><?php _e('Block the <code>DOCUMENT_ROOT</code> server variable in HTTP request', 'ninjafirewall') ?></th>
1173	<td>
1174	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_doc_root]', $yes, $no, 'small', $block_doc_root ) ?>
1175	<?php echo $disabled_msg ?>
1176	</td>
1177	</tr>
1178	<tr>
1179	<th scope="row" class="row-med"><?php _e('Block ASCII character 0x00 (NULL byte)', 'ninjafirewall') ?></th>
1180	<td>
1181	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_null_byte]', $yes, $no, 'small', $block_null_byte ) ?>
1182	</td>
1183	</tr>
1184	<tr>
1185	<th scope="row" class="row-med"><?php _e('Block ASCII control characters 1 to 8 and 14 to 31', 'ninjafirewall') ?></th>
1186	<td>
1187	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_ctrl_chars]', $yes, $no, 'small', $block_ctrl_chars ) ?>
1188	</td>
1189	</tr>
1190	</table>
1191
1192	</div>
1193
1194	<br />
1195	<br />
1196
1197	<input type="hidden" name="tab" id="tab-selected" value="<?php echo htmlspecialchars( $_REQUEST['tab'] ) ?>" />
1198	<input class="button-primary" type="submit" name="Save" value="<?php _e('Save Firewall Policies', 'ninjafirewall') ?>" />
1199
1200	<input class="button-secondary" type="submit" name="Default" value="<?php _e('Restore Default Values', 'ninjafirewall') ?>" onclick="return nfwjs_restore_default();" />
1201	</form>
1202	</div>
1203
1204	<?php
1205
1206	// ---------------------------------------------------------------------
1207	// Save firewall policies.
1208
1209	function nf_sub_policies_save() {
1210
1211	nf_not_allowed( 'block', __LINE__ );
1212
1213	$nfw_options = nfw_get_option( 'nfw_options' );
1214	$nfw_rules = nfw_get_option( 'nfw_rules' );
1215
1216	if ( (isset( $_POST['nfw_options']['scan_protocol'])) &&
1217	( preg_match( '/^[123]$/', $_POST['nfw_options']['scan_protocol'])) ) {
1218	$nfw_options['scan_protocol'] = $_POST['nfw_options']['scan_protocol'];
1219	} else {
1220	$nfw_options['scan_protocol'] = 3;
1221	}
1222
1223	if ( empty( $_POST['nfw_options']['uploads']) ) {
1224	$nfw_options['uploads'] = 0;
1225	} else {
1226	$nfw_options['uploads'] = 1;
1227	}
1228
1229	if ( (isset( $_POST['nfw_options']['sanitise_fn']) ) && ( $nfw_options['uploads'] == 1) ) {
1230	$nfw_options['sanitise_fn'] = 1;
1231	} else {
1232	$nfw_options['sanitise_fn'] = 0;
1233	}
1234	// Substitution character:
1235	// Don't allow the '/' character:
1236	if ( empty( $_POST['nfw_options']['substitute'] ) \|\| strlen( $_POST['nfw_options']['substitute'] ) > 1 \|\| $_POST['nfw_options']['substitute'] == '/' ) {
1237	$nfw_options['substitute'] = 'X';
1238	} else {
1239	$nfw_options['substitute'] = $_POST['nfw_options']['substitute'];
1240	}
1241
1242
1243	if ( empty( $_POST['nfw_options']['get_scan']) ) {
1244	$nfw_options['get_scan'] = 0;
1245	} else {
1246	$nfw_options['get_scan'] = 1;
1247	}
1248	if ( empty( $_POST['nfw_options']['get_sanitise']) ) {
1249	$nfw_options['get_sanitise'] = 0;
1250	} else {
1251	$nfw_options['get_sanitise'] = 1;
1252	}
1253
1254
1255	if ( empty( $_POST['nfw_options']['post_scan']) ) {
1256	$nfw_options['post_scan'] = 0;
1257	} else {
