W3 Total Cache - Version 2.1.4

Version Description

  • Fix: Sanitize extension argument
  • Fix: Use Memcached server from config for Nginx rules instead of localhost
  • Fix: Allow more characters in CDN hostname sanitization
  • Fix: Added missing textdomains for Browser Cache settings
  • Fix: Avoid a possible PHP warning in LazyLoad mutator
  • Enhancement: Added a filter w3tc_cdn_cf_flush_all_uris for CloudFront purging
Download this release

Release Info

Developer joemoto
Plugin Icon 128x128 W3 Total Cache
Version 2.1.4
Comparing to
See all releases

Code changes from version 2.1.3 to 2.1.4

Files changed (52) hide show
  1. BrowserCache_Page_View_SectionSecurity.php +275 -232
  2. Cdnfsd_CloudFront_Engine.php +1 -1
  3. Extension_CloudFlare_Widget_Logo.png +0 -0
  4. Extensions_Page.php +1 -1
  5. Generic_AdminActions_Default.php +1 -1
  6. Generic_Plugin_Admin.php +1 -1
  7. PgCache_Environment.php +5 -1
  8. UserExperience_LazyLoad_Mutator.php +4 -2
  9. pub/img/W3TC_dashboard_logo_title-retina.png +0 -0
  10. pub/img/button-grad-active.png +0 -0
  11. pub/img/button-grad.png +0 -0
  12. pub/img/cdn-highwinds-logo.png +0 -0
  13. pub/img/close.png +0 -0
  14. pub/img/google-logo.png +0 -0
  15. pub/img/moon-bottom-left.png +0 -0
  16. pub/img/moon-bottom-right.png +0 -0
  17. pub/img/open.png +0 -0
  18. pub/img/overlay/gauge-bg-tp.png +0 -0
  19. pub/img/overlay/gray-check.png +0 -0
  20. pub/img/overlay/lite-gray-check.png +0 -0
  21. pub/img/overlay/lock.png +0 -0
  22. pub/img/overlay/overlay-close.png +0 -0
  23. pub/img/overlay/overlay-down-arrow.png +0 -0
  24. pub/img/overlay/save-close.png +0 -0
  25. pub/img/overlay/select-arrow.png +0 -0
  26. pub/img/overlay/twitter-bird-dark-bgs.png +0 -0
  27. pub/img/overlay/wordpress-logo-simplified-rgb.png +0 -0
  28. pub/img/ps_scores.png +0 -0
  29. pub/img/sidebar-background.png +0 -0
  30. pub/img/stats-bg.png +0 -0
  31. pub/img/transparent-comet-moon.png +0 -0
  32. pub/img/transparent-comet.png +0 -0
  33. pub/img/usage-statistics-widget.png +0 -0
  34. pub/img/w3tc_cube-shadow.png +0 -0
  35. pub/img/w3tc_google-logo-retina.png +0 -0
  36. pub/img/w3tc_google-logo.png +0 -0
  37. pub/img/w3tc_maxcdn-logo-retina.png +0 -0
  38. pub/img/w3tc_maxcdn-logo.png +0 -0
  39. pub/img/w3tc_netdna-logo-retina.png +0 -0
  40. pub/img/w3tc_netdna-logo.png +0 -0
  41. pub/img/w3tc_newrelic-logo-retina.png +0 -0
  42. pub/img/w3tc_newrelic-logo.png +0 -0
  43. pub/img/w3tc_swarmify-logo-retina.png +0 -0
  44. pub/img/w3tc_swarmify-logo.png +0 -0
  45. pub/img/w3tc_w3edge-logo-retina.png +0 -0
  46. pub/img/w3tc_w3edge-logo.png +0 -0
  47. pub/img/w3tc_w3tc-logo.png +0 -0
  48. pub/img/white-grad-active.png +0 -0
  49. pub/img/white-grad.png +0 -0
  50. readme.txt +9 -1
  51. w3-total-cache-api.php +1 -1
  52. w3-total-cache.php +1 -1
BrowserCache_Page_View_SectionSecurity.php CHANGED
@@ -1,471 +1,514 @@
1
  <?php
 
 
 
 
 
 
 
 
2
  namespace W3TC;
3
 
4
- if ( !defined( 'W3TC' ) )
5
  die();
 
6
 
7
- $c = Dispatcher::config();
8
  $fp_values = $c->get_array( 'browsercache.security.fp.values' );
9
 
10
  $feature_policies = array(
11
  array(
12
- 'label' => 'accelerometer',
13
- 'description' => __( 'controls whether the current document is allowed to gather information about the acceleration of the device through the Accelerometer interface', 'w3-total-cache' )
14
- ), array(
15
- 'label' => 'ambient-light-sensor',
16
- 'description' => __( 'controls whether the current document is allowed to gather information about the amount of light in the environment around the device through the AmbientLightSensor interface', 'w3-total-cache')
17
- ), array(
18
- 'label' => 'autoplay',
19
- 'description' => __( 'controls whether the current document is allowed to autoplay media requested through the HTMLMediaElement interface', 'w3-total-cache')
20
- ), array(
21
- 'label' => 'camera',
22
- 'description' => __( 'controls whether the current document is allowed to use video input devices', 'w3-total-cache')
23
- ), array(
24
- 'label' => 'display-capture',
25
- 'description' => __( 'controls whether or not the document is permitted to use Screen Capture API', 'w3-total-cache')
26
- ), array(
27
- 'label' => 'document-domain',
28
- 'description' => __( 'controls whether the current document is allowed to set document.domain', 'w3-total-cache')
29
- ), array(
30
- 'label' => 'encrypted-media',
31
- 'description' => __( 'controls whether the current document is allowed to use the Encrypted Media Extensions API (EME)', 'w3-total-cache')
32
- ), array(
33
- 'label' => 'fullscreen',
34
- 'description' => __( 'controls whether the current document is allowed to use Element.requestFullScreen()', 'w3-total-cache')
35
- ), array(
36
- 'label' => 'geolocation',
37
- 'description' => __( 'controls whether the current document is allowed to use the Geolocation Interface', 'w3-total-cache')
38
- ), array(
39
- 'label' => 'gyroscope',
40
- 'description' => __( 'controls whether the current document is allowed to gather information about the orientation of the device through the Gyroscope interface', 'w3-total-cache')
41
- ), array(
42
- 'label' => 'layout-animations',
43
- 'description' => __( 'controls whether the current document is allowed to show layout animations', 'w3-total-cache')
44
- ), array(
45
- 'label' => 'legacy-image-formats',
46
- 'description' => __( 'controls whether the current document is allowed to display images in legacy formats', 'w3-total-cache')
47
- ), array(
48
- 'label' => 'magnetometer',
49
- 'description' => __( 'controls whether the current document is allowed to gather information about the orientation of the device through the Magnetometer interface', 'w3-total-cache')
50
- ), array(
51
- 'label' => 'microphone',
52
- 'description' => __( 'controls whether the current document is allowed to use audio input devices', 'w3-total-cache')
53
- ), array(
54
- 'label' => 'midi',
55
- 'description' => __( 'controls whether the current document is allowed to use the Web MIDI API', 'w3-total-cache')
56
- ), array(
57
- 'label' => 'oversized-images',
58
- 'description' => __( 'controls whether the current document is allowed to download and display large images', 'w3-total-cache')
59
- ), array(
60
- 'label' => 'payment',
61
- 'description' => __( 'controls whether the current document is allowed to use the Payment Request API', 'w3-total-cache')
62
- ), array(
63
- 'label' => 'picture-in-picture',
64
- 'description' => __( 'controls whether the current document is allowed to play a video in a Picture-in-Picture mode via the corresponding API', 'w3-total-cache')
65
- ), array(
66
- 'label' => 'publickey-credentials',
67
- 'description' => __( 'controls whether the current document is allowed to access Web Authentcation API', 'w3-total-cache')
68
- ), array(
69
- 'label' => 'speaker',
70
- 'description' => __( 'controls whether the current document is allowed to play audio via any methods', 'w3-total-cache')
71
- ), array(
72
- 'label' => 'sync-xhr',
73
- 'description' => __( 'controls whether the current document is allowed to make synchronous XMLHttpRequest requests', 'w3-total-cache')
74
- ), array(
75
- 'label' => 'unoptimized-images',
76
- 'description' => __( 'controls whether the current document is allowed to download and display unoptimized images', 'w3-total-cache')
77
- ), array(
78
- 'label' => 'unsized-media',
79
- 'description' => __( 'controls whether the current document is allowed to change the size of media elements after the initial layout is complete', 'w3-total-cache')
80
- ), array(
81
- 'label' => 'usb',
82
- 'description' => __( 'controls whether the current document is allowed to use the WebUSB API', 'w3-total-cache')
83
- ), array(
84
- 'label' => 'vibrate',
85
- 'description' => __( 'directive controls whether the current document is allowed to trigger device vibrations via Vibration API', 'w3-total-cache')
86
- ), array(
87
- 'label' => 'wake-lock',
88
- 'description' => __( 'controls whether the current document is allowed to use Wake Lock API to indicate that device should not enter power-saving mode', 'w3-total-cache')
89
- ), array(
90
- 'label' => 'xr-spatial-tracking',
91
- 'description' => __( 'controls whether the current document is allowed to use the WebXR Device API.', 'w3-total-cache')
92
- )
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
93
  );
94
 
