csp-src.inc.php
2.68 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
<?php
$origins = array(
'wildcard' => '*',
'self' => "'self'",
'none' => "'none'",
'unsafe-inline' => "'unsafe-inline'",
'unsafe-eval' => "'unsafe-eval'",
'strict-dynamic' => "'strict-dynamic'",
'report-sample' => "'report-sample'",
'http' => 'http:',
'https' => 'https:',
'data' => 'data:',
'mediastream' => 'mediastream:',
'blob' => 'blob:',
'filesystem' => 'filesystem:',
);
foreach ($origins as $k => $origin)
{
?>
<p<?php echo $origin == '*' || !isset($csp_value[$item]['*']) ? NULL : ' style="display: none"'; ?>>
<input type="checkbox"
name="hh_content_security_policy_value[<?php echo $item; ?>][<?php echo $origin; ?>]"
id="csp-<?php echo $item; ?>-<?php echo $k; ?>"
value="1"<?php echo isset($csp_value[$item][$origin]) ? ' checked' : NULL; ?>
class="http-header-value"<?php echo $content_security_policy == 1 ? NULL : ' readonly'; ?>>
<label for="csp-<?php echo $item; ?>-<?php echo $k; ?>"><?php echo $origin; ?></label>
</p>
<?php
}
switch ($item) {
case 'script-src':
$host_sources = array(
'js.example.com',
'http://js.example.com',
'https://js.example.com',
);
break;
case 'style-src':
$host_sources = array(
'css.example.com',
'http://css.example.com',
'https://css.example.com',
);
break;
case 'img-src':
$host_sources = array(
'img.example.com',
'http://img.example.com',
'https://img.example.com',
);
break;
case 'font-src':
$host_sources = array(
'font.example.com',
'http://font.example.com',
'https://font.example.com',
);
break;
case 'default-src':
$host_sources = array(
'http://*.example.com',
'mail.example.com:443',
'https://assets.example.com',
'cdn.example.com',
);
break;
default:
$host_sources = array(
'https://store.example.com',
'store.example.com',
'*.example.com',
);
}
shuffle($host_sources);
?>
<p<?php echo !isset($csp_value[$item]['*']) ? NULL : ' style="display: none"'; ?>>
<input type="text"
name="hh_content_security_policy_value[<?php echo $item; ?>][source]"
class="http-header-value"
size="40"
placeholder="<?php echo $host_sources[0]; ?>"
value="<?php echo esc_attr(@$csp_value[$item]['source']); ?>"<?php echo $content_security_policy == 1 ? NULL : ' readonly'; ?>
</p>