Issue #2925376 by wrd, lamp5, mcdruid: Add support for Referrer-Policy header (6db09808) · Commits · project / seckit

config/install/seckit.settings.yml

+2 −0

Changes for config/install/seckit.settings.yml: 2 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -38,4 +38,6 @@ seckit_ssl:
		seckit_various:
		from_origin: FALSE
		from_origin_destination: same
		referrer_policy: FALSE
		referrer_policy_policy: 'no-referrer-when-downgrade'
		disable_autocomplete: FALSE

config/schema/seckit.schema.yml

+6 −0

Changes for config/schema/seckit.schema.yml: 6 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -133,6 +133,12 @@ seckit.settings:
		from_origin_destination:
		type: string
		label: 'Allow loading content to'
		referrer_policy:
		type: boolean
		label: 'Referrer-Policy'
		referrer_policy_policy:
		type: string
		label: 'Select policy'
		disable_autocomplete:
		type: boolean
		label: 'Disable autocomplete'

js/seckit.listener.js

+9 −0

Changes for js/seckit.listener.js: 9 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -32,6 +32,9 @@ Drupal.behaviors.seckit = {
		$('#edit-seckit-various-from-origin', context).click(function () {
		seckit_listener_various(context);
		});
		$('#edit-seckit-various-referrer-policy', context).click(function () {
		seckit_listener_various(context);
		});
		})(jQuery);
		}
		};
		@@ -182,5 +185,11 @@ function seckit_listener_various(context) {
		else {
		$('#edit-seckit-various-from-origin-destination', context).attr('disabled', 'disabled');
		}
		if ($('#edit-seckit-various-referrer-policy').is(':checked')) {
		$('#edit-seckit-various-referrer-policy-policy', context).removeAttr('disabled');
		}
		else {
		$('#edit-seckit-various-referrer-policy-policy', context).attr('disabled', 'disabled');
		}
		})(jQuery);
		}

src/EventSubscriber/SecKitEventSubscriber.php

+14 −0

Changes for src/EventSubscriber/SecKitEventSubscriber.php: 14 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -77,6 +77,9 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
		if ($this->config->get('seckit_various.from_origin')) {
		$this->seckitFromOrigin();
		}
		if ($this->config->get('seckit_various.referrer_policy')) {
		$this->seckitReferrerPolicy();
		}

		$this->seckitXcontentTypeOptions($this->config->get('seckit_xss.x_content_type.checkbox'));

		@@ -421,4 +424,15 @@ EOT;
		$this->response->headers->set('From-Origin', $value);
		}

		/**
		* Sends Referrer-Policy HTTP response header.
		*
		* Implementation is based on specification draft
		* available at https://www.w3.org/TR/referrer-policy.
		*/
		public function seckitReferrerPolicy() {
		$value = $this->config->get('seckit_various.referrer_policy_policy');
		$this->response->headers->set('Referrer-Policy', $value);
		}

		}

src/Form/SecKitSettingsForm.php

+53 −0

Changes for src/Form/SecKitSettingsForm.php: 53 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -529,6 +529,59 @@ class SecKitSettingsForm extends ConfigFormBase {
		],
		],
		];

		// Enable/disable Referrer-Policy.
		$args = [
		':spec' => 'http://www.w3.org/TR/referrer-policy/',
		'@spec' => 'specification',
		];

		$form['seckit_various']['referrer_policy'] = [
		'#type' => 'checkbox',
		'#title' => $this->t('Referrer-Policy'),
		'#default_value' => $config->get('seckit_various.referrer_policy'),
		'#description' => $this->t('Enable Referrer-Policy HTTP response header. This affects the Referer HTTP header for outgoing requests and navigations. More information is available at the <a href=":spec">@spec</a> page.', $args),
		];

		// Referrer-Policy policy selection.
		$items = [
		$this->t('no-referrer - No referrer information will be sent.'),
		$this->t('no-referrer-when-downgrade - No referrer information will be sent when navigating from HTTPS to HTTP.'),
		$this->t('same-origin - Referrer information is sent only with requests to the same origin.'),
		$this->t('origin - This will strip any path information from the referrer information.'),
		$this->t('strict-origin - Like no-referrer-when-downgrade, but sends only the origin.'),
		$this->t('origin-when-cross-origin - Sends full referrer information with same-origin requests, and origin only with cross-origin requests.'),
		$this->t('strict-origin-when-cross-origin - Sends full referrer information with same-origin requests, origin only with cross-origin requests, and no referrer information if downgrading from https to http.'),
		$this->t('unsafe-url - Sends full referrer information with all requests; as the name implies, this is not safe.'),
		$this->t('"" (empty string) - Default to no-referrer-when-downgrade unless a higher-level policy has been defined elsewhere.'),
		];
		$args = [
		'@items' => $this->getItemsList($items),
		];

		$referrer_policy_options = [
		'no-referrer' => 'no-referrer',
		'no-referrer-when-downgrade' => 'no-referrer-when-downgrade',
		'same-origin' => 'same-origin',
		'strict-origin' => 'strict-origin',
		'origin-when-cross-origin' => 'origin-when-cross-origin',
		'strict-origin-when-cross-origin' => 'strict-origin-when-cross-origin',
		'unsafe-url' => 'unsafe-url',
		'empty' => $this->t('"" (empty string)'),
		];
		$form['seckit_various']['referrer_policy_policy'] = [
		'#type' => 'select',
		'#title' => $this->t('Select policy'),
		'#default_value' => $config->get('seckit_various.referrer_policy_policy'),
		'#description' => $this->t('Policy options are: @items', $args),
		'#options' => $referrer_policy_options,
		'#states' => [
		'required' => [
		'input[name="seckit_various[referrer_policy]"]' => ['checked' => TRUE],
		],
		],
		];

		// Disable autocomplete on login and registration forms.
		$form['seckit_various']['disable_autocomplete'] = [
		'#type' => 'checkbox',