95
  ?>
96
- <?php Util_Ui::postbox_header( __( 'Security Headers', 'w3-total-cache' ), '', 'security' ) ?>
97
- <p><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> security headers provide another layer of protection for your website by helping to mitigate attacks and security vulnerabilities.', 'w3-total-cache' ) ?></p>
 
98
  <p><a onclick="w3tc_csp_reference()" href="javascript:void(0);">Quick Reference Chart</a></p>
99
 
100
  <table class="form-table">
101
  <?php
102
- Util_Ui::config_item( array(
103
- 'key' => 'browsercache.security.session.use_only_cookies',
104
- 'control' => 'selectbox',
 
105
  'selectbox_values' => $security_session_values,
106
- 'description' => __( 'This setting prevents attacks that are caused by passing session IDs in <acronym title="Uniform Resource Locator">URL</acronym>s.',
107
- 'w3-total-cache' )
108
- ) );
109
  ?>
110
  <?php
111
- Util_Ui::config_item( array(
112
- 'key' => 'browsercache.security.session.cookie_httponly',
113
- 'control' => 'selectbox',
 
114
  'selectbox_values' => $security_session_values,
115
- 'description' => __( 'This tells the user\'s browser not to make the session cookie accessible to client side scripting such as JavaScript. This makes it harder for an attacker to hijack the session ID and masquerade as the effected user.',
116
- 'w3-total-cache' )
117
- ) );
118
  ?>
119
  <?php
120
- Util_Ui::config_item( array(
121
- 'key' => 'browsercache.security.session.cookie_secure',
122
- 'control' => 'selectbox',
 
