settings_firewall_policies.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.9

ninjafirewall / lib / settings_firewall_policies.php

ninjafirewall / lib Last commit date

settings_firewall_policies.php

1777 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n+ / sa / 2
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	// Block immediately if user is not allowed
23	nf_not_allowed( 'block', __LINE__ );
24
25	$yes = __('Yes', 'ninjafirewall');
26	$no = __('No', 'ninjafirewall');
27
28	$full_waf_msg = '<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span>'.
29	sprintf( __('To use this feature, please <a href="%s">go to the Dashboard page</a> and enable NinjaFirewall\'s Full WAF mode.', 'ninjafirewall'), '?page=NinjaFirewall' ) .'</p>';
30
31	if ( defined('NFW_WPWAF') ) {
32	$option_disabled = 1;
33	} else {
34	$option_disabled = 0;
35	}
36
37	$nfw_options = nfw_get_option( 'nfw_options' );
38	$nfw_rules = nfw_get_option( 'nfw_rules' );
39
40	// Tab and div display
41	if ( empty( $_REQUEST['tab'] ) ) { $_REQUEST['tab'] = 'basic'; }
42
43	if ( $_REQUEST['tab'] == 'intermediate' ) {
44	$basic_tab = ''; $basic_div = ' style="display:none"';
45	$intermediate_tab = ' nav-tab-active'; $intermediate_div = '';
46	$advanced_tab = ''; $advanced_div = ' style="display:none"';
47
48	} elseif ( $_REQUEST['tab'] == 'advanced' ) {
49	$basic_tab = ''; $basic_div = ' style="display:none"';
50	$intermediate_tab = ''; $intermediate_div = ' style="display:none"';
51	$advanced_tab = ' nav-tab-active'; $advanced_div = '';
52
53	} else {
54	$_REQUEST['tab'] = 'basic';
55	$basic_tab = ' nav-tab-active'; $basic_div = '';
56	$intermediate_tab = ''; $intermediate_div = ' style="display:none"';
57	$advanced_tab = ''; $advanced_div = ' style="display:none"';
58	}
59
60	?>
61	<div class="wrap">
62	<h1><img style="vertical-align:top;width:33px;height:33px;" src="<?php echo plugins_url( '/ninjafirewall/images/ninjafirewall_32.png' ) ?>"> <?php _e('Firewall Policies', 'ninjafirewall') ?></h1>
63	<?php
64
65	if ( isset( $_POST['nfw_options']) ) {
66	if ( empty($_POST['nfwnonce']) \|\| ! wp_verify_nonce($_POST['nfwnonce'], 'policies_save') ) {
67	wp_nonce_ays('policies_save');
68	}
69	if (! empty($_POST['Save']) ) {
70	nf_sub_policies_save();
71	echo '<div class="updated notice is-dismissible"><p>' . __('Your changes have been saved.', 'ninjafirewall') . '</p></div>';
72	} elseif (! empty($_POST['Default']) ) {
73	nf_sub_policies_default();
74	echo '<div class="updated notice is-dismissible"><p>' . __('Default values were restored.', 'ninjafirewall') . '</p></div>';
75	} else {
76	echo '<div class="error notice is-dismissible"><p>' . __('No action taken.', 'ninjafirewall') . '</p></div>';
77	}
78	$nfw_options = nfw_get_option( 'nfw_options' );
79	$nfw_rules = nfw_get_option( 'nfw_rules' );
80	}
81
82	?>
83	<br />
84	<h2 class="nav-tab-wrapper wp-clearfix" style="cursor:pointer">
85	<a id="tab-basic" class="nav-tab<?php echo $basic_tab ?>" onClick="nfwjs_switch_tabs('basic', 'basic:intermediate:advanced')"><?php _e( 'Basic Policies', 'ninjafirewall' ) ?></a>
86	<a id="tab-intermediate" class="nav-tab<?php echo $intermediate_tab ?>" onClick="nfwjs_switch_tabs('intermediate', 'basic:intermediate:advanced')"><?php _e( 'Intermediate Policies', 'ninjafirewall' ) ?></a>
87	<a id="tab-advanced" class="nav-tab<?php echo $advanced_tab ?>" onClick="nfwjs_switch_tabs('advanced', 'basic:intermediate:advanced')"><?php _e( 'Advanced Policies', 'ninjafirewall' ) ?></a>
88	<?php nfw_contextual_help() ?>
89	</h2>
90	<br />
91	<?php
92
93	echo '<form method="post" name="fwrules">';
94	wp_nonce_field('policies_save', 'nfwnonce', 0);
95
96	// ---------------------------------------------------------------------
97	// Basic options:
98	?>
99	<div id="basic-options"<?php echo $basic_div ?>>
100	<?php
101	if ( ( isset( $nfw_options['scan_protocol']) ) &&
102	( preg_match( '/^[123]$/', $nfw_options['scan_protocol']) ) ) {
103	$scan_protocol = $nfw_options['scan_protocol'];
104	} else {
105	$scan_protocol = 3;
106	}
107
108	?>
109	<h3>HTTP / HTTPS</h3>
110	<table class="form-table nfw-table">
111	<tr>
112	<th scope="row" class="row-med"><?php _e('Enable NinjaFirewall for', 'ninjafirewall') ?></th>
113	<td>
114	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="3"<?php checked($scan_protocol, 3 ) ?>> <?php _e('HTTP and HTTPS traffic (default)', 'ninjafirewall') ?></label></p>
115	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="1"<?php checked($scan_protocol, 1 ) ?>> <?php _e('HTTP traffic only', 'ninjafirewall') ?></label></p>
116	<p><label><input type="radio" name="nfw_options[scan_protocol]" value="2"<?php checked($scan_protocol, 2 ) ?>> <?php _e('HTTPS traffic only', 'ninjafirewall') ?></label></p>
117	</td>
118	</tr>
119	</table>
120
121	<br />
122	<br />
123
124	<?php
125	if ( empty( $nfw_options['sanitise_fn']) ) {
126	$sanitise_fn = 0;
127	} else {
128	$sanitise_fn = 1;
129	}
130	if ( empty( $nfw_options['uploads']) ) {
131	$uploads = 0;
132	$sanitise_fn = 0;
133	} else {
134	$uploads = 1;
135	}
136	if ( empty( $nfw_options['substitute'] ) \|\| strlen( $nfw_options['substitute'] ) > 1 \|\| $nfw_options['substitute'] == '/' ) {
137	$substitute = 'X';
138	} else {
139	$substitute = htmlspecialchars( $nfw_options['substitute'] );
140	}
141	?>
142	<h3><?php _e('Uploads', 'ninjafirewall') ?></h3>
143	<table class="form-table nfw-table">
144	<tr>
145	<th scope="row" class="row-med"><?php _e('File Uploads', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can allow uploads while rejecting potentially dangerous files, even if they are compressed inside a ZIP archive: scripts (PHP, CGI, Ruby, Python, bash/shell), C/C++ source code, binaries (MZ/PE/NE and ELF formats), system files (.htaccess, .htpasswd and PHP INI) and SVG files containing Javascript/XML events. You can easily limit the size of each uploaded file too, without having to modify your PHP configuration.', 'ninjafirewall' ) ?>"></span></th>
146	<td>
147	<select name="nfw_options[uploads]" onchange="nfwjs_upload_onoff(this);">
148	<option value="1"<?php selected( $uploads, 1 ) ?>><?php echo __('Allow uploads', 'ninjafirewall') .' '. __('(default)', 'ninjafirewall') ?></option>
149	<option value="0"<?php selected( $uploads, 0 ) ?>><?php _e('Disallow uploads', 'ninjafirewall') ?></option>
150	</select>
151	<br />
152	<label><input type="checkbox" onclick='return nfwjs_sanitise(this);' name="nfw_options[sanitise_fn]"<?php checked( $sanitise_fn, 1 ); disabled( $uploads, 0 ) ?> id="san">
153	<?php _e('Sanitise filenames', 'ninjafirewall') ?> (<?php _e('substitution character:', 'ninjafirewall') ?></label> <input id="subs" maxlength="1" size="1" value="<?php echo $substitute ?>" name="nfw_options[substitute]" type="text" <?php disabled( $uploads, 0 ) ?>/> )
154	</td>
155	</tr>
156	</table>
157
158	<br />
159	<br />
160
161	<?php
162	if (! isset( $nfw_options['wp_dir'] ) ) {
163	$nfw_options['wp_dir'] = '';
164	}
165	if ( strpos( $nfw_options['wp_dir'], 'wp-admin' ) !== FALSE ) {
166	$wp_admin = 1;
167	} else {
168	$wp_admin = 0;
169	}
170	if ( strpos( $nfw_options['wp_dir'], 'wp-includes' ) !== FALSE ) {
171	$wp_inc = 1;
172	} else {
173	$wp_inc = 0;
174	}
175	if ( strpos( $nfw_options['wp_dir'], 'uploads' ) !== FALSE ) {
176	$wp_upl = 1;
177	} else {
178	$wp_upl = 0;
179	}
180	if ( strpos( $nfw_options['wp_dir'], 'cache' ) !== FALSE ) {
181	$wp_cache = 1;
182	} else {
183	$wp_cache = 0;
184	}
185	if ( empty( $nfw_options['disallow_creation']) ) {
186	$disallow_creation = 0;
187	} else {
188	$disallow_creation = 1;
189	}
190	if ( empty( $nfw_options['disallow_deletion']) ) {
191	$disallow_deletion = 0;
192	} else {
193	$disallow_deletion = 1;
194	}
195	if ( empty( $nfw_options['disallow_privesc']) ) {
196	$disallow_privesc = 0;
197	} else {
198	$disallow_privesc = 1;
199	}
200	if ( empty( $nfw_options['disallow_privesc_mu']) ) {
201	$disallow_privesc_mu = 0;
202	} else {
203	$disallow_privesc_mu = 1;
204	}
205	if ( empty( $nfw_options['disallow_settings']) ) {
206	$disallow_settings = 0;
207	} else {
208	$disallow_settings = 1;
209	}
210	if ( empty( $nfw_options['enum_archives']) ) {
211	$enum_archives = 0;
212	} else {
213	$enum_archives = 1;
214	}
215	if ( empty( $nfw_options['enum_sitemap']) ) {
216	$enum_sitemap = 0;
217	} else {
218	$enum_sitemap = 1;
219	}
220	if ( empty( $nfw_options['enum_login']) ) {
221	$enum_login = 0;
222	} else {
223	$enum_login = 1;
224	}
225	if ( empty( $nfw_options['enum_restapi']) ) {
226	$enum_restapi = 0;
227	} else {
228	$enum_restapi = 1;
229	}
230	if ( empty( $nfw_options['enum_feed']) ) {
231	$enum_feed = 0;
232	} else {
233	$enum_feed = 1;
234	}
235	if ( empty( $nfw_options['no_appswd']) ) {
236	$no_appswd = 0;
237	} else {
238	$no_appswd = 1;
239	}
240	if ( empty( $nfw_options['no_restapi']) ) {
241	$no_restapi = 0;
242	} else {
243	$no_restapi = 1;
244	}
245	if ( empty( $nfw_options['restapi_loggedin']) \|\| $no_restapi == 0 ) {
246	$restapi_loggedin = 0;
247	} else {
248	$restapi_loggedin = 1;
249	}
250	if ( empty( $nfw_options['no_xmlrpc']) ) {
251	$no_xmlrpc = 0;
252	} else {
