Skip to content

Commit 3da51fd

Browse files
ashvisualthemeashvisualtheme
committed
Fix PHP Warning: assert()
1 parent b3bde11 commit 3da51fd

4 files changed

Lines changed: 287 additions & 287 deletions

File tree

SecurityHeadersPlugin.inc.php renamed to AshSecurityHeadersPlugin.inc.php

Lines changed: 165 additions & 165 deletions
Original file line numberDiff line numberDiff line change
@@ -1,165 +1,165 @@
1-
<?php
2-
3-
/**
4-
* @file plugins/generic/ashSecurityHeaders/SecurityHeadersPlugin.inc.php
5-
*
6-
* Copyright (c) 2021-2025 AshVisualTheme
7-
* Copyright (c) 2014-2025 Simon Fraser University
8-
* Copyright (c) 2003-2025 John Willinsky
9-
* Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
10-
*
11-
* @class SecurityHeadersPlugin
12-
* @brief Main class for the Security Headers plugin.
13-
*/
14-
15-
import('lib.pkp.classes.core.PKPApplication');
16-
import('lib.pkp.classes.core.JSONMessage');
17-
import('lib.pkp.classes.linkAction.LinkAction');
18-
import('lib.pkp.classes.linkAction.request.AjaxModal');
19-
import('lib.pkp.classes.plugins.GenericPlugin');
20-
import('lib.pkp.classes.plugins.HookRegistry');
21-
22-
import('plugins.generic.ashSecurityHeaders.SecurityHeadersSettingsForm');
23-
24-
class SecurityHeadersPlugin extends GenericPlugin
25-
{
26-
public function register($category, $path, $mainContextId = null)
27-
{
28-
$success = parent::register($category, $path, $mainContextId);
29-
if ($success && $this->getEnabled()) {
30-
HookRegistry::register('Dispatcher::dispatch', [$this, 'addSecurityHeaders']);
31-
}
32-
return $success;
33-
}
34-
35-
public function getDisplayName()
36-
{
37-
return __('plugins.generic.ashSecurityHeaders.displayName');
38-
}
39-
40-
public function getDescription()
41-
{
42-
return __('plugins.generic.ashSecurityHeaders.description');
43-
}
44-
45-
public function isSitePlugin()
46-
{
47-
if (!$this->getRequest()->getContext()) {
48-
return true;
49-
}
50-
return false;
51-
}
52-
53-
public function getActions($request, $actionArgs)
54-
{
55-
$actions = parent::getActions($request, $actionArgs);
56-
if (!$this->getEnabled()) {
57-
return $actions;
58-
}
59-
60-
$router = $request->getRouter();
61-
$linkAction = new LinkAction(
62-
'settings',
63-
new AjaxModal(
64-
$router->url(
65-
$request,
66-
null,
67-
null,
68-
'manage',
69-
null,
70-
['verb' => 'settings', 'plugin' => $this->getName(), 'category' => 'generic']
71-
),
72-
$this->getDisplayName()
73-
),
74-
__('manager.plugins.settings'),
75-
null
76-
);
77-
array_unshift($actions, $linkAction);
78-
return $actions;
79-
}
80-
81-
public function manage($args, $request)
82-
{
83-
switch ($request->getUserVar('verb')) {
84-
case 'settings':
85-
$form = new SecurityHeadersSettingsForm($this);
86-
87-
if (!$request->getUserVar('save')) {
88-
$form->initData();
89-
return new JSONMessage(true, $form->fetch($request));
90-
}
91-
92-
$form->readInputData();
93-
if ($form->validate()) {
94-
$form->execute();
95-
return new JSONMessage(true);
96-
}
97-
}
98-
return parent::manage($args, $request);
99-
}
100-
101-
public function getDefaultHeaders()
102-
{
103-
return [
104-
'X-Frame-Options' => 'SAMEORIGIN',
105-
'X-Content-Type-Options' => 'nosniff',
106-
'X-XSS-Protection' => '1; mode=block',
107-
'Content-Security-Policy' => "upgrade-insecure-requests;",
108-
'Cross-Origin-Embedder-Policy' => "same-origin; report-to='default'",
109-