123
  'selectbox_values' => $security_session_values,
124
- 'description' => __( 'This will prevent the user\'s session ID from being transmitted in plain text, making it much harder to hijack the user\'s session.',
125
- 'w3-total-cache' )
126
- ) );
127
  ?>
128
  <tr>
129
  <th colspan="2">
130
- <?php $this->checkbox( 'browsercache.hsts' ) ?> <?php Util_Ui::e_config_label( 'browsercache.hsts' ) ?></label>
131
- <p class="description"><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> Strict-Transport-Security (<acronym title="HTTP Strict Transport Security">HSTS</acronym>) enforces secure (<acronym title="Hypertext Transfer Protocol">HTTP</acronym> over <acronym title="Secure Sockets Layer">SSL</acronym>/<acronym title="Transport Layer Security">TLS</acronym>) connections to the server. This can help mitigate adverse effects caused by bugs and session leaks through cookies and links. It also helps defend against man-in-the-middle attacks. If there are <acronym title="Secure Sockets Layer">SSL</acronym> negotiation warnings then users will not be permitted to ignore them.', 'w3-total-cache' ) ?></p>
132
  </th>
133
  </tr>
134
  <tr>
135
  <th>
136
- <label for="browsercache_security_hsts_directive"><?php Util_Ui::e_config_label( 'browsercache.security.hsts.directive' ) ?></label>
137
  </th>
138
  <td>
139
  <select id="browsercache_security_hsts_directive"
140
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
141
  name="browsercache__security__hsts__directive">
142
- <?php $value = $this->_config->get_string( 'browsercache.security.hsts.directive' ) ?>
143
- <option value="maxage"<?php selected( $value, 'maxage' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS', 'w3-total-cache' ) ?></option>
144
- <option value="maxagepre"<?php selected( $value, 'maxagepre' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS; preload', 'w3-total-cache' ) ?></option>
145
- <option value="maxageinc"<?php selected( $value, 'maxageinc' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains', 'w3-total-cache' ) ?></option>
146
- <option value="maxageincpre"<?php selected( $value, 'maxageincpre' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains; preload', 'w3-total-cache' ) ?></option>
147
  </select>
148
  <div id="browsercache_security_hsts_directive_description"></div>
149
  </td>
150
  </tr>
151
  <tr>
152
  <th colspan="2">
153
- <?php $this->checkbox( 'browsercache.security.xfo' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.xfo' ) ?></label>
154
- <p class="description"><?php _e( 'This tells the browser if it is permitted to render a page within a frame-like tag (i.e., &lt;frame&gt;, &lt;iframe&gt; or &lt;object&gt;). This is useful for preventing clickjacking attacks.', 'w3-total-cache' ) ?></p>
155
  </th>
156
  </tr>
157
  <tr>
158
  <th>
159
- <label for="browsercache_security_xfo_directive"><?php Util_Ui::e_config_label( 'browsercache.security.xfo.directive' ) ?></label>
160
  </th>
161
  <td>
162
  <select id="browsercache_security_xfo_directive"
163
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
164
  name="browsercache__security__xfo__directive">
165
- <?php $value = $this->_config->get_string( 'browsercache.security.xfo.directive' ) ?>
166
- <option value="same"<?php selected( $value, 'same' ) ?>><?php _e( 'SameOrigin', 'w3-total-cache' ) ?></option>
167
- <option value="deny"<?php selected( $value, 'deny' ) ?>><?php _e( 'Deny', 'w3-total-cache' ) ?></option>
168
- <option value="allow"<?php selected( $value, 'allow' ) ?>><?php _e( 'Allow-From', 'w3-total-cache' ) ?></option>
169
  </select>
170
  <input id="browsercache_security_xfo_allow" type="text" name="browsercache__security__xfo__allow"
171
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.xfo.allow' ) ) ?>" size="50" placeholder="Enter URL" />
172
  <div id="browsercache_security_xfo_directive_description"></div>
173
  </td>
174
  </tr>
175
  <tr>
176
  <th colspan="2">
177
- <?php $this->checkbox( 'browsercache.security.xss' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.xss' ) ?></label>
178
- <p class="description"><?php _e( 'This header enables the <acronym title="Cross-Site Scripting">XSS</acronym> filter. It helps to stop malicious scripts from being injected into your website. Although this is already built into and enabled by default in most browsers today it is made available here to enforce its reactivation if it was disabled within the user\'s browser.', 'w3-total-cache' ) ?></p>
179
  </th>
180
  </tr>
181
  <tr>
182
  <th>
183
- <label for="browsercache_security_xss_directive"><?php Util_Ui::e_config_label( 'browsercache.security.xss.directive' ) ?></label>
184
  </th>
185
  <td>
186
  <select id="browsercache_security_xss_directive"
187
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
188
  name="browsercache__security__xss__directive">
189
- <?php $value = $this->_config->get_string( 'browsercache.security.xss.directive' ) ?>
190
- <option value="0"<?php selected( $value, '0' ) ?>><?php _e( '0', 'w3-total-cache' ) ?></option>
191
- <option value="1"<?php selected( $value, '1' ) ?>><?php _e( '1', 'w3-total-cache' ) ?></option>
192
- <option value="block"<?php selected( $value, 'block' ) ?>><?php _e( '1; mode=block', 'w3-total-cache' ) ?></option>
193
  </select>
194
  <div id="browsercache_security_xss_directive_description"></div>
195
  </td>
196
  </tr>
197
  <tr>
198
  <th colspan="2">
199
- <?php $this->checkbox( 'browsercache.security.xcto' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.xcto' ) ?></label>
200
- <p class="description"><?php _e( 'This instructs the browser to not MIME-sniff a response outside its declared content-type. It helps to reduce drive-by download attacks and stops sites from serving malevolent content that could masquerade as an executable or dynamic HTML file.', 'w3-total-cache' ) ?></p>
201
  </th>
202
  </tr>
203
  <tr>
204
  <th colspan="2">
205
- <?php $this->checkbox( 'browsercache.security.pkp' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.pkp' ) ?></label>
206
- <p class="description"><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> Public Key Pinning (<acronym title="HTTP Public Key Pinning">HPKP</acronym>) is a security feature for <acronym title="Hypertext Transfer Protocol">HTTP</acronym>S websites that can prevent fraudulently issued certificates from being used to impersonate existing secure websites.' ) ?></p>
207
  </th>
208
  </tr>
209
  <tr>
210
  <th>
211
- <label for="browsercache_security_pkp_pin"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.pin' ) ?></label>
212
  </th>
213
  <td>
214
  <input id="browsercache_security_pkp_pin" type="text" name="browsercache__security__pkp__pin"
215
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.pin' ) ) ?>" size="50" placeholder="Enter the Base64-Encode of the SHA256 Hash" />
216
- <div><i><?php _e( 'This field is <b>required</b> and represents a <acronym title="Subject Public Key Information">SPKI</acronym> fingerprint. This pin is any public key within your current certificate chain.' ) ?></i></div>
217
  </td>
218
  </tr>
219
  <tr>
220
  <th>
221
- <label for="browsercache_security_pkp_pin_backup"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.pin.backup' ) ?></label>
222
  </th>
223
  <td>
224
  <input id="browsercache_security_pkp_pin_backup" type="text" name="browsercache__security__pkp__pin__backup"
225
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.pin.backup' ) ) ?>" size="50" placeholder="Enter the Base64-Encode of the SHA256 Hash" />
226
- <div><i><?php _e( 'This field is <b>also required</b> and represents your backup <acronym title="Subject Public Key Information">SPKI</acronym> fingerprint. This pin is any public key not in your current certificate chain and serves as a backup in case your certificate expires or has to be revoked.' ) ?></i></div>
227
  </td>
228
  </tr>
229
  <tr>
230
  <th>
231
- <label for="browsercache_security_pkp_extra"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.extra' ) ?></label>
232
  </th>
233
  <td>
234
  <select id="browsercache_security_pkp_extra"
235
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
236
  name="browsercache__security__pkp__extra">
237
- <?php $value = $this->_config->get_string( 'browsercache.security.pkp.extra' ) ?>
238
- <option value="maxage"<?php selected( $value, 'maxage' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS', 'w3-total-cache' ) ?></option>
239
- <option value="maxageinc"<?php selected( $value, 'maxageinc' ) ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains', 'w3-total-cache' ) ?></option>
240
  </select>
241
  <div id="browsercache_security_pkp_extra_description"></div>
242
  </td>
243
  </tr>
244
  <tr>
245
  <th>
246
- <label for="browsercache_security_pkp_report_url"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.report.url' ) ?></label>
247
  </th>
248
  <td>
249
  <input id="browsercache_security_pkp_report_url" type="text" name="browsercache__security__pkp__report__url"
250
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.report.url' ) ) ?>" size="50" placeholder="Enter URL" />
251
- <div><i><?php _e( 'This optional field can be used to specify a <acronym title="Uniform Resource Locator">URL</acronym> that clients will send reports to if pin validation failures occur. The report is sent as a POST request with a JSON body.' ) ?></i></div>
252
  </td>
253
  </tr>
254
  <tr>
255
  <th>
256
- <label for="browsercache_security_pkp_report_only"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.report.only' ) ?></label>
257
  </th>
258
  <td>
259
  <select id="browsercache_security_pkp_report_only"
260
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
261
  name="browsercache__security__pkp__report__only">
262
- <?php $value = $this->_config->get_string( 'browsercache.security.pkp.report.only' ) ?>
263
- <option value="0"<?php selected( $value, '0' ) ?>><?php _e( 'No = Enforce HPKP', 'w3-total-cache' ) ?></option>
264
- <option value="1"<?php selected( $value, '1' ) ?>><?php _e( 'Yes = Don\'t Enforce HPKP', 'w3-total-cache' ) ?></option>
265
  </select>
266
  <div id="browsercache_security_pkp_report_only_description"></div>
267
  </td>
268
  </tr>
269
  <tr>
270
  <th colspan="2">
271
- <?php $this->checkbox( 'browsercache.security.referrer.policy' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.referrer.policy' ) ?></label>
272
- <p class="description"><?php _e( 'This header restricts the values of the referer header in outbound links.' ) ?></p>
273
  </th>
274
  </tr>
275
  <tr>
276
  <th>
277
- <label for="browsercache_security_referrer_policy_directive"><?php Util_Ui::e_config_label( 'browsercache.security.referrer.policy.directive' ) ?></label>
278
  </th>
279
  <td>
280
  <select id="browsercache_security_referrer_policy_directive"
281
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?>
282
  name="browsercache__security__referrer__policy__directive">
283
- <?php $value = $this->_config->get_string( 'browsercache.security.referrer.policy.directive' ) ?>
284
- <option value="0"<?php selected( $value, '0' ) ?>><?php _e( 'Not Set', 'w3-total-cache' ) ?></option>
285
- <option value="no-referrer"<?php selected( $value, 'no-referrer' ) ?>><?php _e( 'no-referrer', 'w3-total-cache' ) ?></option>
286
- <option value="no-referrer-when-downgrade"<?php selected( $value, 'no-referrer-when-downgrade' ) ?>><?php _e( 'no-referrer-when-downgrade', 'w3-total-cache' ) ?></option>
287
- <option value="same-origin"<?php selected( $value, 'same-origin' ) ?>><?php _e( 'same-origin', 'w3-total-cache' ) ?></option>
288
- <option value="origin"<?php selected( $value, 'origin' ) ?>><?php _e( 'origin', 'w3-total-cache' ) ?></option>
289
- <option value="strict-origin"<?php selected( $value, 'strict-origin' ) ?>><?php _e( 'strict-origin', 'w3-total-cache' ) ?></option>
290
- <option value="origin-when-cross-origin"<?php selected( $value, 'origin-when-cross-origin' ) ?>><?php _e( 'origin-when-cross-origin', 'w3-total-cache' ) ?></option>
291
- <option value="strict-origin-when-cross-origin"<?php selected( $value, 'strict-origin-when-cross-origin' ) ?>><?php _e( 'strict-origin-when-cross-origin', 'w3-total-cache' ) ?></option>
292
- <option value="unsafe-url"<?php selected( $value, 'unsafe-url' ) ?>><?php _e( 'unsafe-url', 'w3-total-cache' ) ?></option>
293
  </select>
294
  <div id="browsercache_security_referrer_policy_directive_description"></div>
295
  </td>
296
  </tr>
297
  <tr>
298
  <th colspan="2">
299
- <?php $this->checkbox( 'browsercache.security.csp' ) ?> <?php Util_Ui::e_config_label( 'browsercache.security.csp' ) ?></label>
300
- <p class="description"><?php _e( 'The Content Security Policy (<acronym title="Content Security Policy">CSP</acronym>) header reduces the risk of <acronym title="Cross-Site Scripting">XSS</acronym> attacks by allowing you to define where resources can be retrieved from, preventing browsers from loading data from any other locations. This makes it harder for an attacker to inject malicious code into your site.' ) ?></p>
301
  </th>
302
  </tr>
303
  <tr>
304
  <th>
305
- <label for="browsercache_security_csp_base"><?php Util_Ui::e_config_label( 'browsercache.security.csp.base' ) ?></label>
306
  </th>
307
  <td>
308
  <input id="browsercache_security_csp_base" type="text" name="browsercache__security__csp__base"
309
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.base' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
310
- <div><i><?php _e( 'Restricts the <acronym title="Uniform Resource Locator">URL</acronym>s which can be used in a document\'s &lt;base&gt; element.' ) ?></i></div>
311
  </td>
312
  </tr>
313
  <tr>
314
  <th>
315
- <label for="browsercache_security_csp_connect"><?php Util_Ui::e_config_label( 'browsercache.security.csp.connect' ) ?></label>
316
  </th>
317
  <td>
318
  <input id="browsercache_security_csp_connect" type="text" name="browsercache__security__csp__connect"
319
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.connect' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
320
- <div><i><?php _e( 'Limits the origins to which you can connect via XMLHttpRequest, WebSockets, and EventSource.' ) ?></i></div>
321
  </td>
322
  </tr>
323
  <tr>
324
  <th>
325
- <label for="browsercache_security_csp_font"><?php Util_Ui::e_config_label( 'browsercache.security.csp.font' ) ?></label>
326
  </th>
327
  <td>
328
  <input id="browsercache_security_csp_font" type="text" name="browsercache__security__csp__font"
329
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.font' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
330
- <div><i><?php _e( 'Specifies the origins that can serve web fonts.' ) ?></i></div>
331
  </td>
332
  </tr>
333
  <tr>
334
  <th>
335
- <label for="browsercache_security_csp_frame"><?php Util_Ui::e_config_label( 'browsercache.security.csp.frame' ) ?></label>
336
  </th>
337
  <td>
338
  <input id="browsercache_security_csp_frame" type="text" name="browsercache__security__csp__frame"
339
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.frame' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
340
- <div><i><?php _e( 'Restricts from where the protected resource can embed frames.' ) ?></i></div>
341
  </td>
342
  </tr>
343
  <tr>
344
  <th>
345
- <label for="browsercache_security_csp_img"><?php Util_Ui::e_config_label( 'browsercache.security.csp.img' ) ?></label>
346
  </th>
347
  <td>
348
  <input id="browsercache_security_csp_img" type="text" name="browsercache__security__csp__img"
349
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.img' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
350
- <div><i><?php _e( 'Specifies valid sources for images and favicons.' ) ?></i></div>
351
  </td>
352
  </tr>
353
  <tr>
354
  <th>
355
- <label for="browsercache_security_csp_media"><?php Util_Ui::e_config_label( 'browsercache.security.csp.media' ) ?></label>
356
  </th>
357
  <td>
358
  <input id="browsercache_security_csp_media" type="text" name="browsercache__security__csp__media"
359
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.media' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
360
- <div><i><?php _e( 'Specifies valid sources for loading media using the &lt;audio&gt; and &lt;video&gt; elements.' ) ?></i></div>
361
  </td>
362
  </tr>
363
  <tr>
364
  <th>
365
- <label for="browsercache_security_csp_object"><?php Util_Ui::e_config_label( 'browsercache.security.csp.object' ) ?></label>
366
  </th>
367
  <td>
368
  <input id="browsercache_security_csp_object" type="text" name="browsercache__security__csp__object"
369
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.object' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
370
- <div><i><?php _e( 'Allows control over the &lt;object&gt;, &lt;embed&gt;, and &lt;applet&gt; elements used by Flash and other plugins.' ) ?></i></div>
371
  </td>
372
  </tr>
373
  <tr>
374
  <th>
375
- <label for="browsercache_security_csp_script"><?php Util_Ui::e_config_label( 'browsercache.security.csp.script' ) ?></label>
376
  </th>
377
  <td>
378
  <input id="browsercache_security_csp_script" type="text" name="browsercache__security__csp__script"
379
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.script' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
380
- <div><i><?php _e( 'Specifies valid sources for JavaScript.' ) ?></i></div>
381
  </td>
382
  </tr>
383
  <tr>
384
  <th>
385
- <label for="browsercache_security_csp_style"><?php Util_Ui::e_config_label( 'browsercache.security.csp.style' ) ?></label>
386
  </th>
387
  <td>
388
  <input id="browsercache_security_csp_style" type="text" name="browsercache__security__csp__style"
389
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.style' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
390
- <div><i><?php _e( 'Specifies valid sources for <acronym title="Cascading Style Sheet">CSS</acronym> stylesheets.' ) ?></i></div>
391
  </td>
392
  </tr>
393
  <tr>
394
  <th>
395
- <label for="browsercache_security_csp_form"><?php Util_Ui::e_config_label( 'browsercache.security.csp.form' ) ?></label>
396
  </th>
397
  <td>
398
  <input id="browsercache_security_csp_form" type="text" name="browsercache__security__csp__form"
399
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.form' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
400
- <div><i><?php _e( 'Restricts the <acronym title="Uniform Resource Locator">URL</acronym>s which can be used as the target of form submissions from a given context.' ) ?></i></div>
401
  </td>
402
  </tr>
403
  <tr>
404
  <th>
405
- <label for="browsercache_security_csp_frame_ancestors"><?php Util_Ui::e_config_label( 'browsercache.security.csp.frame.ancestors' ) ?></label>
406
  </th>
407
  <td>
408
  <input id="browsercache_security_csp_frame_ancestors" type="text" name="browsercache__security__csp__frame__ancestors"
409
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.frame.ancestors' ) ) ?>" size="50" placeholder="Example: 'none'" />
410
- <div><i><?php _e( 'Specifies valid parents that may embed a page using &lt;frame&gt;, &lt;iframe&gt;, &lt;object&gt;, &lt;embed&gt;, or &lt;applet&gt;.' ) ?></i></div>
411
  </td>
412
  </tr>
413
  <tr>
414
  <th>
415
- <label for="browsercache_security_csp_plugin"><?php Util_Ui::e_config_label( 'browsercache.security.csp.plugin' ) ?></label>
416
  </th>
417
  <td>
418
  <input id="browsercache_security_csp_plugin" type="text" name="browsercache__security__csp__plugin"
419
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.plugin' ) ) ?>" size="50" placeholder="Example: application/x-shockwave-flash" />
420
- <div><i><?php _e( 'Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.' ) ?></i></div>
421
  </td>
422
  </tr>
423
  <tr>
424
  <th>
425
- <label for="browsercache_security_csp_sandbox"><?php Util_Ui::e_config_label( 'browsercache.security.csp.sandbox' ) ?></label>
426
  </th>
427
  <td>
428
  <input id="browsercache_security_csp_sandbox" type="text" name="browsercache__security__csp__sandbox"
429
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.sandbox' ) ) ?>" size="50" placeholder="Example: allow-popups" />
430
- <div><i><?php _e( 'This directive operates similarly to the &lt;iframe&gt; sandbox attribute by applying restrictions to a page\'s actions, including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy.' ) ?></i></div>
431
  </td>
432
  </tr>
433
  <tr>
434
  <th>
435
- <label for="browsercache_security_csp_default"><?php Util_Ui::e_config_label( 'browsercache.security.csp.default' ) ?></label>
436
  </th>
437
  <td>
438
  <input id="browsercache_security_csp_default" type="text" name="browsercache__security__csp__default"
439
- <?php Util_Ui::sealing_disabled( 'browsercache.' ) ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.default' ) ) ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
440
- <div><i><?php _e( 'Defines the defaults for directives you leave unspecified. Generally, this applies to any directive that ends with -src.' ) ?></i></div>
441
  </td>
442
  </tr>
443
  <?php
444
- Util_Ui::config_item( array(
445
- 'key' => 'browsercache.security.fp',
446
- 'disabled' => Util_Ui::sealing_disabled( 'browsercache.' ),
447
- 'control' => 'checkbox',
 