1258	$nfw_options['post_scan'] = 1;
1259	}
1260	if ( empty( $_POST['nfw_options']['post_sanitise']) ) {
1261	$nfw_options['post_sanitise'] = 0;
1262	} else {
1263	$nfw_options['post_sanitise'] = 1;
1264	}
1265	if ( empty( $_POST['nfw_options']['post_b64']) ) {
1266	$nfw_options['post_b64'] = 0;
1267	} else {
1268	$nfw_options['post_b64'] = 1;
1269	}
1270
1271
1272	if ( empty( $_POST['nfw_options']['request_sanitise']) ) {
1273	$nfw_options['request_sanitise'] = 0;
1274	} else {
1275	$nfw_options['request_sanitise'] = 1;
1276	}
1277
1278
1279	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
1280	$nfw_options['response_headers'] = '0000000000';
1281	$nfw_options['csp_frontend_data'] = '';
1282	$nfw_options['csp_backend_data'] = '';
1283	if ( empty( $_POST['nfw_options']['x_content_type_options']) ) {
1284	$nfw_options['response_headers'][1] = 0;
1285	} else {
1286	$nfw_options['response_headers'][1] = 1;
1287	}
1288	if ( empty( $_POST['nfw_options']['x_frame_options']) ) {
1289	$nfw_options['response_headers'][2] = 0;
1290	} elseif ( $_POST['nfw_options']['x_frame_options'] == 1) {
1291	$nfw_options['response_headers'][2] = 1;
1292	} else {
1293	$nfw_options['response_headers'][2] = 2;
1294	}
1295	// XSS filter:
1296	// 0 = 0
1297	// 1 = 1; mode=block
1298	// 2 = 1
1299	// 3 = unset
1300	if ( empty( $_POST['nfw_options']['x_xss_protection'] ) ) {
1301	$nfw_options['response_headers'][3] = 0;
1302	} elseif ( $_POST['nfw_options']['x_xss_protection'] == 1 ) {
1303	$nfw_options['response_headers'][3] = 1;
1304	} elseif ( $_POST['nfw_options']['x_xss_protection'] == 2 ) {
1305	$nfw_options['response_headers'][3] = 2;
1306	} else {
1307	$nfw_options['response_headers'][3] = 3;
1308	}
1309
1310	if ( empty( $_POST['nfw_options']['cookies_httponly']) ) {
1311	$nfw_options['response_headers'][0] = 0;
1312	} else {
1313	$nfw_options['response_headers'][0] = 1;
1314	}
1315	// SameSite cookie
1316	if ( empty( $_POST['nfw_options']['cookies_samesite'] ) ) {
1317	$nfw_options['response_headers'][9] = 0;
1318	} elseif ( $_POST['nfw_options']['cookies_samesite'] == 1 ) {
1319	$nfw_options['response_headers'][9] = 1;
1320	} elseif ( $_POST['nfw_options']['cookies_samesite'] == 2 ) {
1321	$nfw_options['response_headers'][9] = 2;
1322	}
1323
1324	// Strict-Transport-Security
1325
1326	// includeSubDomains=1, preload=2, both=3
1327	$rs5 = 0;
1328	if ( isset( $_POST['nfw_options']['strict_transport_sub'] ) ) {
1329	$rs5 = 1;
1330	}
1331	if ( isset( $_POST['nfw_options']['strict_transport_preload'] ) ) {
1332	$rs5 += 2;
1333	}
1334	$nfw_options['response_headers'][5] = $rs5;
1335
1336	if ( empty( $_POST['nfw_options']['strict_transport'] ) ) {
1337	$nfw_options['response_headers'][4] = 0;
1338	$nfw_options['response_headers'][5] = 0;
1339	} elseif ( $_POST['nfw_options']['strict_transport'] == 1) {
1340	$nfw_options['response_headers'][4] = 1;
1341	} elseif ( $_POST['nfw_options']['strict_transport'] == 2) {
1342	$nfw_options['response_headers'][4] = 2;
1343	} elseif ( $_POST['nfw_options']['strict_transport'] == 3) {
1344	$nfw_options['response_headers'][4] = 3;