'Cross-Origin-Opener-Policy' => 'require-corp',
110-
'Cross-Origin-Resource-Policy' => 'same-origin',
111-
'Permissions-Policy' => "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=(), fullscreen=(self)",
112-
'Referrer-Policy' => 'strict-origin-when-cross-origin',
113-
'Strict-Transport-Security' => 'max-age=63072000; includeSubDomains; preload',
114-
];
115-
}
116-
117-
public function addSecurityHeaders($hookName, $params)
118-
{
119-
120-
if (defined('SESSION_DISABLE_INIT') || php_sapi_name() === 'cli' || headers_sent()) {
121-
return false;
122-
}
123-
124-
$defaultHeaders = $this->getDefaultHeaders();
125-
$request = PKPApplication::get()->getRequest();
126-
$context = $request->getContext();
127-
$contextId = $context ? $context->getId() : CONTEXT_SITE;
128-
129-
$settingMap = [
130-
'X-Frame-Options' => 'headerXfo',
131-
'X-Content-Type-Options' => 'headerXcto',
132-
'X-XSS-Protection' => 'headerXxss',
133-
'Content-Security-Policy' => 'headerCsp',
134-
'Cross-Origin-Embedder-Policy' => 'headerCoep',
135-
'Cross-Origin-Opener-Policy' => 'headerCoop',
136-
'Cross-Origin-Resource-Policy' => 'headerCorp',
137-
'Permissions-Policy' => 'headerPp',
138-
'Referrer-Policy' => 'headerRp',
139-
'Strict-Transport-Security' => 'headerHsts',
140-
];
141-
142-
$finalHeaders = [];
143-
foreach ($settingMap as $headerName => $settingKey) {
144-
$savedValue = $this->getSetting($contextId, $settingKey);
145-
146-
if ($savedValue === null) {
147-
if (isset($defaultHeaders[$headerName])) {
148-
$finalHeaders[$headerName] = $defaultHeaders[$headerName];
149-
}
150-
} elseif ($savedValue !== '') {
151-
$finalHeaders[$headerName] = $savedValue;
152-
}
153-
}
154-
155-
header_remove('X-Powered-By');
156-
157-
if (!empty($finalHeaders)) {
158-
foreach ($finalHeaders as $name => $value) {
159-
header("{$name}: {$value}");
160-
}
161-
}
162-
163-
return false;
164-
}
165-
}
1+
<?php
2+
3+
/**
4+
* @file plugins/generic/ashSecurityHeaders/AshSecurityHeadersPlugin.inc.php
5+
*
6+
* Copyright (c) 2021-2025 AshVisualTheme
7+
* Copyright (c) 2014-2025 Simon Fraser University
8+
* Copyright (c) 2003-2025 John Willinsky
9+
* Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
10+
*
11+
* @class SecurityHeadersPlugin
12+
* @brief Main class for the Security Headers plugin.
13+
*/
14+
15+
import('lib.pkp.classes.core.PKPApplication');
16+
import('lib.pkp.classes.core.JSONMessage');
17+
import('lib.pkp.classes.linkAction.LinkAction');
18+
import('lib.pkp.classes.linkAction.request.AjaxModal');
19+
import('lib.pkp.classes.plugins.GenericPlugin');
20+
import('lib.pkp.classes.plugins.HookRegistry');
21+
22+
import('plugins.generic.ashSecurityHeaders.AshSecurityHeadersSettingsForm');
23+
24+
class AshSecurityHeadersPlugin extends GenericPlugin
25+
{
26+
public function register($category, $path, $mainContextId = null)
27+
{
28+
$success = parent::register($category, $path, $mainContextId);
29+
if ($success && $this->getEnabled()) {
30+
HookRegistry::register('Dispatcher::dispatch', [$this, 'addSecurityHeaders']);
31+
}
32+
return $success;
33+
}
34+
35+
public function getDisplayName()
36+
{
37+
return __('plugins.generic.ashSecurityHeaders.displayName');
38+
}
39+
40+
public function getDescription()
41+
{
42+
return __('plugins.generic.ashSecurityHeaders.description');
43+
}
44+
45+
public function isSitePlugin()
46+
{
47+
if (!$this->getRequest()->getContext()) {
48+