448
  'checkbox_label' => __( 'Feature-Policy', 'w3-total-cache' ),
449
- 'description' => __( 'Allows you to control which origins can use which features.', 'w3-total-cache' ),
450
- 'label_class' => 'w3tc_single_column'
451
- ) )
 
452
  ?>
453
 
454
- <?php foreach ( $feature_policies as $i ): ?>
455
- <?php
456
- Util_Ui::config_item( array(
457
- 'key' => 'browsercache.security.fp.values.keyvalues.' . $i['label'],
458
- 'value' => !empty( $fp_values[$i['label']] ) ? $fp_values[$i['label']] : '',
459
- 'disabled' => Util_Ui::sealing_disabled( 'browsercache.' ),
460
- 'control' => 'textbox',
461
- 'label' => $i['label'],
462
- 'textbox_size' => '50',
 
463
  'textbox_placeholder' => "One of: 'self' 'src' 'none' *.domain.com",
464
- 'description' => $i['description']
465
- ) )
466
- ?>
467
- <?php endforeach ?>
 
468
  </table>
469
 
470
- <?php Util_Ui::button_config_save( 'browsercache_security' ) ?>
471
- <?php Util_Ui::postbox_footer() ?>
1
  <?php
2
+ /**
3
+ * File: BrowserCache_Page_View_SectionSecurity.php
4
+ *
5
+ * @package W3TC
6
+ *
7
+ * phpcs:disable WordPress.Security.EscapeOutput
8
+ */
9
+
10
  namespace W3TC;
11
 
12
+ if ( ! defined( 'W3TC' ) ) {
13
  die();
14
+ }
15
 
16
+ $c = Dispatcher::config();
17
  $fp_values = $c->get_array( 'browsercache.security.fp.values' );
18
 
19
  $feature_policies = array(
20
  array(
21
+ 'label' => 'accelerometer',
22
+ 'description' => __( 'controls whether the current document is allowed to gather information about the acceleration of the device through the Accelerometer interface', 'w3-total-cache' ),
23
+ ),
24
+ array(
25
+ 'label' => 'ambient-light-sensor',
26
+ 'description' => __( 'controls whether the current document is allowed to gather information about the amount of light in the environment around the device through the AmbientLightSensor interface', 'w3-total-cache' ),
27
+ ),
28
+ array(
29
+ 'label' => 'autoplay',
30
+ 'description' => __( 'controls whether the current document is allowed to autoplay media requested through the HTMLMediaElement interface', 'w3-total-cache' ),
31
+ ),
32
+ array(
33
+ 'label' => 'camera',
34
+ 'description' => __( 'controls whether the current document is allowed to use video input devices', 'w3-total-cache' ),
35
+ ),
36
+ array(
37
+ 'label' => 'display-capture',
38
+ 'description' => __( 'controls whether or not the document is permitted to use Screen Capture API', 'w3-total-cache' ),
39
+ ),
40
+ array(
41
+ 'label' => 'document-domain',
42
+ 'description' => __( 'controls whether the current document is allowed to set document.domain', 'w3-total-cache' ),
43
+ ),
44
+ array(
45
+ 'label' => 'encrypted-media',
46
+ 'description' => __( 'controls whether the current document is allowed to use the Encrypted Media Extensions API (EME)', 'w3-total-cache' ),
47
+ ),
48
+ array(
49
+ 'label' => 'fullscreen',
50
+ 'description' => __( 'controls whether the current document is allowed to use Element.requestFullScreen()', 'w3-total-cache' ),
51
+ ),
52
+ array(
53
+ 'label' => 'geolocation',
54
+ 'description' => __( 'controls whether the current document is allowed to use the Geolocation Interface', 'w3-total-cache' ),
55
+ ),
56
+ array(
57
+ 'label' => 'gyroscope',
58
+ 'description' => __( 'controls whether the current document is allowed to gather information about the orientation of the device through the Gyroscope interface', 'w3-total-cache' ),
59
+ ),
60
+ array(
61
+ 'label' => 'layout-animations',
62
+ 'description' => __( 'controls whether the current document is allowed to show layout animations', 'w3-total-cache' ),
63
+ ),
64
+ array(
65
+ 'label' => 'legacy-image-formats',
66
+ 'description' => __( 'controls whether the current document is allowed to display images in legacy formats', 'w3-total-cache' ),
67
+ ),
68
+ array(
69
+ 'label' => 'magnetometer',
70
+ 'description' => __( 'controls whether the current document is allowed to gather information about the orientation of the device through the Magnetometer interface', 'w3-total-cache' ),
71
+ ),
72
+ array(
73
+ 'label' => 'microphone',
74
+ 'description' => __( 'controls whether the current document is allowed to use audio input devices', 'w3-total-cache' ),
75
+ ),
76
+ array(
77
+ 'label' => 'midi',
78
+ 'description' => __( 'controls whether the current document is allowed to use the Web MIDI API', 'w3-total-cache' ),
79
+ ),
80
+ array(
81
+ 'label' => 'oversized-images',
82
+ 'description' => __( 'controls whether the current document is allowed to download and display large images', 'w3-total-cache' ),
83
+ ),
84
+ array(
85
+ 'label' => 'payment',
86
+ 'description' => __( 'controls whether the current document is allowed to use the Payment Request API', 'w3-total-cache' ),
87
+ ),
88
+ array(
89
+ 'label' => 'picture-in-picture',
90
+ 'description' => __( 'controls whether the current document is allowed to play a video in a Picture-in-Picture mode via the corresponding API', 'w3-total-cache' ),
91
+ ),
92
+ array(
93
+ 'label' => 'publickey-credentials',
94
+ 'description' => __( 'controls whether the current document is allowed to access Web Authentcation API', 'w3-total-cache' ),
95
+ ),
96
+ array(
97
+ 'label' => 'speaker',
98
+ 'description' => __( 'controls whether the current document is allowed to play audio via any methods', 'w3-total-cache' ),
99
+ ),
100
+ array(
101
+ 'label' => 'sync-xhr',
102
+ 'description' => __( 'controls whether the current document is allowed to make synchronous XMLHttpRequest requests', 'w3-total-cache' ),
103
+ ),
104
+ array(
105
+ 'label' => 'unoptimized-images',
106
+ 'description' => __( 'controls whether the current document is allowed to download and display unoptimized images', 'w3-total-cache' ),
107
+ ),
108
+ array(
109
+ 'label' => 'unsized-media',
110
+ 'description' => __( 'controls whether the current document is allowed to change the size of media elements after the initial layout is complete', 'w3-total-cache' ),
111
+ ),
112
+ array(
113
+ 'label' => 'usb',
114
+ 'description' => __( 'controls whether the current document is allowed to use the WebUSB API', 'w3-total-cache' ),
115
+ ),
116
+ array(
117
+ 'label' => 'vibrate',
118
+ 'description' => __( 'directive controls whether the current document is allowed to trigger device vibrations via Vibration API', 'w3-total-cache' ),
119
+ ),
120
+ array(
121
+ 'label' => 'wake-lock',
122
+ 'description' => __( 'controls whether the current document is allowed to use Wake Lock API to indicate that device should not enter power-saving mode', 'w3-total-cache' ),
123
+ ),
124
+ array(
125
+ 'label' => 'xr-spatial-tracking',
126
+ 'description' => __( 'controls whether the current document is allowed to use the WebXR Device API.', 'w3-total-cache' ),
127
+ ),
128
  );
129
 