253	$no_xmlrpc = 1;
254	}
255	if ( empty( $nfw_options['no_xmlrpc_multi']) ) {
256	$no_xmlrpc_multi = 0;
257	} else {
258	$no_xmlrpc_multi = 1;
259	}
260	if ( empty( $nfw_options['no_xmlrpc_pingback']) ) {
261	$no_xmlrpc_pingback = 0;
262	} else {
263	$no_xmlrpc_pingback = 1;
264	}
265	if ( empty( $nfw_options['no_post_themes']) ) {
266	$no_post_themes = 0;
267	} else {
268	$no_post_themes = 1;
269	}
270
271	if ( empty( $nfw_options['force_ssl']) ) {
272	$force_ssl = 0;
273	} else {
274	$force_ssl = 1;
275	}
276	if ( empty( $nfw_options['disallow_edit']) ) {
277	$disallow_edit = 0;
278	} else {
279	$disallow_edit = 1;
280	}
281	if ( empty( $nfw_options['disallow_mods']) ) {
282	$disallow_mods = 0;
283	} else {
284	$disallow_mods = 1;
285	}
286	if ( empty( $nfw_options['disable_error_handler']) ) {
287	$disable_error_handler = 0;
288	} else {
289	$disable_error_handler = 1;
290	}
291	if ( empty( $nfw_options['disallow_publish']) ) {
292	$disallow_publish = 0;
293	} else {
294	$disallow_publish = 1;
295	}
296
297	$force_ssl_already_enabled = 0;
298	$disallow_edit_already_enabled = 0;
299	$disallow_mods_already_enabled = 0;
300	$disable_error_handler_already_enabled = 0;
301	if ( defined('DISALLOW_FILE_EDIT') && ! $disallow_edit ) {
302	$disallow_edit_already_enabled = 1;
303	}
304	if ( defined('DISALLOW_FILE_MODS') && ! $disallow_mods ) {
305	$disallow_mods_already_enabled = 1;
306	}
307	if ( defined('WP_DISABLE_FATAL_ERROR_HANDLER') && ! $disable_error_handler ) {
308	$disable_error_handler_already_enabled = 1;
309	}
310	if ( defined('FORCE_SSL_ADMIN') && FORCE_SSL_ADMIN == true && ! $force_ssl ) {
311	$force_ssl_already_enabled = 1;
312	}
313	?>
314	<h3>WordPress</h3>
315	<table class="form-table nfw-table">
316	<tr>
317	<th scope="row" class="row-med"><?php _e('Block direct access to any PHP file located in one of these directories', 'ninjafirewall') ?></th>
318	<td>
319	<?php
320	if ( defined('NFW_WPWAF') ) {
321	echo $full_waf_msg;
322	}
323	?>
324	<table class="form-table">
325	<tr style="border: solid 1px #DFDFDF;">
326	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_admin]" id="wp_01"<?php checked( $wp_admin, 1 ); disabled( $option_disabled, 1) ?>></td>
327	<td>
328	<label for="wp_01">
329	<p><code>/wp-admin/css/*</code></p>
330	<p><code>/wp-admin/images/*</code></p>
331	<p><code>/wp-admin/includes/*</code></p>
332	<p><code>/wp-admin/js/*</code></p>
333	</label>
334	</td>
335	</tr>
336	<tr style="border: solid 1px #DFDFDF;">
337	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_inc]" id="wp_02"<?php checked( $wp_inc, 1 ); disabled( $option_disabled, 1) ?>></td>
338	<td>
339	<label for="wp_02">
340	<p><code>/wp-includes/*.php</code></p>
341	<p><code>/wp-includes/css/*</code></p>
342	<p><code>/wp-includes/images/*</code></p>
343	<p><code>/wp-includes/js/*</code></p>
344	<p><code>/wp-includes/theme-compat/*</code></p>
345	</label>
346	<br />
347	<p class="description"><?php _e('NinjaFirewall will not block access to the TinyMCE WYSIWYG editor even if this option is enabled.', 'ninjafirewall') ?></p>
348	</td>
349	</tr>
350	<tr style="border: solid 1px #DFDFDF;">
351	<td align="center" width="10"><input type="checkbox" name="nfw_options[wp_upl]" id="wp_03"<?php checked( $wp_upl, 1 ); disabled( $option_disabled, 1) ?>></td>
352	<td><label for="wp_03">
353	<p><code>/<?php echo basename(WP_CONTENT_DIR); ?>/uploads/*</code></p>
354	<p><code>/<?php echo basename(WP_CONTENT_DIR); ?>/blogs.dir/*</code></p>
355	</label></td>
356	</tr>
357	<tr style="border: solid 1px #DFDFDF;">
358	<td align="center" style="vertical-align:top" width="10"><input type="checkbox" name="nfw_options[wp_cache]" id="wp_04"<?php checked( $wp_cache, 1 ); disabled( $option_disabled, 1) ?>></td>
359	<td style="vertical-align:top"><label for="wp_04"><code>/cache/</code></label>
360	<br />
361	<br />
362	<p class="description"><?php _e('Unless you have PHP scripts in a "/cache/" folder that need to be accessed by your visitors, we recommend to enable this option.', 'ninjafirewall') ?></p>
363	</td>
364	</tr>
365	</table>
366	<br />
367	</td>
368	</tr>
369
370	<?php
371	if ( defined('NFW_DISABLE_PRVESC2') ) {
372	$msg = '<p class="description">'. sprintf( __('To enable this option, please remove the %s constant from your wp-config.php or .htninja script.', 'ninjafirewall'), '<code>NFW_DISABLE_PRVESC2</code>' ) .'</p>';
373	$disabled = 1;
374	$disabled_mu = 1;
375	$disallow_privesc = 0;
376	$disallow_privesc_mu = 0;
377	} else {
378	$msg ='';
379	$disabled = 0;
380	$disabled_mu = 0;
381	}
382	$reg_user = ''; $res_user_msg = ' onclick="return nfwjs_reguserwarning(this)"';
383	$reg_site = ''; $res_site_msg = ' onclick="return nfwjs_regsitewarning(this)"';
384	// Multisite
385	if ( is_multisite() ) {
386	// 'none', 'user', 'blog' or 'all'
387	$reg = get_site_option( 'registration' );
388	if ( in_array( $reg, array('user', 'blog', 'all') ) ) {
389	if ( $reg != 'blog' ) {
390	$reg_user = $res_user_msg;
391	}
392	if ( $reg != 'user' ) {
393	$reg_site = $res_site_msg;
394	}
395	}
396	$main_site = ' '.__('(main site only)', 'ninjafirewall');
397	$network_only = ' '.__('(not recommended if you allow sites registration)', 'ninjafirewall');
398	// Single site
399	} else {
400	$reg = get_option( 'users_can_register' );
401	if (! empty( $reg ) ) {
402	$reg_user = $res_user_msg;
403	}
404	// Disable policy on a non-multisite installation
405	$disabled_mu = 1;
406	$main_site = '';
407	$network_only = ' '.__('(multisite installation only)', 'ninjafirewall');
408	}
409	if ( class_exists( 'woocommerce' ) ) {
410	$reg_user = ' onclick="return nfwjs_woowarning(this)"';
411	}
412	?>
413	<tr>
414	<th scope="row" class="row-med"><?php _e('Permissions', 'ninjafirewall') ?></th>
415	<td>
416	<p><label><input type="checkbox" name="nfw_options[disallow_settings]" value="1"<?php checked( $disallow_settings, 1 ) ?>> <?php echo _e('Block attempts to modify important WordPress settings', 'ninjafirewall') ?></label></p>
417	<p><label><input<?php echo $reg_user ?> type="checkbox" name="nfw_options[disallow_creation]" value="1"<?php checked( $disallow_creation, 1 ) ?>> <?php _e('Block user accounts creation', 'ninjafirewall') ?></label></p>
418	<p><label><input type="checkbox" name="nfw_options[disallow_deletion]" value="1"<?php checked( $disallow_deletion, 1 ) ?>> <?php _e('Block user accounts deletion', 'ninjafirewall') ?></label></p>
419	<p><label><input <?php disabled( $disabled, 1 ) ?>type="checkbox" name="nfw_options[disallow_privesc]" value="1"<?php checked( $disallow_privesc, 1 ) ?>> <?php _e('Block attempts to gain administrative privileges', 'ninjafirewall'); echo $main_site; ?></label></p>
420	<?php echo $msg ?>
421	<p style="margin-left:20px"><label><input<?php echo $reg_site ?> <?php disabled( $disabled_mu, 1 ) ?> type="checkbox" name="nfw_options[disallow_privesc_mu]" value="1"<?php checked( $disallow_privesc_mu, 1 ) ?>> <?php _e('Apply to all subsites in the network', 'ninjafirewall'); echo $network_only; ?></label></p>
422
423	<p><label><input type="checkbox" name="nfw_options[disallow_publish]" value="1"<?php checked( $disallow_publish, 1 ) ?>> <?php echo _e('Block attempts to publish, edit or delete a published post by users who do not have the right capabilities', 'ninjafirewall') ?> <?php _e('(recommended)', 'ninjafirewall') ?></label></p>
424	</td>
425	</tr>
426
427	<?php
428	if ( empty( $nfw_options['admin_ajax'] ) ) {
429	$admin_ajax = 0;
430	} else {
431	$admin_ajax = 1;
432	}
433	?>
434	<tr>
435	<th scope="row" class="row-med"><?php _e('WordPress AJAX', 'ninjafirewall') ?></th>
436	<td>
437	<p><label><input type="checkbox" name="nfw_options[admin_ajax]" value="1"<?php checked( $admin_ajax, 1 ) ?>> <?php _e('Protect <code>admin-ajax.php</code> against bots', 'ninjafirewall') ?></label></p>
438	<p class="description"><?php printf( __('Your server IP (%s), localhost and private IP addresses will not be affected by this policy.', 'ninjafirewall'), htmlspecialchars( $_SERVER['SERVER_ADDR'] ) ) ?></p>
439	</td>
440	</tr>
441
442	<tr>
443	<th scope="row" class="row-med"><?php _e('Protect against username enumeration', 'ninjafirewall') ?></th>
444	<td>
445	<p><label><input type="checkbox" name="nfw_options[enum_archives]" value="1"<?php checked( $enum_archives, 1 ) ?>> <?php _e('Through the author archives', 'ninjafirewall') ?></label></p>
446	<p><label><input type="checkbox" name="nfw_options[enum_sitemap]" value="1"<?php checked( $enum_sitemap, 1 ) ?>> <?php _e('Through the author sitemap', 'ninjafirewall') ?></label></p>
447	<p><label><input type="checkbox" name="nfw_options[enum_login]" value="1"<?php checked( $enum_login, 1 ) ?>> <?php _e('Through the login page', 'ninjafirewall') ?></label></p>
448	<p><label><input type="checkbox" name="nfw_options[enum_feed]" value="1"<?php checked( $enum_feed, 1 ) ?>> <?php _e('Through the blog feed', 'ninjafirewall') ?></label></p>
449	<p><label><input type="checkbox" name="nfw_options[enum_restapi]" value="1"<?php checked( $enum_restapi, 1 ) ?>> <?php _e('Through the WordPress REST API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
450	</td>
451	</tr>
