Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
MDL-68820 web: Added referrer policy header setting
  • Loading branch information
Peterburnett committed Jun 3, 2020
1 parent 111b293 commit b4623c8
Show file tree
Hide file tree
Showing 3 changed files with 25 additions and 0 deletions.
17 changes: 17 additions & 0 deletions admin/settings/security.php
Expand Up @@ -160,6 +160,23 @@
$temp->add(new admin_setting_configportlist('curlsecurityallowedport',
new lang_string('curlsecurityallowedport', 'admin'),
new lang_string('curlsecurityallowedportsyntax', 'admin'), ""));

// HTTP Header referrer policy settings.
$referreroptions = [
'default' => get_string('referrernone', 'admin'),
'no-referrer' => 'no-referrer',
'no-referrer-when-downgrade' => 'no-referrer-when-downgrade',
'origin' => 'origin',
'origin-when-cross-origin' => 'origin-when-cross-origin',
'same-origin' => 'same-origin',
'strict-origin' => 'strict-origin',
'strict-origin-when-cross-origin' => 'strict-origin-when-cross-origin',
'unsafe-url' => 'unsafe-url',
];
$temp->add(new admin_setting_configselect('referrerpolicy',
new lang_string('referrerpolicy', 'admin'),
new lang_string('referrerpolicydesc', 'admin'), 'default', $referreroptions));

$ADMIN->add('security', $temp);

// "notifications" settingpage
Expand Down
3 changes: 3 additions & 0 deletions lang/en/admin.php
Expand Up @@ -1068,6 +1068,9 @@
$string['purgeselectedcachesfinished'] = 'The selected caches were purged.';
$string['purgetemplates'] = 'Templates';
$string['purgethemecache'] = 'Themes';
$string['referrernone'] = 'Browser default';
$string['referrerpolicy'] = 'Referrer policy';
$string['referrerpolicydesc'] = 'Set the referrer policy header to be included with responses from your site.';
$string['restorecourse'] = 'Restore course';
$string['restorernewroleid'] = 'Restorers\' role in courses';
$string['restorernewroleid_help'] = 'If the user does not already have the permission to manage the newly restored course, the user is automatically assigned this role and enrolled if necessary. Select "None" if you do not want restorers to be able to manage every restored course.';
Expand Down
5 changes: 5 additions & 0 deletions lib/weblib.php
Expand Up @@ -2285,6 +2285,11 @@ function send_headers($contenttype, $cacheable = true) {
if (empty($CFG->allowframembedding) && !core_useragent::is_moodle_app()) {
@header('X-Frame-Options: sameorigin');
}

// If referrer policy is set, add a referrer header.
if (!empty($CFG->referrerpolicy) && ($CFG->referrerpolicy !== 'default')) {
@header('Referrer-Policy: ' . $CFG->referrerpolicy);
}
}

/**
Expand Down

0 comments on commit b4623c8

Please sign in to comment.