130
  ?>
131
+
132
+ <?php Util_Ui::postbox_header( __( 'Security Headers', 'w3-total-cache' ), '', 'security' ); ?>
133
+ <p><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> security headers provide another layer of protection for your website by helping to mitigate attacks and security vulnerabilities.', 'w3-total-cache' ); ?></p>
134
  <p><a onclick="w3tc_csp_reference()" href="javascript:void(0);">Quick Reference Chart</a></p>
135
 
136
  <table class="form-table">
137
  <?php
138
+ Util_Ui::config_item(
139
+ array(
140
+ 'key' => 'browsercache.security.session.use_only_cookies',
141
+ 'control' => 'selectbox',
142
  'selectbox_values' => $security_session_values,
143
+ 'description' => __( 'This setting prevents attacks that are caused by passing session IDs in <acronym title="Uniform Resource Locator">URL</acronym>s.', 'w3-total-cache' ),
144
+ )
145
+ );
146
  ?>
147
  <?php
148
+ Util_Ui::config_item(
149
+ array(
150
+ 'key' => 'browsercache.security.session.cookie_httponly',
151
+ 'control' => 'selectbox',
152
  'selectbox_values' => $security_session_values,
153
+ 'description' => __( 'This tells the user\'s browser not to make the session cookie accessible to client side scripting such as JavaScript. This makes it harder for an attacker to hijack the session ID and masquerade as the effected user.', 'w3-total-cache' ),
154
+ )
155
+ );
156
  ?>
157
  <?php
158
+ Util_Ui::config_item(
159
+ array(
160
+ 'key' => 'browsercache.security.session.cookie_secure',
161
+ 'control' => 'selectbox',
162
  'selectbox_values' => $security_session_values,
163
+ 'description' => __( 'This will prevent the user\'s session ID from being transmitted in plain text, making it much harder to hijack the user\'s session.', 'w3-total-cache' ),
164
+ )
165
+ );
166
  ?>
167
  <tr>
168
  <th colspan="2">
169
+ <?php $this->checkbox( 'browsercache.hsts' ); ?> <?php Util_Ui::e_config_label( 'browsercache.hsts' ); ?></label>
170
+ <p class="description"><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> Strict-Transport-Security (<acronym title="HTTP Strict Transport Security">HSTS</acronym>) enforces secure (<acronym title="Hypertext Transfer Protocol">HTTP</acronym> over <acronym title="Secure Sockets Layer">SSL</acronym>/<acronym title="Transport Layer Security">TLS</acronym>) connections to the server. This can help mitigate adverse effects caused by bugs and session leaks through cookies and links. It also helps defend against man-in-the-middle attacks. If there are <acronym title="Secure Sockets Layer">SSL</acronym> negotiation warnings then users will not be permitted to ignore them.', 'w3-total-cache' ); ?></p>
171
  </th>
172
  </tr>
173
  <tr>
174
  <th>
175
+ <label for="browsercache_security_hsts_directive"><?php Util_Ui::e_config_label( 'browsercache.security.hsts.directive' ); ?></label>
176
  </th>
177
  <td>
178
  <select id="browsercache_security_hsts_directive"
179
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
180
  name="browsercache__security__hsts__directive">
181
+ <?php $value = $this->_config->get_string( 'browsercache.security.hsts.directive' ); ?>
182
+ <option value="maxage"<?php selected( $value, 'maxage' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS', 'w3-total-cache' ); ?></option>
183
+ <option value="maxagepre"<?php selected( $value, 'maxagepre' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS; preload', 'w3-total-cache' ); ?></option>
184
+ <option value="maxageinc"<?php selected( $value, 'maxageinc' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains', 'w3-total-cache' ); ?></option>
185
+ <option value="maxageincpre"<?php selected( $value, 'maxageincpre' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains; preload', 'w3-total-cache' ); ?></option>
186
  </select>
187
  <div id="browsercache_security_hsts_directive_description"></div>
188
  </td>
189
  </tr>
190
  <tr>
191
  <th colspan="2">
192
+ <?php $this->checkbox( 'browsercache.security.xfo' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.xfo' ); ?></label>
193
+ <p class="description"><?php _e( 'This tells the browser if it is permitted to render a page within a frame-like tag (i.e., &lt;frame&gt;, &lt;iframe&gt; or &lt;object&gt;). This is useful for preventing clickjacking attacks.', 'w3-total-cache' ); ?></p>
194
  </th>
195
  </tr>
196
  <tr>
197
  <th>
198
+ <label for="browsercache_security_xfo_directive"><?php Util_Ui::e_config_label( 'browsercache.security.xfo.directive' ); ?></label>
199
  </th>
200
  <td>
201
  <select id="browsercache_security_xfo_directive"
202
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
203
  name="browsercache__security__xfo__directive">
204
+ <?php $value = $this->_config->get_string( 'browsercache.security.xfo.directive' ); ?>
205
+ <option value="same"<?php selected( $value, 'same' ); ?>><?php _e( 'SameOrigin', 'w3-total-cache' ); ?></option>
206
+ <option value="deny"<?php selected( $value, 'deny' ); ?>><?php _e( 'Deny', 'w3-total-cache' ); ?></option>
207
+ <option value="allow"<?php selected( $value, 'allow' ); ?>><?php _e( 'Allow-From', 'w3-total-cache' ); ?></option>
208
  </select>
209
  <input id="browsercache_security_xfo_allow" type="text" name="browsercache__security__xfo__allow"
210
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.xfo.allow' ) ); ?>" size="50" placeholder="Enter URL" />
211
  <div id="browsercache_security_xfo_directive_description"></div>
212
  </td>
213
  </tr>
214
  <tr>
215
  <th colspan="2">
216
+ <?php $this->checkbox( 'browsercache.security.xss' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.xss' ); ?></label>
217
+ <p class="description"><?php _e( 'This header enables the <acronym title="Cross-Site Scripting">XSS</acronym> filter. It helps to stop malicious scripts from being injected into your website. Although this is already built into and enabled by default in most browsers today it is made available here to enforce its reactivation if it was disabled within the user\'s browser.', 'w3-total-cache' ); ?></p>
218
  </th>
219
  </tr>
220
  <tr>
221
  <th>
222
+ <label for="browsercache_security_xss_directive"><?php Util_Ui::e_config_label( 'browsercache.security.xss.directive' ); ?></label>
223
  </th>
224
  <td>
225
  <select id="browsercache_security_xss_directive"
226
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
227
  name="browsercache__security__xss__directive">
228
+ <?php $value = $this->_config->get_string( 'browsercache.security.xss.directive' ); ?>
229
+ <option value="0"<?php selected( $value, '0' ); ?>><?php _e( '0', 'w3-total-cache' ); ?></option>
230
+ <option value="1"<?php selected( $value, '1' ); ?>><?php _e( '1', 'w3-total-cache' ); ?></option>
231
+ <option value="block"<?php selected( $value, 'block' ); ?>><?php _e( '1; mode=block', 'w3-total-cache' ); ?></option>
232
  </select>
233
  <div id="browsercache_security_xss_directive_description"></div>
234
  </td>
235
  </tr>
236
  <tr>
237
  <th colspan="2">
238
+ <?php $this->checkbox( 'browsercache.security.xcto' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.xcto' ); ?></label>
239
+ <p class="description"><?php _e( 'This instructs the browser to not MIME-sniff a response outside its declared content-type. It helps to reduce drive-by download attacks and stops sites from serving malevolent content that could masquerade as an executable or dynamic HTML file.', 'w3-total-cache' ); ?></p>
240
  </th>
241
  </tr>
242
  <tr>
243
  <th colspan="2">
244
+ <?php $this->checkbox( 'browsercache.security.pkp' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.pkp' ); ?></label>
245
+ <p class="description"><?php _e( '<acronym title="Hypertext Transfer Protocol">HTTP</acronym> Public Key Pinning (<acronym title="HTTP Public Key Pinning">HPKP</acronym>) is a security feature for <acronym title="Hypertext Transfer Protocol">HTTP</acronym>S websites that can prevent fraudulently issued certificates from being used to impersonate existing secure websites.', 'w3-total-cache' ); ?></p>
246
  </th>
247
  </tr>
248
  <tr>
249
  <th>
250
+ <label for="browsercache_security_pkp_pin"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.pin' ); ?></label>
251
  </th>
252
  <td>
253
  <input id="browsercache_security_pkp_pin" type="text" name="browsercache__security__pkp__pin"
254
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.pin' ) ); ?>" size="50" placeholder="Enter the Base64-Encode of the SHA256 Hash" />
255
+ <div><i><?php _e( 'This field is <b>required</b> and represents a <acronym title="Subject Public Key Information">SPKI</acronym> fingerprint. This pin is any public key within your current certificate chain.', 'w3-total-cache' ); ?></i></div>
256
  </td>
257
  </tr>
258
  <tr>
259
  <th>
260
+ <label for="browsercache_security_pkp_pin_backup"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.pin.backup' ); ?></label>
261
  </th>
262
  <td>
263
  <input id="browsercache_security_pkp_pin_backup" type="text" name="browsercache__security__pkp__pin__backup"
264
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.pin.backup' ) ); ?>" size="50" placeholder="Enter the Base64-Encode of the SHA256 Hash" />
265
+ <div><i><?php _e( 'This field is <b>also required</b> and represents your backup <acronym title="Subject Public Key Information">SPKI</acronym> fingerprint. This pin is any public key not in your current certificate chain and serves as a backup in case your certificate expires or has to be revoked.', 'w3-total-cache' ); ?></i></div>
266
  </td>
267
  </tr>
268
  <tr>
269
  <th>
270
+ <label for="browsercache_security_pkp_extra"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.extra' ); ?></label>
271
  </th>
272
  <td>
273
  <select id="browsercache_security_pkp_extra"
274
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
275
  name="browsercache__security__pkp__extra">
276
+ <?php $value = $this->_config->get_string( 'browsercache.security.pkp.extra' ); ?>
277
+ <option value="maxage"<?php selected( $value, 'maxage' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS', 'w3-total-cache' ); ?></option>
278
+ <option value="maxageinc"<?php selected( $value, 'maxageinc' ); ?>><?php _e( 'max-age=EXPIRES_SECONDS; includeSubDomains', 'w3-total-cache' ); ?></option>
279
  </select>
280
  <div id="browsercache_security_pkp_extra_description"></div>
281
  </td>
282
  </tr>
283
  <tr>
284
  <th>
285
+ <label for="browsercache_security_pkp_report_url"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.report.url' ); ?></label>
286
  </th>
287
  <td>
288
  <input id="browsercache_security_pkp_report_url" type="text" name="browsercache__security__pkp__report__url"
289
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.pkp.report.url' ) ); ?>" size="50" placeholder="Enter URL" />
290
+ <div><i><?php _e( 'This optional field can be used to specify a <acronym title="Uniform Resource Locator">URL</acronym> that clients will send reports to if pin validation failures occur. The report is sent as a POST request with a JSON body.', 'w3-total-cache' ); ?></i></div>
291
  </td>
292
  </tr>
293
  <tr>
294
  <th>
295
+ <label for="browsercache_security_pkp_report_only"><?php Util_Ui::e_config_label( 'browsercache.security.pkp.report.only' ); ?></label>
296
  </th>
297
  <td>
298
  <select id="browsercache_security_pkp_report_only"
299
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
300
  name="browsercache__security__pkp__report__only">
301
+ <?php $value = $this->_config->get_string( 'browsercache.security.pkp.report.only' ); ?>
302
+ <option value="0"<?php selected( $value, '0' ); ?>><?php _e( 'No = Enforce HPKP', 'w3-total-cache' ); ?></option>
303
+ <option value="1"<?php selected( $value, '1' ); ?>><?php _e( 'Yes = Don\'t Enforce HPKP', 'w3-total-cache' ); ?></option>
304