452
453	<tr>
454	<th scope="row" class="row-med"><?php _e('WordPress REST API', 'ninjafirewall') ?></th>
455	<td>
456	<p><label><input type="checkbox" onClick="nfwjs_no_restapi(this);" name="nfw_options[no_restapi]" value="1"<?php checked( $no_restapi, 1 ) ?>> <?php _e('Block any access to the API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
457	<p style="margin-left:20px"><label><input type="checkbox"<?php disabled($no_restapi, 0) ?> name="nfw_options[restapi_loggedin]" value="1"<?php checked( $restapi_loggedin, 1 ) ?>> <?php _e('Allow logged-in users to access the API', 'ninjafirewall') ?></label></p>
458	</td>
459	</tr>
460	<tr>
461	<th scope="row" class="row-med"><?php _e('WordPress XML-RPC API', 'ninjafirewall') ?></th>
462	<td>
463	<p><label><input type="checkbox" onClick="nfwjs_no_xmlrpc(this);" name="nfw_options[no_xmlrpc]" value="1"<?php checked( $no_xmlrpc, 1 ) ?>> <?php _e('Block any access to the API', 'ninjafirewall') ?></label> <font color="red">*</font></p>
464	<p><label><input type="checkbox"<?php disabled($no_xmlrpc, 1) ?> name="nfw_options[no_xmlrpc_multi]" value="1"<?php checked( $no_xmlrpc_multi, 1 ) ?>> <?php _e('Block <code>system.multicall</code> method', 'ninjafirewall') ?></label> <font color="red">*</font></p>
465	<p><label><input type="checkbox"<?php disabled($no_xmlrpc, 1) ?> name="nfw_options[no_xmlrpc_pingback]" value="1"<?php checked( $no_xmlrpc_pingback, 1 ) ?>> <?php _e('Block Pingbacks', 'ninjafirewall') ?></label></p>
466	<br />
467	<p class="description" style="font-size:14px"><font color="red">*</font> <?php _e('Disabling access to the REST or XML-RPC API may break some functionality on your blog, its themes or plugins (e.g., Gutenberg editor, Jetpack, Contact Form 7 etc).', 'ninjafirewall') ?></p>
468	</td>
469	</tr>
470
471	<tr>
472	<th scope="row" class="row-med"><?php _e('Application Passwords', 'ninjafirewall') ?></th>
473	<td>
474	<p><label><input type="checkbox" name="nfw_options[no_appswd]" value="1"<?php checked( $no_appswd, 1 ) ?>> <?php printf( __('Disable <a %s>Application Passwords</a>', 'ninjafirewall'), 'href="https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/" target="_blank" rel="noreferrer noopener"') ?></label></p>
475	</td>
476	</tr>
477
478	<tr valign="top">
479	<th scope="row" class="row-med" style="vertical-align:top"><?php _e('Block <code>POST</code> requests in the themes folder', 'ninjafirewall') ?> <code>/<?php echo basename(WP_CONTENT_DIR); ?>/themes</code></th>
480	<td>
481	<?php nfw_toggle_switch( 'info', 'nfw_options[no_post_themes]', $yes, $no, 'small', $no_post_themes, $option_disabled );
482	if ( defined('NFW_WPWAF') ) {
483	echo $full_waf_msg;
484	}
485	?>
486	</td>
487	</tr>
488	<tr valign="top">
489	<th scope="row" class="row-med"><a name="builtinconstants"></a><?php _e('Force HTTPS for admin and logins', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#require-ssl-for-admin-and-logins" target="_blank" rel="noreferrer noopener">FORCE_SSL_ADMIN</a></code></th>
490	<td>
491	<?php nfw_toggle_switch( 'info', 'nfw_options[force_ssl]', $yes, $no, 'small', $force_ssl, $force_ssl_already_enabled, 'onclick="return nfwjs_ssl_warn(this,'. NFW_IS_HTTPS .');"' ) ?>
492	</td>
493	</tr>
494	<tr valign="top">
495	<th scope="row" class="row-med"><?php _e('Disable the plugin and theme editor', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#disable-the-plugin-and-theme-editor" target="_blank" rel="noreferrer noopener">DISALLOW_FILE_EDIT</a></code></th>
496	<td>
497	<?php nfw_toggle_switch( 'info', 'nfw_options[disallow_edit]', $yes, $no, 'small', $disallow_edit, $disallow_edit_already_enabled ) ?>
498	</td>
499	</tr>
500	<tr valign="top">
501	<th scope="row" class="row-med"><?php _e('Disable plugin and theme update/installation', 'ninjafirewall') ?> <code><a href="https://wordpress.org/support/article/editing-wp-config-php/#disable-plugin-and-theme-update-and-installation" target="_blank" rel="noreferrer noopener">DISALLOW_FILE_MODS</a></code></th>
502	<td>
503	<?php nfw_toggle_switch( 'info', 'nfw_options[disallow_mods]', $yes, $no, 'small', $disallow_mods, $disallow_mods_already_enabled ) ?>
504	</td>
505	</tr>
506	<tr valign="top">
507	<th scope="row" class="row-med"><?php _e('Disable the fatal error handler', 'ninjafirewall') ?> <code><a href="https://make.wordpress.org/core/2019/01/14/php-site-health-mechanisms-in-5-1/" target="_blank" rel="noreferrer noopener">WP_DISABLE_FATAL_ERROR_HANDLER</a></code></th>
508	<td>
509	<?php nfw_toggle_switch( 'info', 'nfw_options[disable_error_handler]', $yes, $no, 'small', $disable_error_handler, $disable_error_handler_already_enabled ) ?>
510	</td>
511	</tr>
512
513	</table>
514	<a name="donotblockadmin"></a>
515	<br />
516	<br />
517
518	<?php
519	if ( empty( $nfw_options['wl_admin']) ) {
520	$wl_admin = 0;
521	} elseif ( $nfw_options['wl_admin'] == 2 ) {
522	$wl_admin = 2;
523	} else {
524	$wl_admin = 1;
525	}
526	?>
527	<table class="form-table nfw-table">
528	<tr style="background-color:#F9F9F9;border: solid 1px #DFDFDF;">
529	<th scope="row" class="row-med"><?php _e('Users Whitelist', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, the Access Control section allows you to whitelist WordPress users depending on their role.', 'ninjafirewall' ) ?>"></span></th>
530	<td>
531	<p><label><input type="radio" name="nfw_options[wl_admin]" value="1"<?php checked( $wl_admin, 1 ) ?>> <?php _e('Add the Administrator to the whitelist (default).', 'ninjafirewall') ?></label></p>
532	<p><label><input type="radio" name="nfw_options[wl_admin]" value="2"<?php checked( $wl_admin, 2 ) ?>> <?php _e('Add all logged in users to the whitelist (users must log out and log in back again to apply changes).', 'ninjafirewall') ?></label></p>
533	<p><label><input type="radio" name="nfw_options[wl_admin]" value="0"<?php checked( $wl_admin, 0 ) ?>> <?php _e('Disable users whitelist.', 'ninjafirewall') ?></label></p>
534	<p class="description"><?php _e('Note: This feature does not apply to <code>FORCE_SSL_ADMIN</code>, <code>DISALLOW_FILE_EDIT</code>, <code>DISALLOW_FILE_MODS</code> and <code>WP_DISABLE_FATAL_ERROR_HANDLER</code> options which, if enabled, are always enforced.', 'ninjafirewall') ?></p>
535	</td>
536	</tr>
537	</table>
538
539	</div>
540
541
542	<?php
543	// ---------------------------------------------------------------------
544	// Intermediate options:
545	?>
546	<div id="intermediate-options"<?php echo $intermediate_div ?>>
547	<?php
548	if ( empty( $nfw_options['get_scan']) ) {
549	$get_scan = 0;
550	} else {
551	$get_scan = 1;
552	}
553	if ( empty( $nfw_options['get_sanitise']) ) {
554	$get_sanitise = 0;
555	} else {
556	$get_sanitise = 1;
557	}
558	?>
559	<h3><?php _e('HTTP GET variable', 'ninjafirewall') ?></h3>
560	<table class="form-table nfw-table">
561	<tr>
562	<th scope="row" class="row-med"><?php _e('Scan <code>GET</code> variable', 'ninjafirewall') ?></th>
563	<td>
564	<?php nfw_toggle_switch( 'info', 'nfw_options[get_scan]', $yes, $no, 'small', $get_scan ) ?>
565	</td>
566	</tr>
567	<tr>
568	<th scope="row" class="row-med"><?php _e('Sanitise <code>GET</code> variable', 'ninjafirewall') ?></th>
569	<td>
570	<?php nfw_toggle_switch( 'info', 'nfw_options[get_sanitise]', $yes, $no, 'small', $get_sanitise ) ?>
571	</td>
572	</tr>
573	</table>
574
575	<br /><br />
576
577	<?php
578	if ( empty( $nfw_options['post_scan']) ) {
579	$post_scan = 0;
580	} else {
581	$post_scan = 1;
582	}
583	if ( empty( $nfw_options['post_b64']) ) {
584	$post_b64 = 0;
585	} else {
586	$post_b64 = 1;
587	}
588	?>
589	<h3><?php _e('HTTP POST variable', 'ninjafirewall') ?></h3>
590	<table class="form-table nfw-table">
591	<tr valign="top">
592	<th scope="row" class="row-med"><?php _e('Scan <code>POST</code> variable', 'ninjafirewall') ?></th>
593	<td>
594	<?php nfw_toggle_switch( 'info', 'nfw_options[post_scan]', $yes, $no, 'small', $post_scan ) ?>
595	</td>
596	</tr>
597	<tr valign="top">
598	<th scope="row" class="row-med"><?php _e('Decode Base64-encoded <code>POST</code> variable', 'ninjafirewall') ?></th>
599	<td>
600	<?php nfw_toggle_switch( 'info', 'nfw_options[post_b64]', $yes, $no, 'small', $post_b64 ) ?>
601	</td>
602	</tr>
603	</table>
604
605	<br /><br />
606
607	<?php
608	if ( empty( $nfw_options['cookies_scan']) ) {
609	$cookies_scan = 0;
610	} else {
611	$cookies_scan = 1;
612	}
613	if ( empty( $nfw_options['cookies_sanitise']) ) {
614	$cookies_sanitise = 0;
615	} else {
616	$cookies_sanitise = 1;
617	}
618	?>
619	<h3><?php _e('Cookies', 'ninjafirewall') ?></h3>
620	<table class="form-table nfw-table">
621	<tr>
622	<th scope="row" class="row-med"><?php _e('Scan cookies', 'ninjafirewall') ?></th>
623	<td>
624	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_scan]', $yes, $no, 'small', $cookies_scan ) ?>
625	</td>
626	</tr>
627	<tr>
628	<th scope="row" class="row-med"><?php _e('Sanitise cookies', 'ninjafirewall') ?></th>
629	<td>
630	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_sanitise]', $yes, $no, 'small', $cookies_sanitise ) ?>
631	</td>
632	</tr>
633	</table>
634
635	<br /><br />
636
637	<?php
638	if ( empty( $nfw_options['ua_scan']) ) {
