StrictTransportSecurityPlugin.php 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667
  1. <?php
  2. /**
  3. * StatusNet, the distributed open-source microblogging tool
  4. *
  5. * Plugin to enable Strict Transport Security headers
  6. *
  7. * PHP version 5
  8. *
  9. * LICENCE: This program is free software: you can redistribute it and/or modify
  10. * it under the terms of the GNU Affero General Public License as published by
  11. * the Free Software Foundation, either version 3 of the License, or
  12. * (at your option) any later version.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU Affero General Public License for more details.
  18. *
  19. * You should have received a copy of the GNU Affero General Public License
  20. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  21. *
  22. * @category Plugin
  23. * @package StatusNet
  24. * @author Craig Andrews <candrews@integralblue.com>
  25. * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  26. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  27. * @link http://status.net/
  28. */
  29. if (!defined('GNUSOCIAL')) { exit(1); }
  30. class StrictTransportSecurityPlugin extends Plugin
  31. {
  32. const PLUGIN_VERSION = '2.0.0';
  33. public $max_age = 15552000;
  34. public $includeSubDomains = false;
  35. public $preloadToken = false;
  36. function __construct()
  37. {
  38. parent::__construct();
  39. }
  40. function onArgsInitialize($args)
  41. {
  42. $path = common_config('site', 'path');
  43. if (GNUsocial::useHTTPS() && ($path == '/' || mb_strlen($path)==0 )) {
  44. header('Strict-Transport-Security: max-age=' . $this->max_age
  45. . ($this->includeSubDomains ? '; includeSubDomains' : '')
  46. . ($this->preloadToken ? '; preload' : ''));
  47. }
  48. }
  49. function onPluginVersion(array &$versions)
  50. {
  51. $versions[] = array('name' => 'StrictTransportSecurity',
  52. 'version' => self::PLUGIN_VERSION,
  53. 'author' => 'Craig Andrews',
  54. 'homepage' => 'https://git.gnu.io/gnu/gnu-social/tree/master/plugins/StrictTransportSecurity',
  55. 'rawdescription' =>
  56. // TRANS: Plugin description.
  57. _m('The Strict Transport Security plugin implements the Strict Transport Security header, improving the security of HTTPS only sites.'));
  58. return true;
  59. }
  60. }