  </select>
305
  <div id="browsercache_security_pkp_report_only_description"></div>
306
  </td>
307
  </tr>
308
  <tr>
309
  <th colspan="2">
310
+ <?php $this->checkbox( 'browsercache.security.referrer.policy' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.referrer.policy' ); ?></label>
311
+ <p class="description"><?php _e( 'This header restricts the values of the referer header in outbound links.', 'w3-total-cache' ); ?></p>
312
  </th>
313
  </tr>
314
  <tr>
315
  <th>
316
+ <label for="browsercache_security_referrer_policy_directive"><?php Util_Ui::e_config_label( 'browsercache.security.referrer.policy.directive' ); ?></label>
317
  </th>
318
  <td>
319
  <select id="browsercache_security_referrer_policy_directive"
320
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?>
321
  name="browsercache__security__referrer__policy__directive">
322
+ <?php $value = $this->_config->get_string( 'browsercache.security.referrer.policy.directive' ); ?>
323
+ <option value="0"<?php selected( $value, '0' ); ?>><?php _e( 'Not Set', 'w3-total-cache' ); ?></option>
324
+ <option value="no-referrer"<?php selected( $value, 'no-referrer' ); ?>><?php _e( 'no-referrer', 'w3-total-cache' ); ?></option>
325
+ <option value="no-referrer-when-downgrade"<?php selected( $value, 'no-referrer-when-downgrade' ); ?>><?php _e( 'no-referrer-when-downgrade', 'w3-total-cache' ); ?></option>
326
+ <option value="same-origin"<?php selected( $value, 'same-origin' ); ?>><?php _e( 'same-origin', 'w3-total-cache' ); ?></option>
327
+ <option value="origin"<?php selected( $value, 'origin' ); ?>><?php _e( 'origin', 'w3-total-cache' ); ?></option>
328
+ <option value="strict-origin"<?php selected( $value, 'strict-origin' ); ?>><?php _e( 'strict-origin', 'w3-total-cache' ); ?></option>
329
+ <option value="origin-when-cross-origin"<?php selected( $value, 'origin-when-cross-origin' ); ?>><?php _e( 'origin-when-cross-origin', 'w3-total-cache' ); ?></option>
330
+ <option value="strict-origin-when-cross-origin"<?php selected( $value, 'strict-origin-when-cross-origin' ); ?>><?php _e( 'strict-origin-when-cross-origin', 'w3-total-cache' ); ?></option>
331
+ <option value="unsafe-url"<?php selected( $value, 'unsafe-url' ); ?>><?php _e( 'unsafe-url', 'w3-total-cache' ); ?></option>
332
  </select>
333
  <div id="browsercache_security_referrer_policy_directive_description"></div>
334
  </td>
335
  </tr>
336
  <tr>
337
  <th colspan="2">
338
+ <?php $this->checkbox( 'browsercache.security.csp' ); ?> <?php Util_Ui::e_config_label( 'browsercache.security.csp' ); ?></label>
339
+ <p class="description"><?php _e( 'The Content Security Policy (<acronym title="Content Security Policy">CSP</acronym>) header reduces the risk of <acronym title="Cross-Site Scripting">XSS</acronym> attacks by allowing you to define where resources can be retrieved from, preventing browsers from loading data from any other locations. This makes it harder for an attacker to inject malicious code into your site.', 'w3-total-cache' ); ?></p>
340
  </th>
341
  </tr>
342
  <tr>
343
  <th>
344
+ <label for="browsercache_security_csp_base"><?php Util_Ui::e_config_label( 'browsercache.security.csp.base' ); ?></label>
345
  </th>
346
  <td>
347
  <input id="browsercache_security_csp_base" type="text" name="browsercache__security__csp__base"
348
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.base' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
349
+ <div><i><?php _e( 'Restricts the <acronym title="Uniform Resource Locator">URL</acronym>s which can be used in a document\'s &lt;base&gt; element.', 'w3-total-cache' ); ?></i></div>
350
  </td>
351
  </tr>
352
  <tr>
353
  <th>
354
+ <label for="browsercache_security_csp_connect"><?php Util_Ui::e_config_label( 'browsercache.security.csp.connect' ); ?></label>
355
  </th>
356
  <td>
357
  <input id="browsercache_security_csp_connect" type="text" name="browsercache__security__csp__connect"
358
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.connect' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
359
+ <div><i><?php _e( 'Limits the origins to which you can connect via XMLHttpRequest, WebSockets, and EventSource.', 'w3-total-cache' ); ?></i></div>
360
  </td>
361
  </tr>
362
  <tr>
363
  <th>
364
+ <label for="browsercache_security_csp_font"><?php Util_Ui::e_config_label( 'browsercache.security.csp.font' ); ?></label>
365
  </th>
366
  <td>
367
  <input id="browsercache_security_csp_font" type="text" name="browsercache__security__csp__font"
368
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.font' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
369
+ <div><i><?php _e( 'Specifies the origins that can serve web fonts.', 'w3-total-cache' ); ?></i></div>
370
  </td>
371
  </tr>
372
  <tr>
373
  <th>
374
+ <label for="browsercache_security_csp_frame"><?php Util_Ui::e_config_label( 'browsercache.security.csp.frame' ); ?></label>
375
  </th>
376
  <td>
377
  <input id="browsercache_security_csp_frame" type="text" name="browsercache__security__csp__frame"
378
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.frame' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
379
+ <div><i><?php _e( 'Restricts from where the protected resource can embed frames.', 'w3-total-cache' ); ?></i></div>
380
  </td>
381
  </tr>
382
  <tr>
383
  <th>
384
+ <label for="browsercache_security_csp_img"><?php Util_Ui::e_config_label( 'browsercache.security.csp.img' ); ?></label>
385
  </th>
386
  <td>
387
  <input id="browsercache_security_csp_img" type="text" name="browsercache__security__csp__img"
388
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.img' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
389
+ <div><i><?php _e( 'Specifies valid sources for images and favicons.', 'w3-total-cache' ); ?></i></div>
390
  </td>
391
  </tr>
392
  <tr>
393
  <th>
394
+ <label for="browsercache_security_csp_media"><?php Util_Ui::e_config_label( 'browsercache.security.csp.media' ); ?></label>
395
  </th>
396
  <td>
397
  <input id="browsercache_security_csp_media" type="text" name="browsercache__security__csp__media"
398
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.media' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
399
+ <div><i><?php _e( 'Specifies valid sources for loading media using the &lt;audio&gt; and &lt;video&gt; elements.', 'w3-total-cache' ); ?></i></div>
400
  </td>
401
  </tr>
402
  <tr>
403
  <th>
404
+ <label for="browsercache_security_csp_object"><?php Util_Ui::e_config_label( 'browsercache.security.csp.object' ); ?></label>
405
  </th>
406
  <td>
407
  <input id="browsercache_security_csp_object" type="text" name="browsercache__security__csp__object"
408
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.object' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
409
+ <div><i><?php _e( 'Allows control over the &lt;object&gt;, &lt;embed&gt;, and &lt;applet&gt; elements used by Flash and other plugins.', 'w3-total-cache' ); ?></i></div>
410
  </td>
411
  </tr>
412
  <tr>
413
  <th>
414
+ <label for="browsercache_security_csp_script"><?php Util_Ui::e_config_label( 'browsercache.security.csp.script' ); ?></label>
415
  </th>
416
  <td>
417
  <input id="browsercache_security_csp_script" type="text" name="browsercache__security__csp__script"
418
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.script' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
419
+ <div><i><?php _e( 'Specifies valid sources for JavaScript.', 'w3-total-cache' ); ?></i></div>
420
  </td>
421
  </tr>
422
  <tr>
423
  <th>
424
+ <label for="browsercache_security_csp_style"><?php Util_Ui::e_config_label( 'browsercache.security.csp.style' ); ?></label>
425
  </th>
426
  <td>
427
  <input id="browsercache_security_csp_style" type="text" name="browsercache__security__csp__style"
428
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.style' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
429
+ <div><i><?php _e( 'Specifies valid sources for <acronym title="Cascading Style Sheet">CSS</acronym> stylesheets.', 'w3-total-cache' ); ?></i></div>
430
  </td>
431
  </tr>
432
  <tr>
433
  <th>
434
+ <label for="browsercache_security_csp_form"><?php Util_Ui::e_config_label( 'browsercache.security.csp.form' ); ?></label>
435
  </th>
436
  <td>
437
  <input id="browsercache_security_csp_form" type="text" name="browsercache__security__csp__form"
438
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.form' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
439
+ <div><i><?php _e( 'Restricts the <acronym title="Uniform Resource Locator">URL</acronym>s which can be used as the target of form submissions from a given context.', 'w3-total-cache' ); ?></i></div>
440
  </td>
441
  </tr>
442
  <tr>
443
  <th>
444
+ <label for="browsercache_security_csp_frame_ancestors"><?php Util_Ui::e_config_label( 'browsercache.security.csp.frame.ancestors' ); ?></label>
445
  </th>
446
  <td>
447
  <input id="browsercache_security_csp_frame_ancestors" type="text" name="browsercache__security__csp__frame__ancestors"
448
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.frame.ancestors' ) ); ?>" size="50" placeholder="Example: 'none'" />
449
+ <div><i><?php _e( 'Specifies valid parents that may embed a page using &lt;frame&gt;, &lt;iframe&gt;, &lt;object&gt;, &lt;embed&gt;, or &lt;applet&gt;.', 'w3-total-cache' ); ?></i></div>
450
  </td>
451
  </tr>
452
  <tr>
453
  <th>
454
+ <label for="browsercache_security_csp_plugin"><?php Util_Ui::e_config_label( 'browsercache.security.csp.plugin' ); ?></label>
455
  </th>
456
  <td>
457
  <input id="browsercache_security_csp_plugin" type="text" name="browsercache__security__csp__plugin"
458
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.plugin' ) ); ?>" size="50" placeholder="Example: application/x-shockwave-flash" />
459
+ <div><i><?php _e( 'Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.', 'w3-total-cache' ); ?></i></div>
460
  </td>
461
  </tr>
462
  <tr>
463
  <th>
464
+ <label for="browsercache_security_csp_sandbox"><?php Util_Ui::e_config_label( 'browsercache.security.csp.sandbox' ); ?></label>
465
  </th>
466
  <td>
467
  <input id="browsercache_security_csp_sandbox" type="text" name="browsercache__security__csp__sandbox"
468
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.sandbox' ) ); ?>" size="50" placeholder="Example: allow-popups" />
469
+ <div><i><?php _e( 'This directive operates similarly to the &lt;iframe&gt; sandbox attribute by applying restrictions to a page\'s actions, including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy.', 'w3-total-cache' ); ?></i></div>
470
  </td>
471
  </tr>
472
  <tr>
473
  <th>
474
+ <label for="browsercache_security_csp_default"><?php Util_Ui::e_config_label( 'browsercache.security.csp.default' ); ?></label>
475
  </th>
476
  <td>
477
  <input id="browsercache_security_csp_default" type="text" name="browsercache__security__csp__default"
478
+ <?php Util_Ui::sealing_disabled( 'browsercache.' ); ?> value="<?php echo esc_attr( $this->_config->get_string( 'browsercache.security.csp.default' ) ); ?>" size="50" placeholder="Example: 'self' 'unsafe-inline' *.domain.com" />
479
+ <div><i><?php _e( 'Defines the defaults for directives you leave unspecified. Generally, this applies to any directive that ends with -src.', 'w3-total-cache' ); ?></i></div>
480
  </td>
481
  </tr>
482
  <?php
483
+ Util_Ui::config_item(
484
+ array(
485
+ 'key' => 'browsercache.security.fp',
486
+ 'disabled' => Util_Ui::sealing_disabled( 'browsercache.' ),
487
+ 'control' => 'checkbox',
488
  'checkbox_label' => __( 'Feature-Policy', 'w3-total-cache' ),
489
+ 'description' => __( 'Allows you to control which origins can use which features.', 'w3-total-cache' ),
490
+ 'label_class' => 'w3tc_single_column',
491
+ )
492
+ );
493
  ?>
494
 