return true;
49+
}
50+
return false;
51+
}
52+
53+
public function getActions($request, $actionArgs)
54+
{
55+
$actions = parent::getActions($request, $actionArgs);
56+
if (!$this->getEnabled()) {
57+
return $actions;
58+
}
59+
60+
$router = $request->getRouter();
61+
$linkAction = new LinkAction(
62+
'settings',
63+
new AjaxModal(
64+
$router->url(
65+
$request,
66+
null,
67+
null,
68+
'manage',
69+
null,
70+
['verb' => 'settings', 'plugin' => $this->getName(), 'category' => 'generic']
71+
),
72+
$this->getDisplayName()
73+
),
74+
__('manager.plugins.settings'),
75+
null
76+
);
77+
array_unshift($actions, $linkAction);
78+
return $actions;
79+
}
80+
81+
public function manage($args, $request)
82+
{
83+
switch ($request->getUserVar('verb')) {
84+
case 'settings':
85+
$form = new AshSecurityHeadersSettingsForm($this);
86+
87+
if (!$request->getUserVar('save')) {
88+
$form->initData();
89+
return new JSONMessage(true, $form->fetch($request));
90+
}
91+
92+
$form->readInputData();
93+
if ($form->validate()) {
94+
$form->execute();
95+
return new JSONMessage(true);
96+
}
97+
}
98+
return parent::manage($args, $request);
99+
}
100+
101+
public function getDefaultHeaders()
102+
{
103+
return [
104+
'X-Frame-Options' => 'SAMEORIGIN',
105+
'X-Content-Type-Options' => 'nosniff',
106+
'X-XSS-Protection' => '1; mode=block',
107+
'Content-Security-Policy' => "upgrade-insecure-requests;",
108+
'Cross-Origin-Embedder-Policy' => "same-origin; report-to='default'",
109+
'Cross-Origin-Opener-Policy' => 'require-corp',
110+
'Cross-Origin-Resource-Policy' => 'same-origin',
111+
'Permissions-Policy' => "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=(), fullscreen=(self)",
112+
'Referrer-Policy' => 'strict-origin-when-cross-origin',
113+
'Strict-Transport-Security' => 'max-age=63072000; includeSubDomains; preload',
114+
];
115+
}
116+
117+
public function addSecurityHeaders($hookName, $params)
118+
{
119+
120+
if (defined('SESSION_DISABLE_INIT') || php_sapi_name() === 'cli' || headers_sent()) {
121+
return false;
122+
}
123+
124+
$defaultHeaders = $this->getDefaultHeaders();
125+
$request = PKPApplication::get()->getRequest();
126+
$context = $request->getContext();
127+
$contextId = $context ? $context->getId() : CONTEXT_SITE;
128+
129+
$settingMap = [
130+
'X-Frame-Options' => 'headerXfo',
131+
'X-Content-Type-Options' => 'headerXcto',
132+
'X-XSS-Protection' => 'headerXxss',
133+
'Content-Security-Policy' => 'headerCsp',
134+
'Cross-Origin-Embedder-Policy' => 'headerCoep',
135+
'Cross-Origin-Opener-Policy' => 'headerCoop',
136+
'Cross-Origin-Resource-Policy' => 'headerCorp',
137+
'Permissions-Policy' => 'headerPp',
138+
'Referrer-Policy' => 'headerRp',
139+
'Strict-Transport-Security' => 'headerHsts',
140+
];
141+
142+
$finalHeaders = [];
143+
foreach ($settingMap as $headerName => $settingKey) {
144+
$savedValue = $this->getSetting($contextId, $settingKey);
145+
146+
if ($savedValue === null) {
147+
if (isset($defaultHeaders[$headerName])) {
148+
$finalHeaders[$headerName] = $defaultHeaders[$headerName];
149+
}
150+
} elseif ($savedValue !== '') {
151+
$finalHeaders[$headerName] = $savedValue;
152+
}
153+
}
154+
155+
header_remove('X-Powered-By');
156+
157+
if (!empty($finalHeaders)) {
158+
foreach ($finalHeaders as $name => $value) {
159+
header("{$name}: {$value}");
160+
}
161+
}
162+
163+
return false;
164+
}
165+
}

0 commit comments

Comments
 (0)