1345	} elseif ( $_POST['nfw_options']['strict_transport'] == 4) {
1346	$nfw_options['response_headers'][4] = 4;
1347	} else {
1348	$nfw_options['response_headers'][4] = 5;
1349	}
1350
1351
1352	$nfw_options['csp_frontend_data'] = stripslashes( str_replace( array( '<', '>', "\x0a", "\x0d", '%', '$', '&') , '', $_POST['nfw_options']['csp_frontend_data'] ) );
1353	if ( empty( $_POST['nfw_options']['csp_frontend']) \|\| empty( $nfw_options['csp_frontend_data'] ) ) {
1354	$nfw_options['response_headers'][6] = 0;
1355	} else {
1356	$nfw_options['response_headers'][6] = 1;
1357	}
1358	$nfw_options['csp_backend_data'] = stripslashes( str_replace( array( '<', '>', "\x0a", "\x0d", '%', '$', '&') , '', $_POST['nfw_options']['csp_backend_data'] ) );
1359	if ( empty( $_POST['nfw_options']['csp_backend']) \|\| empty( $nfw_options['csp_backend_data'] ) ) {
1360	$nfw_options['response_headers'][7] = 0;
1361	} else {
1362	$nfw_options['response_headers'][7] = 1;
1363	}
1364	if ( empty( $_POST['nfw_options']['referrer_policy_enabled'] ) ) {
1365	$nfw_options['referrer_policy_enabled'] = 0;
1366	$_POST['nfw_options']['referrer_policy'] = 0;
1367	} else {
1368	$nfw_options['referrer_policy_enabled'] = 1;
1369	}
1370
1371	if ( empty( $_POST['nfw_options']['referrer_policy'] ) \|\| ! preg_match('/^[1-8]$/', $_POST['nfw_options']['referrer_policy'] ) ) {
1372	$nfw_options['response_headers'][8] = 0;
1373	$nfw_options['referrer_policy_enabled'] = 0;
1374	} else {
1375	$nfw_options['response_headers'][8] = (int)$_POST['nfw_options']['referrer_policy'];
1376	}
1377	}
1378
1379	/**
1380	* Custom HTTP headers.
1381	*/
1382	$custom_headers = [];
1383	if (! empty( $_POST['nfw_options']['custom_headers'] ) ) {
1384	$headers = explode( "\r\n", stripslashes( $_POST['nfw_options']['custom_headers'] ) );
1385	if (! empty( $headers[0] ) ) {
1386	foreach( $headers as $header ) {
1387	if ( empty( $header ) \|\| strpos( $header, ':') === false ) {
1388	continue;
1389	}
1390	list( $key, $value ) = explode(':', $header, 2 );
1391	/**
1392	* Lowercase key name.
1393	*/
1394	$key = strtolower( trim( $key ) );
1395	$value = trim( $value );
1396	if (! empty( $key ) && ! empty( $value ) ) {
1397	$custom_headers[ $key ] = $value;
1398	}
1399	}
1400	}
1401	}
1402	if (! empty( $custom_headers ) ) {
1403	$nfw_options['custom_headers'] = json_encode( $custom_headers );
1404	} else {
1405	unset ( $nfw_options['custom_headers'] );
1406	}
1407
1408	if ( empty( $_POST['nfw_options']['cookies_scan']) ) {
1409	$nfw_options['cookies_scan'] = 0;
1410	} else {
1411	$nfw_options['cookies_scan'] = 1;
1412	}
1413	if ( empty( $_POST['nfw_options']['cookies_sanitise']) ) {
1414	$nfw_options['cookies_sanitise'] = 0;
1415	} else {
1416	$nfw_options['cookies_sanitise'] = 1;
1417	}
1418
1419
1420	if ( empty( $_POST['nfw_options']['ua_scan']) ) {
1421	$nfw_options['ua_scan'] = 0;
1422	} else {
1423	$nfw_options['ua_scan'] = 1;
1424	}
1425	if ( empty( $_POST['nfw_options']['ua_sanitise']) ) {
1426	$nfw_options['ua_sanitise'] = 0;
1427	} else {
1428	$nfw_options['ua_sanitise'] = 1;
1429	}
1430
1431
1432	if ( empty( $_POST['nfw_options']['referer_scan']) ) {