495
+ <?php
496
+ foreach ( $feature_policies as $i ) {
497
+ Util_Ui::config_item(
498
+ array(
499
+ 'key' => 'browsercache.security.fp.values.keyvalues.' . $i['label'],
500
+ 'value' => ! empty( $fp_values[ $i['label'] ] ) ? $fp_values[ $i['label'] ] : '',
501
+ 'disabled' => Util_Ui::sealing_disabled( 'browsercache.' ),
502
+ 'control' => 'textbox',
503
+ 'label' => $i['label'],
504
+ 'textbox_size' => '50',
505
  'textbox_placeholder' => "One of: 'self' 'src' 'none' *.domain.com",
506
+ 'description' => $i['description'],
507
+ )
508
+ );
509
+ }
510
+ ?>
511
  </table>
512
 
513
+ <?php Util_Ui::button_config_save( 'browsercache_security' ); ?>
514
+ <?php Util_Ui::postbox_footer(); ?>
Cdnfsd_CloudFront_Engine.php CHANGED
@@ -54,7 +54,7 @@ class Cdnfsd_CloudFront_Engine {
54
  */
55
  public function flush_all() {
56
  $api = $this->_api();
57
- $uris = array( '/*' );
58
 
59
  $api->createInvalidation( array(
60
  'DistributionId' => $this->distribution_id,
54
  */
55
  public function flush_all() {
56
  $api = $this->_api();
57
+ $uris = apply_filters( 'w3tc_cdn_cf_flush_all_uris', array( '/*' ) );
58
 
59
  $api->createInvalidation( array(
60
  'DistributionId' => $this->distribution_id,
Extension_CloudFlare_Widget_Logo.png CHANGED
Binary file
Extensions_Page.php CHANGED
@@ -39,7 +39,7 @@ class Extensions_Page extends Base_Page_Settings {
39
  }
40
 
41
  if ( isset( $_GET['extension'] ) ) {
42
- $extension = $_GET['extension'];
43
  }
44
 
45
  $view = ( isset( $_GET['action'] ) && $_GET['action'] == 'view' );
39
  }
40
 
41
  if ( isset( $_GET['extension'] ) ) {
42
+ $extension = esc_attr( $_GET['extension'] );
43
  }
44
 
45
  $view = ( isset( $_GET['action'] ) && $_GET['action'] == 'view' );
Generic_AdminActions_Default.php CHANGED
@@ -367,7 +367,7 @@ class Generic_AdminActions_Default {
367
  $cdn_domains = array();
368
 
369
  foreach ( $cdn_cnames as $cdn_cname ) {
370
- $cdn_cname = preg_replace( '~[^0-9a-zA-Z.:\-]~', '', strip_tags( $cdn_cname ) );
371
 
372
  /**
373
  * Auto expand wildcard domain to 10 subdomains
367
  $cdn_domains = array();
368
 
369
  foreach ( $cdn_cnames as $cdn_cname ) {
370
+ $cdn_cname = preg_replace( '~[^0-9a-zA-Z/_.:\-]~', '', wp_strip_all_tags( $cdn_cname ) );
371
 