639	$ua_scan = 0;
640	} else {
641	$ua_scan = 1;
642	}
643	if ( empty( $nfw_options['ua_sanitise']) ) {
644	$ua_sanitise = 0;
645	} else {
646	$ua_sanitise = 1;
647	}
648	if ( empty( $nfw_rules[NFW_SCAN_BOTS]['ena']) ) {
649	$block_bots = 0;
650	} else {
651	$block_bots = 1;
652	}
653	?>
654	<h3><?php _e('HTTP_USER_AGENT server variable', 'ninjafirewall') ?></h3>
655	<table class="form-table nfw-table">
656	<tr>
657	<th scope="row" class="row-med"><?php _e('Scan <code>HTTP_USER_AGENT</code>', 'ninjafirewall') ?></th>
658	<td>
659	<?php nfw_toggle_switch( 'info', 'nfw_options[ua_scan]', $yes, $no, 'small', $ua_scan ) ?>
660	</td>
661	</tr>
662	<tr>
663	<th scope="row" class="row-med"><?php _e('Sanitise <code>HTTP_USER_AGENT</code>', 'ninjafirewall') ?></th>
664	<td>
665	<?php nfw_toggle_switch( 'info', 'nfw_options[ua_sanitise]', $yes, $no, 'small', $ua_sanitise ) ?>
666	</td>
667	</tr>
668	<tr>
669	<th scope="row" class="row-med"><?php _e('Block suspicious bots/scanners', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, the Bot Access Control section allows you to select, edit, add and remove bots.', 'ninjafirewall' ) ?>"></span></th>
670	<td>
671	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_bots]', $yes, $no, 'small', $block_bots ) ?>
672	</td>
673	</tr>
674	</table>
675
676	<br /><br />
677
678	<?php
679	if ( empty( $nfw_options['referer_scan']) ) {
680	$referer_scan = 0;
681	} else {
682	$referer_scan = 1;
683	}
684	if ( empty( $nfw_options['referer_sanitise']) ) {
685	$referer_sanitise = 0;
686	} else {
687	$referer_sanitise = 1;
688	}
689	if ( empty( $nfw_options['referer_post']) ) {
690	$referer_post = 0;
691	} else {
692	$referer_post = 1;
693	}
694	?>
695	<h3><?php _e('HTTP_REFERER server variable', 'ninjafirewall') ?></h3>
696	<table class="form-table nfw-table">
697	<tr>
698	<th scope="row" class="row-med"><?php _e('Scan <code>HTTP_REFERER</code>', 'ninjafirewall') ?></th>
699	<td>
700	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_scan]', $yes, $no, 'small', $referer_scan ) ?>
701	</td>
702	</tr>
703	<tr>
704	<th scope="row" class="row-med"><?php _e('Sanitise <code>HTTP_REFERER</code>', 'ninjafirewall') ?></th>
705	<td>
706	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_sanitise]', $yes, $no, 'small', $referer_sanitise ) ?>
707	</td>
708	</tr>
709	<tr valign="top">
710	<th scope="row" class="row-med"><?php _e('Block <code>POST</code> requests that do not have an <code>HTTP_REFERER</code> header', 'ninjafirewall') ?></th>
711	<td>
712	<?php nfw_toggle_switch( 'info', 'nfw_options[referer_post]', $yes, $no, 'small', $referer_post ) ?>
713	<p class="description"> <?php _e('Keep this option disabled if you are using scripts like Paypal IPN, WordPress WP-Cron etc', 'ninjafirewall') ?>.</p>
714	</td>
715	</tr>
716	</table>
717
718	<br /><br />
719
720	<?php
721	if ( empty( $nfw_rules[NFW_LOOPBACK]['ena']) ) {
722	$no_localhost_ip = 0;
723	} else {
724	$no_localhost_ip = 1;
725	}
726	if ( empty( $nfw_options['no_host_ip']) ) {
727	$no_host_ip = 0;
728	} else {
729	$no_host_ip = 1;
730	}
731	if ( empty( $nfw_options['allow_local_ip']) ) {
732	$allow_local_ip = 0;
733	} else {
734	$allow_local_ip = 1;
735	}
736	?>
737	<h3>IP <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, you can use the IP Access Control section to easily configure all IP address related options (source, whitelist, blacklist, rate limiting etc).', 'ninjafirewall' ) ?>"></span></h3>
738	<table class="form-table nfw-table" border=0>
739	<tr>
740	<th scope="row" class="row-med"><?php _e('Block localhost IP in <code>GET/POST</code> request', 'ninjafirewall') ?></th>
741	<td>
742	<?php nfw_toggle_switch( 'info', 'nfw_rules[no_localhost_ip]', $yes, $no, 'small', $no_localhost_ip ) ?>
743	</td>
744	</tr>
745	<tr>
746	<th scope="row" class="row-med"><?php _e('Block HTTP requests with an IP in the <code>HTTP_HOST</code> header', 'ninjafirewall') ?></th>
747	<td>
748	<?php nfw_toggle_switch( 'info', 'nfw_options[no_host_ip]', $yes, $no, 'small', $no_host_ip ) ?>
749	</td>
750	</tr>
751	<tr>
752	<th scope="row" class="row-med"><?php _e('Scan traffic coming from localhost and private IP address spaces', 'ninjafirewall') ?></th>
753	<td>
754	<?php nfw_toggle_switch( 'info', 'nfw_options[allow_local_ip]', $yes, $no, 'small', $allow_local_ip ) ?>
755	</td>
756	</tr>
757	</table>
758
759	</div>
760
761	<?php
762	// ---------------------------------------------------------------------
763	// Advanced options:
764	?>
765	<div id="advanced-options"<?php echo $advanced_div ?>>
766
767	<?php
768	if (! isset( $nfw_options['response_headers'][0]) ) { $nfw_options['response_headers'][0] = 0; }
769	if (! isset( $nfw_options['response_headers'][1]) ) { $nfw_options['response_headers'][1] = 0; }
770	if (! isset( $nfw_options['response_headers'][2]) ) { $nfw_options['response_headers'][2] = 0; }
771	if (! isset( $nfw_options['response_headers'][3]) ) { $nfw_options['response_headers'][3] = 3; }
772	if (! isset( $nfw_options['response_headers'][4]) ) { $nfw_options['response_headers'][4] = 0; }
773	if (! isset( $nfw_options['response_headers'][5]) ) { $nfw_options['response_headers'][5] = 0; }
774	if (! isset( $nfw_options['response_headers'][6]) ) { $nfw_options['response_headers'][6] = 0; }
775	if (! isset( $nfw_options['response_headers'][7]) ) { $nfw_options['response_headers'][7] = 0; }
776	if (! isset( $nfw_options['response_headers'][8]) ) { $nfw_options['response_headers'][8] = 0; }
777	if (! isset( $nfw_options['response_headers'][9]) ) { $nfw_options['response_headers'][9] = 0; }
778	$err_msg = ''; $err = 0;
779	// Some compatibility checks:
780	// 1. header_register_callback(): requires PHP >=5.4
781	// 2. headers_list() and header_remove(): some hosts may disable them.
782	$tpl = __('The "HTTP response headers" options below are disabled because the %s PHP function is not available on your server.', 'ninjafirewall');
783	if (! function_exists( 'header_register_callback' ) ) {
784	$err_msg = sprintf( $tpl, 'header_register_callback()' );
785	$err = 1;
786
787	} elseif (! function_exists( 'headers_list' ) ) {
788	$err_msg = sprintf( $tpl, 'headers_list()' );
789	$err = 1;
790
791	} elseif (! function_exists( 'header_remove' ) ) {
792	$err_msg = sprintf( $tpl, 'header_remove()' );
793	$err = 1;
794	}
795	if ( empty( $nfw_options['response_headers'] ) \|\| ! empty( $err_msg ) \|\|
796	! preg_match( '/^\d+$/', $nfw_options['response_headers'] ) ) {
797
798	$nfw_options['response_headers'] = '0000000000';
799	}
800	?>
801
802	<h3><?php _e('HTTP response headers', 'ninjafirewall') ?></h3>
803	<?php
804	if (! empty( $err_msg ) ) {
805	echo '<p class="description" style="color:red;font-size:14px">'. $err_msg .'</p>';
806	}
807	?>
808	<table class="form-table nfw-table">
809	<tr>
810	<th scope="row" class="row-med"><?php printf( __('Set %s to protect against MIME type confusion attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-Content-Type-Options</a>') ?></th>
811	<td>
812	<?php nfw_toggle_switch( 'info', 'nfw_options[x_content_type_options]', $yes, $no, 'small', $nfw_options['response_headers'][1], $err ) ?>
813	</td>
814	</tr>
815	<tr>
816	<th scope="row" class="row-med"><?php printf( __('Set %s to protect against clickjacking attempts', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-Frame-Options</a>') ?></th>
817	<td>
818	<select name="nfw_options[x_frame_options]" <?php disabled( $err, 1 ) ?>>
819	<option value="0"<?php selected( $nfw_options['response_headers'][2], 0 ) ?>><?php echo $no; ?></option>
820	<option value="1"<?php selected( $nfw_options['response_headers'][2], 1 ) ?>>SAMEORIGIN</option>
821	<option value="2"<?php selected( $nfw_options['response_headers'][2], 2 ) ?>>DENY</option>
822	</select>
823	<p class="description"><?php _e('Setting this option to <code>DENY</code> may break some functionality on your blog, its themes or plugins.', 'ninjafirewall') ?></p>
824	</td>
825	</tr>
826	<tr>
827	<th scope="row" class="row-med"><?php printf( __('Set %s', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">X-XSS-Protection</a>') ?></th>
828	<td>
829	<select name="nfw_options[x_xss_protection]" <?php disabled( $err, 1 ) ?>>
830	<option value="3"<?php selected( $nfw_options['response_headers'][3], 3 ) ?>><?php echo $no; ?></option>
831	<option value="0"<?php selected( $nfw_options['response_headers'][3], 0 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"0"'); ?></option>
832	<option value="2"<?php selected( $nfw_options['response_headers'][3], 2 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"1"'); ?></option>
833	<option value="1"<?php selected( $nfw_options['response_headers'][3], 1 ) ?>><?php printf( __('Set to %s', 'ninjafirewall'), '"1; mode=block"') ?></option>
834	</select>
835	<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span><?php esc_html_e('This header is deprecated and most browsers phased out support for it. Consider using Content-Security-Policy instead.', 'ninjafirewall') ?></p>
836	</td>
837	</tr>
838	<tr>