1433	$nfw_options['referer_scan'] = 0;
1434	} else {
1435	$nfw_options['referer_scan'] = 1;
1436	}
1437	if ( empty( $_POST['nfw_options']['referer_sanitise']) ) {
1438	$nfw_options['referer_sanitise'] = 0;
1439	} else {
1440	$nfw_options['referer_sanitise'] = 1;
1441	}
1442	if ( empty( $_POST['nfw_options']['referer_post']) ) {
1443	$nfw_options['referer_post'] = 0;
1444	} else {
1445	$nfw_options['referer_post'] = 1;
1446	}
1447
1448
1449	if ( empty( $_POST['nfw_options']['no_host_ip']) ) {
1450	$nfw_options['no_host_ip'] = 0;
1451	} else {
1452	$nfw_options['no_host_ip'] = 1;
1453	}
1454	if ( empty( $_POST['nfw_options']['allow_local_ip']) ) {
1455	$nfw_options['allow_local_ip'] = 0;
1456	} else {
1457	$nfw_options['allow_local_ip'] = 1;
1458	}
1459
1460
1461	if ( empty( $_POST['nfw_options']['php_errors']) ) {
1462	$nfw_options['php_errors'] = 0;
1463	} else {
1464	$nfw_options['php_errors'] = 1;
1465	}
1466
1467	if ( empty( $_POST['nfw_options']['php_self']) ) {
1468	$nfw_options['php_self'] = 0;
1469	} else {
1470	$nfw_options['php_self'] = 1;
1471	}
1472	if ( empty( $_POST['nfw_options']['php_path_t']) ) {
1473	$nfw_options['php_path_t'] = 0;
1474	} else {
1475	$nfw_options['php_path_t'] = 1;
1476	}
1477	if ( empty( $_POST['nfw_options']['php_path_i']) ) {
1478	$nfw_options['php_path_i'] = 0;
1479	} else {
1480	$nfw_options['php_path_i'] = 1;
1481	}
1482	// Superglobals override
1483	if ( empty( $_POST['nfw_options']['php_superglobals']) ) {
1484	$nfw_options['php_superglobals'] = 0;
1485	} else {
1486	$nfw_options['php_superglobals'] = 1;
1487	}
1488
1489	// We change those policies only if we're in Full WAF mode
1490	if (! defined( 'NFW_WPWAF' ) ) {
1491	$nfw_options['wp_dir'] = ''; $tmp = '';
1492	if ( isset( $_POST['nfw_options']['wp_admin']) ) {
1493	$tmp .= '/wp-admin/(?:css\|images\|includes\|js)/\|';
1494	}
1495	if ( isset( $_POST['nfw_options']['wp_inc']) ) {
1496	$tmp .= '/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|';
1497	}
1498	if ( isset( $_POST['nfw_options']['wp_upl']) ) {
1499	$tmp .= '/' . basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/\|';
1500	}
1501	if ( isset( $_POST['nfw_options']['wp_cache']) ) {
1502	$tmp .= '/cache/\|';
1503	}
1504	if ( $tmp ) {
1505	$nfw_options['wp_dir'] = rtrim( $tmp, '\|' );
1506	}
1507	}
1508
1509	if (! isset( $_POST['nfw_options']['disallow_creation']) ) {
1510	$nfw_options['disallow_creation'] = 0;
1511	} else {
1512	$nfw_options['disallow_creation'] = 1;
1513	}
1514	if (! isset( $_POST['nfw_options']['disallow_deletion']) ) {
1515	$nfw_options['disallow_deletion'] = 0;
1516	} else {
1517	$nfw_options['disallow_deletion'] = 1;
1518	}
1519	if (! isset( $_POST['nfw_options']['disallow_settings']) ) {
1520	$nfw_options['disallow_settings'] = 0;
1521	} else {
1522	$nfw_options['disallow_settings'] = 1;
1523	}
1524	if (! isset( $_POST['nfw_options']['disallow_privesc']) ) {
1525	$nfw_options['disallow_privesc'] = 0;
1526	} else {
1527	$nfw_options['disallow_privesc'] = 1;
1528	}
1529	if (! isset( $_POST['nfw_options']['disallow_privesc_mu']) ) {
1530	$nfw_options['disallow_privesc_mu'] = 0;
