Changeset 3279:0fc10be22e4c for inc/admin

Timestamp:

07/21/16 14:07:55 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Add adminPageHTTPHeaders behavior : give third party code opportunity to modify, add or reset some HTTP headers

File:

• inc/admin/lib.dc.page.php (modified) (4 diffs)

inc/admin/lib.dc.page.php

@@ -90 +90 @@
 
           # Display
-          header('Content-Type: text/html; charset=UTF-8');
-
-          // Prevents Clickjacking as far as possible
+          $headers = new arrayobject(array());
+
+          # Content-Type
+          $headers['content-type'] = 'Content-Type: text/html; charset=UTF-8';
+
+          # Prevents Clickjacking as far as possible
           if (isset($options['x-frame-allow'])) {
-               self::setXFrameOptions($options['x-frame-allow']);
+               self::setXFrameOptions($headers,$options['x-frame-allow']);
           } else {
-               self::setXFrameOptions();
+               self::setXFrameOptions($headers);
           }
 
           # Content-Security-Policy (report only up to now)
-          header(
+          $headers['csp'] =
                "Content-Security-Policy: ".
                     "default-src 'self' ; ".
@@ -106 +109 @@
                     "style-src 'self' 'unsafe-inline' ; ".
                     "img-src 'self' data: media.dotaddict.org".
-                    (version_compare(phpversion(),'5.4','>=') ? " ; report-uri ".DC_ADMIN_URL."csp_report.php" : '')
-               );
+                    (version_compare(phpversion(),'5.4','>=') ? " ; report-uri ".DC_ADMIN_URL."csp_report.php" : '');
+
+          # --BEHAVIOR-- adminPageHTTPHeaders
+          $core->callBehavior('adminPageHTTPHeaders',$headers);
+          foreach ($headers as $key => $value) {
+               header($value);
+          }
 
           echo
@@ -1023 +1031 @@
      }
 
-     public static function setXFrameOptions($origin = null)
+     public static function setXFrameOptions($headers,$origin = null)
      {
           if (self::$xframe_loaded) {
@@ -1030 +1038 @@
           if ($origin !== null) {
                $url = parse_url($origin);
-               header(sprintf('X-Frame-Options: %s',is_array($url) ?
+               $headers['x-frame-options'] = sprintf('X-Frame-Options: %s',is_array($url) ?
                     ("ALLOW-FROM ".(isset($url['scheme']) ? $url['scheme'].':' : '' ).'//'.$url['host']) :
-                    'SAMEORIGIN'));
+                    'SAMEORIGIN');
           } else {
-               header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+
+               $headers['x-frame-options'] = 'X-Frame-Options: SAMEORIGIN'; // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+
           }
           self::$xframe_loaded = true;