839	<th scope="row" class="row-med"><?php printf( __('Force %s flag on all cookies to mitigate CSRF attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">SameSite</a>' ) ?></th>
840	<td>
841	<select name="nfw_options[cookies_samesite]" <?php disabled( $err, 1 ) ?>>
842	<option value="0"<?php selected( $nfw_options['response_headers'][9], 0 ) ?>><?php echo $no; ?></option>
843	<option value="1"<?php selected( $nfw_options['response_headers'][9], 1 ) ?>>SameSite=Lax</option>
844	<option value="2"<?php selected( $nfw_options['response_headers'][9], 2 ) ?>>SameSite=Strict</option>
845	</select>
846	</td>
847	</tr>
848	<tr>
849	<th scope="row" class="row-med"><?php printf( __('Force %s flag on all cookies to mitigate XSS attacks', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">HttpOnly</a>') ?></th>
850	<td>
851	<?php nfw_toggle_switch( 'info', 'nfw_options[cookies_httponly]', $yes, $no, 'small', $nfw_options['response_headers'][0], $err ) ?>
852	<p class="description"><?php _e('If your PHP scripts use cookies that need to be accessed from JavaScript, you should not enable this option.', 'ninjafirewall') ?></p>
853	</td>
854	</tr>
855	<?php
856	// We don't send HSTS headers over HTTP (only display this message if there
857	// is no other warning to display, $err==0 ):
858	$hsts_err = 0;
859	if ( NFW_IS_HTTPS == false && ! $err ) {
860	$hsts_err = 1;
861	$hsts_msg = __('HSTS headers can only be set when you are accessing your site over HTTPS.', 'ninjafirewall');
862	} else {
863	$hsts_msg = '';
864	$hsts_err = 0;
865	}
866	if ( $err == 1 ) { $hsts_err = 1; }
867	?>
868	<tr>
869	<th scope="row" class="row-med"><?php printf( __('Set %s (HSTS) to enforce secure connections to the server', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Strict-Transport-Security</a>') ?></th>
870	<td>
871	<select name="nfw_options[strict_transport]" <?php disabled( $hsts_err, 1 ) ?>>
872	<option value="0"<?php selected( $nfw_options['response_headers'][4], 0 ) ?>><?php echo $no; ?></option>
873	<option value="4"<?php selected( $nfw_options['response_headers'][4], 4 ) ?>><?php _e('Set "max-age" to 0', 'ninjafirewall') ?></option>
874	<option value="1"<?php selected( $nfw_options['response_headers'][4], 1 ) ?>><?php _e('1 month', 'ninjafirewall') ?></option>
875	<option value="2"<?php selected( $nfw_options['response_headers'][4], 2 ) ?>><?php _e('6 months', 'ninjafirewall') ?></option>
876	<option value="3"<?php selected( $nfw_options['response_headers'][4], 3 ) ?>><?php _e('1 year', 'ninjafirewall') ?></option>
877	<option value="5"<?php selected( $nfw_options['response_headers'][4], 5 ) ?>><?php _e('2 years', 'ninjafirewall') ?></option>
878	</select>
879	<?php
880	// includeSubDomains=1, preload=2, both=3
881	$preload = 0; $subdom = 0;
882	if ( $nfw_options['response_headers'][5] == 3 ) {
883	$preload = 1;
884	$subdom = 1;
885	} elseif ( $nfw_options['response_headers'][5] == 2 ) {
886	$preload = 1;
887	} elseif ( $nfw_options['response_headers'][5] == 1 ) {
888	$subdom = 1;
889	}
890	?>
891	<p><label><input type="checkbox" name="nfw_options[strict_transport_sub]" value="1"<?php checked( $subdom, 1 );disabled($hsts_err, 1) ?>> <?php _e('Apply to subdomains', 'ninjafirewall') ?></label>  <label><input type="checkbox" name="nfw_options[strict_transport_preload]" value="1"<?php checked( $preload, 1 );disabled($hsts_err, 1) ?>> <?php _e('Preload', 'ninjafirewall') ?></label></p>
892	<?php
893	if (! empty( $hsts_msg ) ) {
894	echo '<p class="description"><span class="dashicons dashicons-warning nfw-warning"></span>'. $hsts_msg .'</p>';
895	}
896	?>
897	</td>
898	</tr>
899
900	<?php
901	if (! isset( $nfw_options['csp_frontend_data'] ) ) {
902	$nfw_options['csp_frontend_data'] = '';
903	}
904	if (! isset( $nfw_options['csp_backend_data'] ) ) {
905	$nfw_options['csp_backend_data'] = '';
906	}
907	if (! isset( $nfw_options['response_headers'][6] ) ) {
908	$nfw_options['response_headers'][6] = 0;
909	}
910	if (! isset( $nfw_options['response_headers'][7] ) ) {
911	$nfw_options['response_headers'][7] = 0;
912	}
913	?>
914	<tr>
915	<th scope="row" class="row-med"><?php printf( __('Set %s for the website frontend', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Content-Security-Policy</a>') ?></th>
916	<td>
917	<?php nfw_toggle_switch( 'info', 'nfw_options[csp_frontend]', $yes, $no, 'small', $nfw_options['response_headers'][6], $err, 'onclick="nfwjs_csp_onoff(\'csp1_switch\',\'csp1\');"', 'csp1_switch' ) ?>
918	<br />
919	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[csp_frontend_data]" id="csp1" class="large-text code" rows="8"<?php wp_readonly( $err, 1 ); wp_readonly( $nfw_options['response_headers'][6], 0 ) ?>><?php echo htmlspecialchars( $nfw_options['csp_frontend_data'] ) ?></textarea>
920	<p class="description"><?php _e('This CSP header will apply to the website frontend only.', 'ninjafirewall') ?></p>
921	</td>
922	</tr>
923	<tr>
924	<th scope="row" class="row-med"><?php printf( __('Set %s for the WordPress admin dashboard', 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Content-Security-Policy</a>') ?></th>
925	<td>
926	<?php nfw_toggle_switch( 'info', 'nfw_options[csp_backend]', $yes, $no, 'small', $nfw_options['response_headers'][7], $err, 'onclick="nfwjs_csp_onoff(\'csp2_switch\',\'csp2\');"', 'csp2_switch' ) ?>
927	<br />
928	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[csp_backend_data]" id="csp2" class="large-text code" rows="8"<?php wp_readonly( $err, 1 ); wp_readonly( $nfw_options['response_headers'][7], 0 ) ?>><?php echo htmlspecialchars( $nfw_options['csp_backend_data'] ) ?></textarea>
929	<p class="description"><?php _e('This CSP header will apply to the WordPress admin dashboard only.', 'ninjafirewall') ?></p>
930	<?php echo $err_msg ?>
931	</td>
932	</tr>
933
934	<?php
935	if (! isset( $nfw_options['response_headers'][8] ) ) {
936	$nfw_options['response_headers'][8] = 0;
937	}
938	if ( empty( $nfw_options['referrer_policy_enabled'] ) ) {
939	$nfw_options['referrer_policy_enabled'] = 0;
940	} else {
941	$nfw_options['referrer_policy_enabled'] = 1;
942	}
943	?>
944	<tr>
945	<th scope="row"><?php printf( __("Set %s (Chrome, Opera and Firefox browsers)", 'ninjafirewall'), '<a href="https://blog.nintechnet.com/securing-wordpress-with-a-web-application-firewall-ninjafirewall/#advanced-policies" target="_blank" rel="noreferrer noopener">Referrer-Policy</a>') ?></th>
946	<td>
947	<?php nfw_toggle_switch( 'info', 'nfw_options[referrer_policy_enabled]', $yes, $no, 'small', $nfw_options['referrer_policy_enabled'], $err, 'onclick="nfwjs_referrer_onoff();"', 'referrer_switch' ) ?>
948	<br />
949	<select id="rp_select" name="nfw_options[referrer_policy]"<?php disabled($nfw_options['referrer_policy_enabled'], 0) ?>>
950	<option value="1"<?php selected($nfw_options['response_headers'][8], 1) ?>>no-referrer</option>
951	<option value="2"<?php selected($nfw_options['response_headers'][8], 2) ?>>no-referrer-when-downgrade</option>
952	<option value="3"<?php selected($nfw_options['response_headers'][8], 3) ?>>origin</option>
953	<option value="4"<?php selected($nfw_options['response_headers'][8], 4) ?>>origin-when-cross-origin</option>
954	<option value="5"<?php selected($nfw_options['response_headers'][8], 5) ?>>strict-origin</option>
955	<option value="6"<?php selected($nfw_options['response_headers'][8], 6) ?>>strict-origin-when-cross-origin</option>
956	<option value="7"<?php selected($nfw_options['response_headers'][8], 7) ?>>same-origin</option>
957	<option value="8"<?php selected($nfw_options['response_headers'][8], 8) ?>>unsafe-url</option>
958	</select>
959	</td>
960	</tr>
961
962	<?php
963	$custom_headers = '';
964	if (! empty( $nfw_options['custom_headers'] ) ) {
965	$headers = json_decode( $nfw_options['custom_headers'], true );
966	if (! empty( $headers ) ) {
967	foreach( $headers as $key => $value ) {
968	$custom_headers .= "$key: $value\n";
969	}
970	}
971	}
972	?>
973	<tr>
974	<th scope="row" class="row-med"><?php esc_html_e('Custom HTTP headers', 'ninjafirewall'); ?></th>
975	<td>
976	<textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="nfw_options[custom_headers]" class="large-text code" rows="8"><?php echo esc_textarea( $custom_headers ) ?></textarea>
977	<p class="description"><?php _e('You can enter one or more custom HTTP headers. The format is <code>header: value</code>, one per line.', 'ninjafirewall') ?></p>
978	</td>
979	</tr>
980
981	<tr>
982	<th scope="row" class="row-med"><?php esc_html_e('HTTP headers test', 'ninjafirewall'); ?></th>
983	<td>
984	<button type="button" class="button-secondary" onClick="nfwjs_test_headers('<?php echo esc_attr( home_url( '/' ) ) ?>');" /><?php esc_html_e('View your website\'s HTTP response headers', 'ninjafirewall' )?></button>
985
986	<img style="vertical-align:middle;display:none" id="progress-gif" src="<?php echo plugins_url('/images/progress.gif', dirname (__FILE__ ) ) ?>" />
987	<p class="description"><?php _e('Make sure to save your changes before running the test.', 'ninjafirewall') ?></p>
988	</td>
989	</tr>
990	</table>
991
992	<br /><br />
993
994	<?php
995	if ( empty( $nfw_rules[NFW_WRAPPERS]['ena']) ) {
996	$php_wrappers = 0;
997	} else {