1531	} else {
1532	$nfw_options['disallow_privesc_mu'] = 1;
1533	}
1534	if (! isset( $_POST['nfw_options']['disallow_publish']) ) {
1535	$nfw_options['disallow_publish'] = 0;
1536	} else {
1537	$nfw_options['disallow_publish'] = 1;
1538	}
1539
1540	if (! isset( $_POST['nfw_options']['enum_archives']) ) {
1541	$nfw_options['enum_archives'] = 0;
1542	} else {
1543	$nfw_options['enum_archives'] = 1;
1544	}
1545	if (! isset( $_POST['nfw_options']['enum_sitemap']) ) {
1546	$nfw_options['enum_sitemap'] = 0;
1547	} else {
1548	$nfw_options['enum_sitemap'] = 1;
1549	}
1550	if (! isset( $_POST['nfw_options']['enum_login']) ) {
1551	$nfw_options['enum_login'] = 0;
1552	} else {
1553	$nfw_options['enum_login'] = 1;
1554	}
1555	if (! isset( $_POST['nfw_options']['admin_ajax']) ) {
1556	$nfw_options['admin_ajax'] = 0;
1557	} else {
1558	$nfw_options['admin_ajax'] = 1;
1559	}
1560	if (! isset( $_POST['nfw_options']['enum_restapi']) ) {
1561	$nfw_options['enum_restapi'] = 0;
1562	} else {
1563	$nfw_options['enum_restapi'] = 1;
1564	}
1565	if (! isset( $_POST['nfw_options']['enum_feed']) ) {
1566	$nfw_options['enum_feed'] = 0;
1567	} else {
1568	$nfw_options['enum_feed'] = 1;
1569	}
1570	if (! isset( $_POST['nfw_options']['no_restapi']) ) {
1571	$nfw_options['no_restapi'] = 0;
1572	} else {
1573	$nfw_options['no_restapi'] = 1;
1574	}
1575	if (! isset( $_POST['nfw_options']['restapi_loggedin']) \|\| $nfw_options['no_restapi'] == 0 ) {
1576	$nfw_options['restapi_loggedin'] = 0;
1577	} else {
1578	$nfw_options['restapi_loggedin'] = 1;
1579	}
1580	if (! isset( $_POST['nfw_options']['no_appswd']) ) {
1581	$nfw_options['no_appswd'] = 0;
1582	} else {
1583	$nfw_options['no_appswd'] = 1;
1584	}
1585
1586	if ( empty( $_POST['nfw_options']['no_xmlrpc']) ) {
1587	$nfw_options['no_xmlrpc'] = 0;
1588	} else {
1589	$nfw_options['no_xmlrpc'] = 1;
1590	$_POST['nfw_options']['no_xmlrpc_multi'] = 0;
1591	$_POST['nfw_options']['no_xmlrpc_pingback'] = 0;
1592	}
1593	if ( empty( $_POST['nfw_options']['no_xmlrpc_multi']) ) {
1594	$nfw_options['no_xmlrpc_multi'] = 0;
1595	} else {
1596	$nfw_options['no_xmlrpc_multi'] = 1;
1597	}
1598	if ( empty( $_POST['nfw_options']['no_xmlrpc_pingback']) ) {
1599	$nfw_options['no_xmlrpc_pingback'] = 0;
1600	} else {
1601	$nfw_options['no_xmlrpc_pingback'] = 1;
1602	}
1603
1604	if ( empty( $_POST['nfw_options']['no_post_themes']) ) {
1605	$nfw_options['no_post_themes'] = 0;
1606	} else {
1607	$nfw_options['no_post_themes'] = '/'. basename(WP_CONTENT_DIR) .'/themes/';
1608	}
1609
1610	if ( empty( $_POST['nfw_options']['force_ssl']) ) {
1611	$nfw_options['force_ssl'] = 0;
1612	} else {
1613	$nfw_options['force_ssl'] = 1;
1614	}
1615
1616	if ( empty( $_POST['nfw_options']['disallow_edit']) ) {
1617	$nfw_options['disallow_edit'] = 0;
1618	} else {
1619	$nfw_options['disallow_edit'] = 1;
1620	}
1621
1622	if ( empty( $_POST['nfw_options']['disable_error_handler']) ) {
1623	$nfw_options['disable_error_handler'] = 0;
1624	} else {
1625	$nfw_options['disable_error_handler'] = 1;
1626	}
1627
1628	if ( empty( $_POST['nfw_options']['disallow_mods']) ) {