372
  /**
373
  * Auto expand wildcard domain to 10 subdomains
Generic_Plugin_Admin.php CHANGED
@@ -321,7 +321,7 @@ class Generic_Plugin_Admin {
321
  'dimension9': '<?php echo esc_attr( $state->get_string( 'common.install_version' ) ) ?>',
322
  'dimension10': '<?php echo esc_attr( Util_Environment::w3tc_edition( $this->_config ) ) ?>',
323
  'dimension11': '<?php echo esc_attr( Util_Widget::list_widgets() ) ?>',
324
- 'page': '<?php echo $page ?>'
325
  });
326
 
327
  w3tc_ga('send', 'pageview');
321
  'dimension9': '<?php echo esc_attr( $state->get_string( 'common.install_version' ) ) ?>',
322
  'dimension10': '<?php echo esc_attr( Util_Environment::w3tc_edition( $this->_config ) ) ?>',
323
  'dimension11': '<?php echo esc_attr( Util_Widget::list_widgets() ) ?>',
324
+ 'page': '<?php echo wp_strip_all_tags( $page ); ?>'
325
  });
326
 
327
  w3tc_ga('send', 'pageview');
PgCache_Environment.php CHANGED
@@ -1213,8 +1213,12 @@ class PgCache_Environment {
1213
  }
1214
 
1215
  $rules .= ' default_type text/html;' . "\n";
 
 
 
 
1216
  $rules .= ' if ($w3tc_rewrite = 1) {' . "\n";
1217
- $rules .= ' memcached_pass localhost:11211;' . "\n";
1218
  $rules .= " }\n";
1219
  $rules .= ' error_page 404 502 504 = @fallback;' . "\n";
1220
  $rules .= "}\n";
1213
  }
1214
 
1215
  $rules .= ' default_type text/html;' . "\n";
1216
+
1217
+ $memcached_servers = $config->get_array( 'pgcache.memcached.servers' );
1218
+ $memcached_pass = !empty( $memcached_servers ) ? array_values( $memcached_servers )[0] : 'localhost:11211';
1219
+
1220
  $rules .= ' if ($w3tc_rewrite = 1) {' . "\n";
1221
+ $rules .= ' memcached_pass' . $memcached_pass . ';' . "\n";
1222
  $rules .= " }\n";
1223
  $rules .= ' error_page 404 502 504 = @fallback;' . "\n";
1224
  $rules .= "}\n";
UserExperience_LazyLoad_Mutator.php CHANGED
@@ -237,8 +237,10 @@ class UserExperience_LazyLoad_Mutator {
237
 
238
  private function is_content_excluded( $content ) {
239
  foreach ( $this->excludes as $w ) {
240
- if ( strpos( $content, $w ) !== FALSE ) {
241
- return true;
 
 
242
  }
243
  }
244
 
237
 
238
  private function is_content_excluded( $content ) {
239
  foreach ( $this->excludes as $w ) {
240
+ if ( !empty($w) ) {
241
+ if ( strpos( $content, $w ) !== FALSE ) {
242
+ return true;
243
+ }
244
  }
245
  }
246
 
pub/img/W3TC_dashboard_logo_title-retina.png CHANGED
Binary file
pub/img/button-grad-active.png CHANGED
Binary file
pub/img/button-grad.png CHANGED
Binary file
pub/img/cdn-highwinds-logo.png CHANGED
Binary file
pub/img/close.png CHANGED
Binary file
pub/img/google-logo.png CHANGED
Binary file
pub/img/moon-bottom-left.png CHANGED
Binary file
pub/img/moon-bottom-right.png CHANGED
Binary file
pub/img/open.png CHANGED
Binary file
pub/img/overlay/gauge-bg-tp.png CHANGED
Binary file
pub/img/overlay/gray-check.png CHANGED
Binary file
pub/img/overlay/lite-gray-check.png CHANGED
Binary file
pub/img/overlay/lock.png CHANGED
Binary file
pub/img/overlay/overlay-close.png CHANGED
Binary file
pub/img/overlay/overlay-down-arrow.png CHANGED
Binary file
pub/img/overlay/save-close.png CHANGED
Binary file
pub/img/overlay/select-arrow.png CHANGED
Binary file
pub/img/overlay/twitter-bird-dark-bgs.png CHANGED
Binary file
pub/img/overlay/wordpress-logo-simplified-rgb.png CHANGED
Binary file
pub/img/ps_scores.png CHANGED
Binary file
pub/img/sidebar-background.png CHANGED
Binary file
pub/img/stats-bg.png CHANGED
Binary file
pub/img/transparent-comet-moon.png CHANGED
Binary file
pub/img/transparent-comet.png CHANGED
Binary file
pub/img/usage-statistics-widget.png CHANGED
Binary file
pub/img/w3tc_cube-shadow.png CHANGED
Binary file
pub/img/w3tc_google-logo-retina.png CHANGED
Binary file
pub/img/w3tc_google-logo.png CHANGED
Binary file
pub/img/w3tc_maxcdn-logo-retina.png CHANGED
Binary file
pub/img/w3tc_maxcdn-logo.png CHANGED
Binary file
pub/img/w3tc_netdna-logo-retina.png CHANGED
Binary file
pub/img/w3tc_netdna-logo.png CHANGED
Binary file
pub/img/w3tc_newrelic-logo-retina.png CHANGED
Binary file
pub/img/w3tc_newrelic-logo.png CHANGED
Binary file
pub/img/w3tc_swarmify-logo-retina.png CHANGED
Binary file
pub/img/w3tc_swarmify-logo.png CHANGED
Binary file
pub/img/w3tc_w3edge-logo-retina.png CHANGED
Binary file
pub/img/w3tc_w3edge-logo.png CHANGED
Binary file
pub/img/w3tc_w3tc-logo.png CHANGED
Binary file
pub/img/white-grad-active.png CHANGED
Binary file
pub/img/white-grad.png CHANGED
Binary file
readme.txt CHANGED
@@ -3,7 +3,7 @@ Contributors: boldgrid, fredericktownes, maxicusc, gidomanders, bwmarkle, harryj
3
  Tags: seo, cache, optimize, pagespeed, performance, caching, compression, maxcdn, nginx, varnish, redis, new relic, aws, amazon web services, s3, cloudfront, rackspace, cloudflare, azure, apache
4
  Requires at least: 3.8
5
  Tested up to: 5.7
6
- Stable tag: 2.1.3
7
  License: GPLv2 or later
8
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
9
 
@@ -275,6 +275,14 @@ Please reach out to all of these people and support their projects if you're so
275
 
276
  == Changelog ==
277
 
 
 
 
 
 
 
 
 
278
  = 2.1.3 =
279
  * Fix: Authenticated Persistent XSS & XFS in CDN admin page
280
  * Update: AWS library version 3.183.0
3
  Tags: seo, cache, optimize, pagespeed, performance, caching, compression, maxcdn, nginx, varnish, redis, new relic, aws, amazon web services, s3, cloudfront, rackspace, cloudflare, azure, apache
4
  Requires at least: 3.8
5
  Tested up to: 5.7
6
+ Stable tag: 2.1.4
7
  License: GPLv2 or later
8
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
9
 
275
 
276
  == Changelog ==
277
 
278
+ = 2.1.4 =
279
+ * Fix: Sanitize extension argument
280
+ * Fix: Use Memcached server from config for Nginx rules instead of localhost
281
+ * Fix: Allow more characters in CDN hostname sanitization
282
+ * Fix: Added missing textdomains for Browser Cache settings
283
+ * Fix: Avoid a possible PHP warning in LazyLoad mutator
284
+ * Enhancement: Added a filter w3tc_cdn_cf_flush_all_uris for CloudFront purging
285
+
286
  = 2.1.3 =
287
  * Fix: Authenticated Persistent XSS & XFS in CDN admin page
288
  * Update: AWS library version 3.183.0
w3-total-cache-api.php CHANGED
@@ -5,7 +5,7 @@ if ( !defined( 'ABSPATH' ) ) {
5
  }
6
 
7
  define( 'W3TC', true );
8
- define( 'W3TC_VERSION', '2.1.3' );
9
  define( 'W3TC_POWERED_BY', 'W3 Total Cache' );
10
  define( 'W3TC_EMAIL', 'w3tc@w3-edge.com' );
11
  define( 'W3TC_TEXT_DOMAIN', 'w3-total-cache' );
5
  }
6
 
7
  define( 'W3TC', true );
8
+ define( 'W3TC_VERSION', '2.1.4' );
9
  define( 'W3TC_POWERED_BY', 'W3 Total Cache' );
10
  define( 'W3TC_EMAIL', 'w3tc@w3-edge.com' );
11
  define( 'W3TC_TEXT_DOMAIN', 'w3-total-cache' );
w3-total-cache.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: W3 Total Cache
4
  * Plugin URI: https://www.boldgrid.com/totalcache/
5
  * Description: The highest rated and most complete WordPress performance plugin. Dramatically improve the speed and user experience of your site. Add browser, page, object and database caching as well as minify and content delivery network (CDN) to WordPress.
6
- * Version: 2.1.3
7
  * Requires at least: 3.8
8
  * Requires PHP: 5.6
9
  * Author: BoldGrid
3
  * Plugin Name: W3 Total Cache
4
  * Plugin URI: https://www.boldgrid.com/totalcache/
5
  * Description: The highest rated and most complete WordPress performance plugin. Dramatically improve the speed and user experience of your site. Add browser, page, object and database caching as well as minify and content delivery network (CDN) to WordPress.
6
+ * Version: 2.1.4
7
  * Requires at least: 3.8
8
  * Requires PHP: 5.6
9
  * Author: BoldGrid