rev. 32 To add http headers (security headers)

Two sets of headers: common and secury.
forkbb · Jan 9, 2021 · 3708d0d · 3708d0d
1 parent 683e5a8
commit 3708d0d
Show file tree

Hide file tree

Showing 3 changed files with 54 additions and 1 deletion.
diff --git a/app/Models/Pages/Admin/Update.php b/app/Models/Pages/Admin/Update.php
@@ -1214,6 +1214,41 @@ protected function stageNumber30(array $args): ?int
             $this->c->DB->exec($query);
         }
 
+        return null;
+   }
+
+    /**
+     * rev.31 to rev.32
+     */
+    protected function stageNumber31(array $args): ?int
+    {
+        $coreConfig = new CoreConfig($this->c->DIR_CONFIG . '/' . self::CONFIG_FILE);
+
+        $coreConfig->add(
+            'HTTP_HEADERS',
+            [
+                'common' => [
+                    'X-Content-Type-Options'  => '\'nosniff\'',
+                    'X-Frame-Options'         => '\'DENY\'',
+                    'X-XSS-Protection'        => '\'1; mode=block\'',
+                    'Referrer-Policy'         => '\'origin-when-cross-origin\'',
+                    'Content-Security-Policy' => '\'default-src \\\'self\\\';img-src *;object-src \\\'none\\\';frame-ancestors \\\'none\\\'\'',
+                    'Feature-Policy'          => '\'accelerometer \\\'none\\\';ambient-light-sensor \\\'none\\\';autoplay \\\'none\\\';battery \\\'none\\\';camera \\\'none\\\';document-domain \\\'self\\\';fullscreen \\\'self\\\';geolocation \\\'none\\\';gyroscope \\\'none\\\';magnetometer \\\'none\\\';microphone \\\'none\\\';midi \\\'none\\\';payment \\\'none\\\';picture-in-picture \\\'none\\\';sync-xhr \\\'self\\\';usb \\\'none\\\'\'',
+                ],
+                'secure' => [
+                    'X-Content-Type-Options'  => '\'nosniff\'',
+                    'X-Frame-Options'         => '\'DENY\'',
+                    'X-XSS-Protection'        => '\'1; mode=block\'',
+                    'Referrer-Policy'         => '\'origin-when-cross-origin\'',
+                    'Content-Security-Policy' => '\'default-src \\\'self\\\';object-src \\\'none\\\';frame-ancestors \\\'none\\\'\'',
+                    'Feature-Policy'          => '\'accelerometer \\\'none\\\';ambient-light-sensor \\\'none\\\';autoplay \\\'none\\\';battery \\\'none\\\';camera \\\'none\\\';document-domain \\\'self\\\';fullscreen \\\'self\\\';geolocation \\\'none\\\';gyroscope \\\'none\\\';magnetometer \\\'none\\\';microphone \\\'none\\\';midi \\\'none\\\';payment \\\'none\\\';picture-in-picture \\\'none\\\';sync-xhr \\\'self\\\';usb \\\'none\\\'\'',
+                ],
+            ],
+            'USERNAME_PATTERN'
+        );
+
+        $coreConfig->save();
+
         return null;
    }
 }
diff --git a/app/bootstrap.php b/app/bootstrap.php
@@ -50,7 +50,7 @@
 }
 $c->PUBLIC_URL = $c->BASE_URL . $forkPublicPrefix;
 
-$c->FORK_REVISION = 31;
+$c->FORK_REVISION = 32;
 $c->START         = $forkStart;
 $c->DIR_APP       = __DIR__;
 $c->DIR_PUBLIC    = $forkPublic;

diff --git a/app/config/main.dist.php b/app/config/main.dist.php
@@ -53,6 +53,24 @@
     'MAX_EMAIL_LENGTH' => 80,
     'FLOOD_INTERVAL'   => 3600,
     'USERNAME_PATTERN' => '%^(?=.{2,25}$)\p{L}[\p{L}\p{N}\x20\._-]+$%uD',
+    'HTTP_HEADERS'     => [
+        'common' => [
+            'X-Content-Type-Options'  => 'nosniff',
+            'X-Frame-Options'         => 'DENY',
+            'X-XSS-Protection'        => '1; mode=block',
+            'Referrer-Policy'         => 'origin-when-cross-origin',
+            'Content-Security-Policy' => 'default-src \self\';img-src *;object-src \'none\';frame-ancestors \'none\'',
+            'Feature-Policy'          => 'accelerometer \'none\';ambient-light-sensor \'none\';autoplay \'none\';battery \'none\';camera \'none\';document-domain \'self\';fullscreen \'self\';geolocation \'none\';gyroscope \'none\';magnetometer \'none\';microphone \'none\';midi \'none\';payment \'none\';picture-in-picture \'none\';sync-xhr \'self\';usb \'none\'',
+        ],
+        'secure' => [
+            'X-Content-Type-Options'  => 'nosniff',
+            'X-Frame-Options'         => 'DENY',
+            'X-XSS-Protection'        => '1; mode=block',
+            'Referrer-Policy'         => 'origin-when-cross-origin',
+            'Content-Security-Policy' => 'default-src \self\';object-src \'none\';frame-ancestors \'none\'',
+            'Feature-Policy'          => 'accelerometer \'none\';ambient-light-sensor \'none\';autoplay \'none\';battery \'none\';camera \'none\';document-domain \'self\';fullscreen \'self\';geolocation \'none\';gyroscope \'none\';magnetometer \'none\';microphone \'none\';midi \'none\';payment \'none\';picture-in-picture \'none\';sync-xhr \'self\';usb \'none\'',
+        ],
+    ],
 
     'shared' => [
         'DB' => [