998	$php_wrappers = 1;
999	}
1000	if ( empty( $nfw_options['php_errors']) ) {
1001	$php_errors = 0;
1002	} else {
1003	$php_errors = 1;
1004	}
1005	if ( empty( $nfw_options['php_self']) ) {
1006	$php_self = 0;
1007	} else {
1008	$php_self = 1;
1009	}
1010	if ( empty( $nfw_options['php_path_t']) ) {
1011	$php_path_t = 0;
1012	} else {
1013	$php_path_t = 1;
1014	}
1015	if ( empty( $nfw_options['php_path_i']) ) {
1016	$php_path_i = 0;
1017	} else {
1018	$php_path_i = 1;
1019	}
1020	if ( empty( $nfw_options['php_superglobals']) ) {
1021	$php_superglobals = 0;
1022	} else {
1023	$php_superglobals = 1;
1024	}
1025	?>
1026	<h3>PHP</h3>
1027	<table class="form-table nfw-table">
1028	<tr>
1029	<th scope="row" class="row-med"><?php _e('Block PHP built-in wrappers in <code>GET</code>, <code>POST</code>, <code>HTTP_USER_AGENT</code>, <code>HTTP_REFERER</code> and cookies', 'ninjafirewall') ?></th>
1030	<td>
1031	<?php nfw_toggle_switch( 'info', 'nfw_rules[php_wrappers]', $yes, $no, 'small', $php_wrappers ) ?>
1032	</td>
1033	</tr>
1034
1035	<?php
1036	if (! empty( $nfw_rules[NFW_OBJECTS]['ena'] ) ) {
1037	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'GET' ) !== FALSE) {
1038	$NFW_OBJECTS_GET = ' checked="checked"';
1039	} else {
1040	$NFW_OBJECTS_GET = '';
1041	}
1042	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'POST' ) !== FALSE) {
1043	$NFW_OBJECTS_POST = ' checked="checked"';
1044	} else {
1045	$NFW_OBJECTS_POST = '';
1046	}
1047	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'COOKIE' ) !== FALSE) {
1048	$NFW_OBJECTS_COOKIE = ' checked="checked"';
1049	} else {
1050	$NFW_OBJECTS_COOKIE = '';
1051	}
1052	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'HTTP_USER_AGENT' ) !== FALSE) {
1053	$NFW_OBJECTS_HTTP_USER_AGENT = ' checked="checked"';
1054	} else {
1055	$NFW_OBJECTS_HTTP_USER_AGENT = '';
1056	}
1057	if ( strpos( $nfw_rules[NFW_OBJECTS]['cha'][1]['whe'], 'HTTP_REFERER' ) !== FALSE) {
1058	$NFW_OBJECTS_HTTP_REFERER = ' checked="checked"';
1059	} else {
1060	$NFW_OBJECTS_HTTP_REFERER = '';
1061	}
1062	} else {
1063	$NFW_OBJECTS_GET = ''; $NFW_OBJECTS_POST = ''; $NFW_OBJECTS_COOKIE = '';
1064	$NFW_OBJECTS_HTTP_USER_AGENT = ''; $NFW_OBJECTS_HTTP_REFERER = '';
1065	}
1066	?>
1067	<tr>
1068	<th scope="row" class="row-mid"><?php _e('Block serialized PHP objects in the following global variables', 'ninjafirewall') ?></th>
1069	<td>
1070	<p><label><input type="checkbox" name="nfw_rules[php_objects_get]" value="1"<?php echo $NFW_OBJECTS_GET ?>><code>GET</code></label><p>
1071	<p><label><input type="checkbox" name="nfw_rules[php_objects_post]" value="1"<?php echo $NFW_OBJECTS_POST ?>><code>POST</code></label><p>
1072	<p><label><input type="checkbox" name="nfw_rules[php_objects_cookie]" value="1"<?php echo $NFW_OBJECTS_COOKIE ?>><code>COOKIE</code></label><p>
1073	<p><label><input type="checkbox" name="nfw_rules[php_objects_http_user_agent]" value="1"<?php echo $NFW_OBJECTS_HTTP_USER_AGENT ?>><code>HTTP_USER_AGENT</code></label><p>
1074	<p><label><input type="checkbox" name="nfw_rules[php_objects_http_referer]" value="1"<?php echo $NFW_OBJECTS_HTTP_REFERER ?>><code>HTTP_REFERER</code></label><p>
1075	</td>
1076	</tr>
1077	<tr>
1078	<th scope="row" class="row-mid"><?php _e('Block attempts to override PHP Superglobals', 'ninjafirewall') ?></th>
1079	<td>
1080	<?php nfw_toggle_switch( 'info', 'nfw_options[php_superglobals]', $yes, $no, 'small', $php_superglobals ) ?>
1081	</td>
1082	</tr>
1083	<tr>
1084	<th scope="row" class="row-mid"><?php _e('Hide PHP notice and error messages', 'ninjafirewall') ?></th>
1085	<td>
1086	<?php nfw_toggle_switch( 'info', 'nfw_options[php_errors]', $yes, $no, 'small', $php_errors ) ?>
1087	</td>
1088	</tr>
1089	<tr>
1090	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PHP_SELF</code>', 'ninjafirewall') ?></th>
1091	<td>
1092	<?php nfw_toggle_switch( 'info', 'nfw_options[php_self]', $yes, $no, 'small', $php_self ) ?>
1093	</td>
1094	</tr>
1095	<tr>
1096	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PATH_TRANSLATED</code>', 'ninjafirewall') ?></th>
1097	<td>
1098	<?php nfw_toggle_switch( 'info', 'nfw_options[php_path_t]', $yes, $no, 'small', $php_path_t ) ?>
1099	</td>
1100	</tr>
1101	<tr>
1102	<th scope="row" class="row-mid"><?php _e('Sanitise <code>PATH_INFO</code>', 'ninjafirewall') ?></th>
1103	<td>
1104	<?php nfw_toggle_switch( 'info', 'nfw_options[php_path_i]', $yes, $no, 'small', $php_path_i ) ?>
1105	</td>
1106	</tr>
1107	</table>
1108
1109	<br /><br />
1110
1111	<?php
1112	// If the document root is < 5 characters, disable the option
1113	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) < 5 ) {
1114	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1115	$disabled_msg = '<p class="description">' .
1116	__('This option is not compatible with your actual configuration.', 'ninjafirewall') .
1117	'</p>';
1118	} else {
1119	$disabled_msg = '';
1120	}
1121
1122	if ( empty( $nfw_rules[NFW_DOC_ROOT]['ena']) ) {
1123	$block_doc_root = 0;
1124	} else {
1125	$block_doc_root = 1;
1126	}
1127	if ( empty( $nfw_rules[NFW_NULL_BYTE]['ena']) ) {
1128	$block_null_byte = 0;
1129	} else {
1130	$block_null_byte = 1;
1131	}
1132	if ( empty( $nfw_rules[NFW_ASCII_CTRL]['ena']) ) {
1133	$block_ctrl_chars = 0;
1134	} else {
1135	$block_ctrl_chars = 1;
1136	}
1137	?>
1138	<h3><?php _e('Various', 'ninjafirewall') ?></h3>
1139	<table class="form-table nfw-table">
1140	<tr>
1141	<th scope="row" class="row-med"><?php _e('Block the <code>DOCUMENT_ROOT</code> server variable in HTTP request', 'ninjafirewall') ?></th>
1142	<td>
1143	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_doc_root]', $yes, $no, 'small', $block_doc_root ) ?>
1144	<?php echo $disabled_msg ?>
1145	</td>
1146	</tr>
1147	<tr>
1148	<th scope="row" class="row-med"><?php _e('Block ASCII character 0x00 (NULL byte)', 'ninjafirewall') ?></th>
1149	<td>
1150	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_null_byte]', $yes, $no, 'small', $block_null_byte ) ?>
1151	</td>
1152	</tr>
1153	<tr>
1154	<th scope="row" class="row-med"><?php _e('Block ASCII control characters 1 to 8 and 14 to 31', 'ninjafirewall') ?></th>
1155	<td>
1156	<?php nfw_toggle_switch( 'info', 'nfw_rules[block_ctrl_chars]', $yes, $no, 'small', $block_ctrl_chars ) ?>
1157	</td>
1158	</tr>
1159	</table>
1160
1161	</div>
1162
1163	<br />
1164	<br />
1165
1166	<input type="hidden" name="tab" id="tab-selected" value="<?php echo htmlspecialchars( $_REQUEST['tab'] ) ?>" />
1167	<input class="button-primary" type="submit" name="Save" value="<?php _e('Save Firewall Policies', 'ninjafirewall') ?>" />
1168
1169	<input class="button-secondary" type="submit" name="Default" value="<?php _e('Restore Default Values', 'ninjafirewall') ?>" onclick="return nfwjs_restore_default();" />
1170	</form>
1171	</div>
1172
1173	<?php
1174
1175	// ---------------------------------------------------------------------
1176	// Save firewall policies.
1177
1178	function nf_sub_policies_save() {
1179
1180	nf_not_allowed( 'block', __LINE__ );
1181
1182	$nfw_options = nfw_get_option( 'nfw_options' );
1183	$nfw_rules = nfw_get_option( 'nfw_rules' );
1184
1185	if ( (isset( $_POST['nfw_options']['scan_protocol'])) &&
1186	( preg_match( '/^[123]$/', $_POST['nfw_options']['scan_protocol'])) ) {
1187	$nfw_options['scan_protocol'] = $_POST['nfw_options']['scan_protocol'];
1188	} else {
1189	$nfw_options['scan_protocol'] = 3;
1190	}
1191
1192	if ( empty( $_POST['nfw_options']['uploads']) ) {
1193	$nfw_options['uploads'] = 0;
1194	} else {
1195	$nfw_options['uploads'] = 1;
1196	}
1197
1198	if ( (isset( $_POST['nfw_options']['sanitise_fn']) ) && ( $nfw_options['uploads'] == 1) ) {
1199	$nfw_options['sanitise_fn'] = 1;
1200	} else {
1201	$nfw_options['sanitise_fn'] = 0;
1202	}
1203	// Substitution character:
1204	// Don't allow the '/' character:
1205	if ( empty( $_POST['nfw_options']['substitute'] ) \|\| strlen( $_POST['nfw_options']['substitute'] ) > 1 \|\| $_POST['nfw_options']['substitute'] == '/' ) {
1206	$nfw_options['substitute'] = 'X';
1207	} else {
1208	$nfw_options['substitute'] = $_POST['nfw_options']['substitute'];
1209	}
1210
1211
1212	if ( empty( $_POST['nfw_options']['get_scan']) ) {
1213	$nfw_options['get_scan'] = 0;
1214	} else {
1215	$nfw_options['get_scan'] = 1;
1216	}
1217	if ( empty( $_POST['nfw_options']['get_sanitise']) ) {
1218	$nfw_options['get_sanitise'] = 0;
1219	} else {
1220	$nfw_options['get_sanitise'] = 1;
1221	}
1222
1223
1224	if ( empty( $_POST['nfw_options']['post_scan']) ) {
1225	$nfw_options['post_scan'] = 0;
1226	} else {
1227	$nfw_options['post_scan'] = 1;
1228	}
1229	if ( empty( $_POST['nfw_options']['post_b64']) ) {
1230	$nfw_options['post_b64'] = 0;
1231	} else {
1232	$nfw_options['post_b64'] = 1;
1233	}
1234
1235
1236	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
1237	$nfw_options['response_headers'] = '0000000000';
1238	$nfw_options['csp_frontend_data'] = '';
1239	$nfw_options['csp_backend_data'] = '';
1240	if ( empty( $_POST['nfw_options']['x_content_type_options']) ) {
1241	$nfw_options['response_headers'][1] = 0;
1242	} else {
1243	$nfw_options['response_headers'][1] = 1;
1244	}