1629	$nfw_options['disallow_mods'] = 0;
1630	} else {
1631	$nfw_options['disallow_mods'] = 1;
1632	}
1633
1634
1635	if ( empty( $_POST['nfw_options']['wl_admin']) ) {
1636	$nfw_options['wl_admin'] = 0;
1637	if ( isset( $_SESSION['nfw_goodguy']) ) {
1638	unset( $_SESSION['nfw_goodguy']);
1639	}
1640	} else {
1641	if ( $_POST['nfw_options']['wl_admin'] == 2 ) {
1642	$nfw_options['wl_admin'] = 2;
1643	} else {
1644	$nfw_options['wl_admin'] = 1;
1645	}
1646	$_SESSION['nfw_goodguy'] = $nfw_options['wl_admin'];
1647	}
1648
1649
1650	if ( empty( $_POST['nfw_rules']['block_null_byte']) ) {
1651	$nfw_rules[NFW_NULL_BYTE]['ena'] = 0;
1652	} else {
1653	$nfw_rules[NFW_NULL_BYTE]['ena'] = 1;
1654	}
1655	if ( empty( $_POST['nfw_rules']['block_bots']) ) {
1656	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 0;
1657	} else {
1658	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 1;
1659	}
1660	if ( empty( $_POST['nfw_rules']['block_ctrl_chars']) ) {
1661	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 0;
1662	} else {
1663	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 1;
1664	}
1665
1666
1667	if ( empty( $_POST['nfw_rules']['block_doc_root']) ) {
1668	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1669	} else {
1670
1671	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
1672	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
1673	$nfw_rules[NFW_DOC_ROOT]['ena'] = 1;
1674	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
1675	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
1676	$nfw_rules[NFW_DOC_ROOT]['ena'] = 1;
1677	} else {
1678	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1679	}
1680	}
1681
1682
1683	if ( empty( $_POST['nfw_rules']['php_wrappers']) ) {
1684	$nfw_rules[NFW_WRAPPERS]['ena'] = 0;
1685	} else {
1686	$nfw_rules[NFW_WRAPPERS]['ena'] = 1;
1687	}
1688
1689
1690	$nfw_objects = '';
1691	if (! empty( $_POST['nfw_rules']['php_objects_get'] ) ) {
1692	$nfw_objects .= "GET\|";
1693	}
1694	if (! empty( $_POST['nfw_rules']['php_objects_post'] ) ) {
1695	$nfw_objects .= "POST\|";
1696	}
1697	if (! empty( $_POST['nfw_rules']['php_objects_cookie'] ) ) {
1698	$nfw_objects .= "COOKIE\|";
1699	}
1700	if (! empty( $_POST['nfw_rules']['php_objects_http_user_agent'] ) ) {
1701	$nfw_objects .= "SERVER:HTTP_USER_AGENT\|";
1702	}
1703	if (! empty( $_POST['nfw_rules']['php_objects_http_referer'] ) ) {
1704	$nfw_objects .= "SERVER:HTTP_REFERER\|";
1705	}
1706	if (! empty( $nfw_objects ) ) {
1707	$nfw_objects = rtrim( $nfw_objects, '\|' );
1708	$nfw_rules[NFW_OBJECTS]['ena'] = 1;
1709	} else {
1710	// Disable rule:
1711	$nfw_rules[NFW_OBJECTS]['ena'] = 0;
1712	}
1713	$nfw_rules[NFW_OBJECTS]['cha'][1]['whe'] = $nfw_objects;
1714
1715
1716	if ( empty( $_POST['nfw_rules']['no_localhost_ip']) ) {
1717	$nfw_rules[NFW_LOOPBACK]['ena'] = 0;
1718	} else {
1719	$nfw_rules[NFW_LOOPBACK]['ena'] = 1;
1720	}
1721
1722	nfw_update_option( 'nfw_options', $nfw_options );
1723	nfw_update_option( 'nfw_rules', $nfw_rules );
1724
1725	}
1726
1727	// ---------------------------------------------------------------------
1728	// Restore default firewall policies.