1245	if ( empty( $_POST['nfw_options']['x_frame_options']) ) {
1246	$nfw_options['response_headers'][2] = 0;
1247	} elseif ( $_POST['nfw_options']['x_frame_options'] == 1) {
1248	$nfw_options['response_headers'][2] = 1;
1249	} else {
1250	$nfw_options['response_headers'][2] = 2;
1251	}
1252	// XSS filter:
1253	// 0 = 0
1254	// 1 = 1; mode=block
1255	// 2 = 1
1256	// 3 = unset
1257	if ( empty( $_POST['nfw_options']['x_xss_protection'] ) ) {
1258	$nfw_options['response_headers'][3] = 0;
1259	} elseif ( $_POST['nfw_options']['x_xss_protection'] == 1 ) {
1260	$nfw_options['response_headers'][3] = 1;
1261	} elseif ( $_POST['nfw_options']['x_xss_protection'] == 2 ) {
1262	$nfw_options['response_headers'][3] = 2;
1263	} else {
1264	$nfw_options['response_headers'][3] = 3;
1265	}
1266
1267	if ( empty( $_POST['nfw_options']['cookies_httponly']) ) {
1268	$nfw_options['response_headers'][0] = 0;
1269	} else {
1270	$nfw_options['response_headers'][0] = 1;
1271	}
1272	// SameSite cookie
1273	if ( empty( $_POST['nfw_options']['cookies_samesite'] ) ) {
1274	$nfw_options['response_headers'][9] = 0;
1275	} elseif ( $_POST['nfw_options']['cookies_samesite'] == 1 ) {
1276	$nfw_options['response_headers'][9] = 1;
1277	} elseif ( $_POST['nfw_options']['cookies_samesite'] == 2 ) {
1278	$nfw_options['response_headers'][9] = 2;
1279	}
1280
1281	// Strict-Transport-Security
1282
1283	// includeSubDomains=1, preload=2, both=3
1284	$rs5 = 0;
1285	if ( isset( $_POST['nfw_options']['strict_transport_sub'] ) ) {
1286	$rs5 = 1;
1287	}
1288	if ( isset( $_POST['nfw_options']['strict_transport_preload'] ) ) {
1289	$rs5 += 2;
1290	}
1291	$nfw_options['response_headers'][5] = $rs5;
1292
1293	if ( empty( $_POST['nfw_options']['strict_transport'] ) ) {
1294	$nfw_options['response_headers'][4] = 0;
1295	$nfw_options['response_headers'][5] = 0;
1296	} elseif ( $_POST['nfw_options']['strict_transport'] == 1) {
1297	$nfw_options['response_headers'][4] = 1;
1298	} elseif ( $_POST['nfw_options']['strict_transport'] == 2) {
1299	$nfw_options['response_headers'][4] = 2;
1300	} elseif ( $_POST['nfw_options']['strict_transport'] == 3) {
1301	$nfw_options['response_headers'][4] = 3;
1302	} elseif ( $_POST['nfw_options']['strict_transport'] == 4) {
1303	$nfw_options['response_headers'][4] = 4;
1304	} else {
1305	$nfw_options['response_headers'][4] = 5;
1306	}
1307
1308
1309	$nfw_options['csp_frontend_data'] = stripslashes( str_replace( array( '<', '>', "\x0a", "\x0d", '%', '$', '&') , '', $_POST['nfw_options']['csp_frontend_data'] ) );
1310	if ( empty( $_POST['nfw_options']['csp_frontend']) \|\| empty( $nfw_options['csp_frontend_data'] ) ) {
1311	$nfw_options['response_headers'][6] = 0;
1312	} else {
1313	$nfw_options['response_headers'][6] = 1;
1314	}
1315	$nfw_options['csp_backend_data'] = stripslashes( str_replace( array( '<', '>', "\x0a", "\x0d", '%', '$', '&') , '', $_POST['nfw_options']['csp_backend_data'] ) );
1316	if ( empty( $_POST['nfw_options']['csp_backend']) \|\| empty( $nfw_options['csp_backend_data'] ) ) {
1317	$nfw_options['response_headers'][7] = 0;
1318	} else {
1319	$nfw_options['response_headers'][7] = 1;
1320	}
1321	if ( empty( $_POST['nfw_options']['referrer_policy_enabled'] ) ) {
1322	$nfw_options['referrer_policy_enabled'] = 0;
1323	$_POST['nfw_options']['referrer_policy'] = 0;
1324	} else {
1325	$nfw_options['referrer_policy_enabled'] = 1;
1326	}
1327
1328	if ( empty( $_POST['nfw_options']['referrer_policy'] ) \|\| ! preg_match('/^[1-8]$/', $_POST['nfw_options']['referrer_policy'] ) ) {
1329	$nfw_options['response_headers'][8] = 0;
1330	$nfw_options['referrer_policy_enabled'] = 0;
1331	} else {
1332	$nfw_options['response_headers'][8] = (int)$_POST['nfw_options']['referrer_policy'];
1333	}
1334	}
1335
1336	/**
1337	* Custom HTTP headers.
1338	*/
1339	$custom_headers = [];
1340	if (! empty( $_POST['nfw_options']['custom_headers'] ) ) {
1341	$headers = explode( "\r\n", stripslashes( $_POST['nfw_options']['custom_headers'] ) );
1342	if (! empty( $headers[0] ) ) {
1343	foreach( $headers as $header ) {
1344	if ( empty( $header ) \|\| strpos( $header, ':') === false ) {
1345	continue;
1346	}
1347	list( $key, $value ) = explode(':', $header, 2 );
1348	/**
1349	* Lowercase key name.
1350	*/
1351	$key = strtolower( trim( $key ) );
1352	$value = trim( $value );
1353	if (! empty( $key ) && ! empty( $value ) ) {
1354	$custom_headers[ $key ] = $value;
1355	}
1356	}
1357	}
1358	}
1359	if (! empty( $custom_headers ) ) {
1360	$nfw_options['custom_headers'] = json_encode( $custom_headers );
1361	} else {
1362	unset ( $nfw_options['custom_headers'] );
1363	}
1364
1365	if ( empty( $_POST['nfw_options']['cookies_scan']) ) {
1366	$nfw_options['cookies_scan'] = 0;
1367	} else {
1368	$nfw_options['cookies_scan'] = 1;
1369	}
1370	if ( empty( $_POST['nfw_options']['cookies_sanitise']) ) {
1371	$nfw_options['cookies_sanitise'] = 0;
1372	} else {
1373	$nfw_options['cookies_sanitise'] = 1;
1374	}
1375
1376
1377	if ( empty( $_POST['nfw_options']['ua_scan']) ) {
1378	$nfw_options['ua_scan'] = 0;
1379	} else {
1380	$nfw_options['ua_scan'] = 1;
1381	}
1382	if ( empty( $_POST['nfw_options']['ua_sanitise']) ) {
1383	$nfw_options['ua_sanitise'] = 0;
1384	} else {
1385	$nfw_options['ua_sanitise'] = 1;
1386	}
1387
1388
1389	if ( empty( $_POST['nfw_options']['referer_scan']) ) {
1390	$nfw_options['referer_scan'] = 0;
1391	} else {
1392	$nfw_options['referer_scan'] = 1;
1393	}
1394	if ( empty( $_POST['nfw_options']['referer_sanitise']) ) {
1395	$nfw_options['referer_sanitise'] = 0;
1396	} else {
1397	$nfw_options['referer_sanitise'] = 1;
1398	}
1399	if ( empty( $_POST['nfw_options']['referer_post']) ) {
1400	$nfw_options['referer_post'] = 0;
1401	} else {
1402	$nfw_options['referer_post'] = 1;
1403	}
1404
1405
1406	if ( empty( $_POST['nfw_options']['no_host_ip']) ) {
1407	$nfw_options['no_host_ip'] = 0;
1408	} else {
1409	$nfw_options['no_host_ip'] = 1;
1410	}
1411	if ( empty( $_POST['nfw_options']['allow_local_ip']) ) {
1412	$nfw_options['allow_local_ip'] = 0;
1413	} else {
1414	$nfw_options['allow_local_ip'] = 1;
1415	}
1416
1417
1418	if ( empty( $_POST['nfw_options']['php_errors']) ) {
1419	$nfw_options['php_errors'] = 0;
1420	} else {
1421	$nfw_options['php_errors'] = 1;
1422	}
1423
1424	if ( empty( $_POST['nfw_options']['php_self']) ) {
1425	$nfw_options['php_self'] = 0;
1426	} else {
1427	$nfw_options['php_self'] = 1;
1428	}
1429	if ( empty( $_POST['nfw_options']['php_path_t']) ) {
1430	$nfw_options['php_path_t'] = 0;
1431	} else {
1432	$nfw_options['php_path_t'] = 1;
1433	}
1434	if ( empty( $_POST['nfw_options']['php_path_i']) ) {
1435	$nfw_options['php_path_i'] = 0;
1436	} else {
1437	$nfw_options['php_path_i'] = 1;
1438	}
1439	// Superglobals override
1440	if ( empty( $_POST['nfw_options']['php_superglobals']) ) {
1441	$nfw_options['php_superglobals'] = 0;
1442	} else {
1443	$nfw_options['php_superglobals'] = 1;
1444	}
1445
1446	// We change those policies only if we're in Full WAF mode
1447	if (! defined( 'NFW_WPWAF' ) ) {
1448	$nfw_options['wp_dir'] = ''; $tmp = '';
1449	if ( isset( $_POST['nfw_options']['wp_admin']) ) {
1450	$tmp .= '/wp-admin/(?:css\|images\|includes\|js)/\|';
1451	}
1452	if ( isset( $_POST['nfw_options']['wp_inc']) ) {
1453	$tmp .= '/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|';
1454	}
1455	if ( isset( $_POST['nfw_options']['wp_upl']) ) {
1456	$tmp .= '/' . basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/\|';
1457	}
1458	if ( isset( $_POST['nfw_options']['wp_cache']) ) {
1459	$tmp .= '/cache/\|';
1460	}
1461	if ( $tmp ) {
1462	$nfw_options['wp_dir'] = rtrim( $tmp, '\|' );
1463	}
1464	}
1465
1466	if (! isset( $_POST['nfw_options']['disallow_creation']) ) {
1467	$nfw_options['disallow_creation'] = 0;
1468	} else {
1469	$nfw_options['disallow_creation'] = 1;
1470	}
1471	if (! isset( $_POST['nfw_options']['disallow_deletion']) ) {
1472	$nfw_options['disallow_deletion'] = 0;
1473	} else {
1474	$nfw_options['disallow_deletion'] = 1;
1475	}
1476	if (! isset( $_POST['nfw_options']['disallow_settings']) ) {
1477	$nfw_options['disallow_settings'] = 0;
1478	} else {
1479	$nfw_options['disallow_settings'] = 1;
1480	}
1481	if (! isset( $_POST['nfw_options']['disallow_privesc']) ) {
1482	$nfw_options['disallow_privesc'] = 0;
1483	} else {
1484	$nfw_options['disallow_privesc'] = 1;
1485	}
1486	if (! isset( $_POST['nfw_options']['disallow_privesc_mu']) ) {
1487	$nfw_options['disallow_privesc_mu'] = 0;
1488	} else {
1489	$nfw_options['disallow_privesc_mu'] = 1;
1490	}
1491	if (! isset( $_POST['nfw_options']['disallow_publish']) ) {
1492	$nfw_options['disallow_publish'] = 0;
1493	} else {
1494	$nfw_options['disallow_publish'] = 1;
1495	}
1496
1497	if (! isset( $_POST['nfw_options']['enum_archives']) ) {
1498	$nfw_options['enum_archives'] = 0;
1499	} else {
1500	$nfw_options['enum_archives'] = 1;
1501	}
1502	if (! isset( $_POST['nfw_options']['enum_sitemap']) ) {
1503	$nfw_options['enum_sitemap'] = 0;
1504	} else {
1505	$nfw_options['enum_sitemap'] = 1;
1506	}
1507	if (! isset( $_POST['nfw_options']['enum_login']) ) {
1508	$nfw_options['enum_login'] = 0;
1509	} else {