1729
1730	function nf_sub_policies_default() {
1731
1732	nf_not_allowed( 'block', __LINE__ );
1733
1734	$nfw_options = nfw_get_option( 'nfw_options' );
1735	$nfw_rules = nfw_get_option( 'nfw_rules' );
1736
1737	$nfw_options['scan_protocol'] = 3;
1738	$nfw_options['uploads'] = 1;
1739	$nfw_options['sanitise_fn'] = 0;
1740	$nfw_options['substitute'] = 'X';
1741	$nfw_options['get_scan'] = 1;
1742	$nfw_options['get_sanitise'] = 0;
1743	$nfw_options['post_scan'] = 1;
1744	$nfw_options['post_sanitise'] = 0;
1745	$nfw_options['request_sanitise'] = 0;
1746	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
1747	$nfw_options['response_headers'] = '0003000000';
1748	$nfw_options['referrer_policy_enabled'] = 0;
1749	// We unset it, so that a default sample line will be displayed:
1750	unset( $nfw_options['csp_backend_data'] );
1751	$nfw_options['csp_frontend_data'] = '';
1752	}
1753	$nfw_options['custom_headers'] = '';
1754	$nfw_options['cookies_scan'] = 1;
1755	$nfw_options['cookies_sanitise'] = 0;
1756	$nfw_options['ua_scan'] = 1;
1757	$nfw_options['ua_sanitise'] = 1;
1758	$nfw_options['referer_scan'] = 0;
1759	$nfw_options['referer_sanitise'] = 1;
1760	$nfw_options['referer_post'] = 0;
1761	$nfw_options['no_host_ip'] = 0;
1762	$nfw_options['allow_local_ip'] = 1; // 1 == no !
1763	$nfw_options['php_superglobals'] = 1;
1764	$nfw_options['php_errors'] = 1;
1765	$nfw_options['php_self'] = 1;
1766	$nfw_options['php_path_t'] = 1;
1767	$nfw_options['php_path_i'] = 1;
1768	$nfw_options['wp_dir'] = '/wp-admin/(?:css\|images\|includes\|js)/\|' .
1769	'/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|' .
1770	'/'. basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/';
1771	$nfw_options['disallow_creation']= 0;
1772	$nfw_options['disallow_deletion']= 0;
1773	$nfw_options['disallow_settings']= 1;
1774	$nfw_options['disallow_privesc'] = 1;
1775	$nfw_options['disallow_privesc_mu'] = 0;
1776	$nfw_options['disallow_publish'] = 0;
1777	$nfw_options['enum_archives'] = 0;
1778	$nfw_options['enum_sitemap'] = 0;
1779	$nfw_options['enum_login'] = 0;
1780	$nfw_options['admin_ajax'] = 0;
1781	$nfw_options['enum_restapi'] = 0;
1782	$nfw_options['enum_feed'] = 0;
1783	$nfw_options['no_restapi'] = 0;
1784	$nfw_options['restapi_loggedin'] = 0;
1785	$nfw_options['no_appswd'] = 0;
1786	$nfw_options['no_xmlrpc'] = 0;
1787	$nfw_options['no_xmlrpc_multi'] = 0;
1788	$nfw_options['no_xmlrpc_pingback']= 0;
1789	$nfw_options['no_post_themes'] = 0;
1790	$nfw_options['force_ssl'] = 0;
1791	$nfw_options['disallow_edit'] = 0;
1792	$nfw_options['disable_error_handler'] = 0;
1793	$nfw_options['disallow_mods'] = 0;
1794	$nfw_options['post_b64'] = 1;
1795	$nfw_options['wl_admin'] = 1;
1796	$_SESSION['nfw_goodguy'] = true;
1797
1798	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 1;
1799	$nfw_rules[NFW_LOOPBACK]['ena'] = 1;
1800	$nfw_rules[NFW_WRAPPERS]['ena'] = 1;
1801
1802	$nfw_rules[NFW_OBJECTS]['ena'] = 1;
1803	$nfw_rules[NFW_OBJECTS]['cha'][1]['whe'] = 'GET\|POST\|SERVER:HTTP_USER_AGENT\|SERVER:HTTP_REFERER';
1804
1805	// Create but disable the rule by default
1806	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
1807	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
1808	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
1809	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
1810	}
1811	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1812
1813
1814	$nfw_rules[NFW_NULL_BYTE]['ena'] = 1;
1815	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 0;
1816
1817	nfw_update_option( 'nfw_options', $nfw_options);
1818	nfw_update_option( 'nfw_rules', $nfw_rules);
1819
1820	}
1821
1822	// ---------------------------------------------------------------------
1823	// EOF
1824