1510	$nfw_options['enum_login'] = 1;
1511	}
1512	if (! isset( $_POST['nfw_options']['admin_ajax']) ) {
1513	$nfw_options['admin_ajax'] = 0;
1514	} else {
1515	$nfw_options['admin_ajax'] = 1;
1516	}
1517	if (! isset( $_POST['nfw_options']['enum_restapi']) ) {
1518	$nfw_options['enum_restapi'] = 0;
1519	} else {
1520	$nfw_options['enum_restapi'] = 1;
1521	}
1522	if (! isset( $_POST['nfw_options']['enum_feed']) ) {
1523	$nfw_options['enum_feed'] = 0;
1524	} else {
1525	$nfw_options['enum_feed'] = 1;
1526	}
1527	if (! isset( $_POST['nfw_options']['no_restapi']) ) {
1528	$nfw_options['no_restapi'] = 0;
1529	} else {
1530	$nfw_options['no_restapi'] = 1;
1531	}
1532	if (! isset( $_POST['nfw_options']['restapi_loggedin']) \|\| $nfw_options['no_restapi'] == 0 ) {
1533	$nfw_options['restapi_loggedin'] = 0;
1534	} else {
1535	$nfw_options['restapi_loggedin'] = 1;
1536	}
1537	if (! isset( $_POST['nfw_options']['no_appswd']) ) {
1538	$nfw_options['no_appswd'] = 0;
1539	} else {
1540	$nfw_options['no_appswd'] = 1;
1541	}
1542
1543	if ( empty( $_POST['nfw_options']['no_xmlrpc']) ) {
1544	$nfw_options['no_xmlrpc'] = 0;
1545	} else {
1546	$nfw_options['no_xmlrpc'] = 1;
1547	$_POST['nfw_options']['no_xmlrpc_multi'] = 0;
1548	$_POST['nfw_options']['no_xmlrpc_pingback'] = 0;
1549	}
1550	if ( empty( $_POST['nfw_options']['no_xmlrpc_multi']) ) {
1551	$nfw_options['no_xmlrpc_multi'] = 0;
1552	} else {
1553	$nfw_options['no_xmlrpc_multi'] = 1;
1554	}
1555	if ( empty( $_POST['nfw_options']['no_xmlrpc_pingback']) ) {
1556	$nfw_options['no_xmlrpc_pingback'] = 0;
1557	} else {
1558	$nfw_options['no_xmlrpc_pingback'] = 1;
1559	}
1560
1561	if ( empty( $_POST['nfw_options']['no_post_themes']) ) {
1562	$nfw_options['no_post_themes'] = 0;
1563	} else {
1564	$nfw_options['no_post_themes'] = '/'. basename(WP_CONTENT_DIR) .'/themes/';
1565	}
1566
1567	if ( empty( $_POST['nfw_options']['force_ssl']) ) {
1568	$nfw_options['force_ssl'] = 0;
1569	} else {
1570	$nfw_options['force_ssl'] = 1;
1571	}
1572
1573	if ( empty( $_POST['nfw_options']['disallow_edit']) ) {
1574	$nfw_options['disallow_edit'] = 0;
1575	} else {
1576	$nfw_options['disallow_edit'] = 1;
1577	}
1578
1579	if ( empty( $_POST['nfw_options']['disable_error_handler']) ) {
1580	$nfw_options['disable_error_handler'] = 0;
1581	} else {
1582	$nfw_options['disable_error_handler'] = 1;
1583	}
1584
1585	if ( empty( $_POST['nfw_options']['disallow_mods']) ) {
1586	$nfw_options['disallow_mods'] = 0;
1587	} else {
1588	$nfw_options['disallow_mods'] = 1;
1589	}
1590
1591	if ( empty( $_POST['nfw_options']['wl_admin'] ) ) {
1592	$nfw_options['wl_admin'] = 0;
1593	NinjaFirewall_session::delete('nfw_goodguy');
1594
1595	} else {
1596	if ( $_POST['nfw_options']['wl_admin'] == 2 ) {
1597	$nfw_options['wl_admin'] = 2;
1598	} else {
1599	$nfw_options['wl_admin'] = 1;
1600	}
1601	NinjaFirewall_session::write( ['nfw_goodguy' => true ] );
1602	}
1603
1604	if ( empty( $_POST['nfw_rules']['block_null_byte']) ) {
1605	$nfw_rules[NFW_NULL_BYTE]['ena'] = 0;
1606	} else {
1607	$nfw_rules[NFW_NULL_BYTE]['ena'] = 1;
1608	}
1609	if ( empty( $_POST['nfw_rules']['block_bots']) ) {
1610	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 0;
1611	} else {
1612	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 1;
1613	}
1614	if ( empty( $_POST['nfw_rules']['block_ctrl_chars']) ) {
1615	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 0;
1616	} else {
1617	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 1;
1618	}
1619
1620
1621	if ( empty( $_POST['nfw_rules']['block_doc_root']) ) {
1622	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1623	} else {
1624
1625	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
1626	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
1627	$nfw_rules[NFW_DOC_ROOT]['ena'] = 1;
1628	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
1629	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
1630	$nfw_rules[NFW_DOC_ROOT]['ena'] = 1;
1631	} else {
1632	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1633	}
1634	}
1635
1636
1637	if ( empty( $_POST['nfw_rules']['php_wrappers']) ) {
1638	$nfw_rules[NFW_WRAPPERS]['ena'] = 0;
1639	} else {
1640	$nfw_rules[NFW_WRAPPERS]['ena'] = 1;
1641	}
1642
1643
1644	$nfw_objects = '';
1645	if (! empty( $_POST['nfw_rules']['php_objects_get'] ) ) {
1646	$nfw_objects .= "GET\|";
1647	}
1648	if (! empty( $_POST['nfw_rules']['php_objects_post'] ) ) {
1649	$nfw_objects .= "POST\|";
1650	}
1651	if (! empty( $_POST['nfw_rules']['php_objects_cookie'] ) ) {
1652	$nfw_objects .= "COOKIE\|";
1653	}
1654	if (! empty( $_POST['nfw_rules']['php_objects_http_user_agent'] ) ) {
1655	$nfw_objects .= "SERVER:HTTP_USER_AGENT\|";
1656	}
1657	if (! empty( $_POST['nfw_rules']['php_objects_http_referer'] ) ) {
1658	$nfw_objects .= "SERVER:HTTP_REFERER\|";
1659	}
1660	if (! empty( $nfw_objects ) ) {
1661	$nfw_objects = rtrim( $nfw_objects, '\|' );
1662	$nfw_rules[NFW_OBJECTS]['ena'] = 1;
1663	} else {
1664	// Disable rule:
1665	$nfw_rules[NFW_OBJECTS]['ena'] = 0;
1666	}
1667	$nfw_rules[NFW_OBJECTS]['cha'][1]['whe'] = $nfw_objects;
1668
1669
1670	if ( empty( $_POST['nfw_rules']['no_localhost_ip']) ) {
1671	$nfw_rules[NFW_LOOPBACK]['ena'] = 0;
1672	} else {
1673	$nfw_rules[NFW_LOOPBACK]['ena'] = 1;
1674	}
1675
1676	nfw_update_option( 'nfw_options', $nfw_options );
1677	nfw_update_option( 'nfw_rules', $nfw_rules );
1678
1679	}
1680
1681	// ---------------------------------------------------------------------
1682	// Restore default firewall policies.
1683
1684	function nf_sub_policies_default() {
1685
1686	nf_not_allowed( 'block', __LINE__ );
1687
1688	$nfw_options = nfw_get_option( 'nfw_options' );
1689	$nfw_rules = nfw_get_option( 'nfw_rules' );
1690
1691	$nfw_options['scan_protocol'] = 3;
1692	$nfw_options['uploads'] = 1;
1693	$nfw_options['sanitise_fn'] = 0;
1694	$nfw_options['substitute'] = 'X';
1695	$nfw_options['get_scan'] = 1;
1696	$nfw_options['get_sanitise'] = 0;
1697	$nfw_options['post_scan'] = 1;
1698	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
1699	$nfw_options['response_headers'] = '0003000000';
1700	$nfw_options['referrer_policy_enabled'] = 0;
1701	// We unset it, so that a default sample line will be displayed:
1702	unset( $nfw_options['csp_backend_data'] );
1703	$nfw_options['csp_frontend_data'] = '';
1704	}
1705	$nfw_options['custom_headers'] = '';
1706	$nfw_options['cookies_scan'] = 1;
1707	$nfw_options['cookies_sanitise'] = 0;
1708	$nfw_options['ua_scan'] = 1;
1709	$nfw_options['ua_sanitise'] = 1;
1710	$nfw_options['referer_scan'] = 0;
1711	$nfw_options['referer_sanitise'] = 1;
1712	$nfw_options['referer_post'] = 0;
1713	$nfw_options['no_host_ip'] = 0;
1714	$nfw_options['allow_local_ip'] = 1; // 1 == no !
1715	$nfw_options['php_superglobals'] = 1;
1716	$nfw_options['php_errors'] = 1;
1717	$nfw_options['php_self'] = 1;
1718	$nfw_options['php_path_t'] = 1;
1719	$nfw_options['php_path_i'] = 1;
1720	$nfw_options['wp_dir'] = '/wp-admin/(?:css\|images\|includes\|js)/\|' .
1721	'/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|' .
1722	'/'. basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/';
1723	$nfw_options['disallow_creation']= 0;
1724	$nfw_options['disallow_deletion']= 0;
1725	$nfw_options['disallow_settings']= 1;
1726	$nfw_options['disallow_privesc'] = 1;
1727	$nfw_options['disallow_privesc_mu'] = 0;
1728	$nfw_options['disallow_publish'] = 0;
1729	$nfw_options['enum_archives'] = 0;
1730	$nfw_options['enum_sitemap'] = 0;
1731	$nfw_options['enum_login'] = 0;
1732	$nfw_options['admin_ajax'] = 0;
1733	$nfw_options['enum_restapi'] = 0;
1734	$nfw_options['enum_feed'] = 0;
1735	$nfw_options['no_restapi'] = 0;
1736	$nfw_options['restapi_loggedin'] = 0;
1737	$nfw_options['no_appswd'] = 0;
1738	$nfw_options['no_xmlrpc'] = 0;
1739	$nfw_options['no_xmlrpc_multi'] = 0;
1740	$nfw_options['no_xmlrpc_pingback']= 0;
1741	$nfw_options['no_post_themes'] = 0;
1742	$nfw_options['force_ssl'] = 0;
1743	$nfw_options['disallow_edit'] = 0;
1744	$nfw_options['disable_error_handler'] = 0;
1745	$nfw_options['disallow_mods'] = 0;
1746	$nfw_options['post_b64'] = 1;
1747	$nfw_options['wl_admin'] = 1;
1748
1749	NinjaFirewall_session::write( ['nfw_goodguy' => true ] );
1750
1751	$nfw_rules[NFW_SCAN_BOTS]['ena'] = 1;
1752	$nfw_rules[NFW_LOOPBACK]['ena'] = 1;
1753	$nfw_rules[NFW_WRAPPERS]['ena'] = 1;
1754
1755	$nfw_rules[NFW_OBJECTS]['ena'] = 1;
1756	$nfw_rules[NFW_OBJECTS]['cha'][1]['whe'] = 'GET\|POST\|SERVER:HTTP_USER_AGENT\|SERVER:HTTP_REFERER';
1757
1758	// Create but disable the rule by default
1759	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
1760	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
1761	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
1762	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
1763	}
1764	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
1765
1766
1767	$nfw_rules[NFW_NULL_BYTE]['ena'] = 1;
1768	$nfw_rules[NFW_ASCII_CTRL]['ena'] = 0;
1769
1770	nfw_update_option( 'nfw_options', $nfw_options);
1771	nfw_update_option( 'nfw_rules', $nfw_rules);
1772
1773	}
1774
1775	// ---------------------------------------------------------------------
1776	// EOF
1777