|
@@ -50,7 +50,7 @@ discard block |
|
|
block discarded – undo |
|
50
|
50
|
'X-Permitted-Cross-Domain-Policies' => ['none', null], |
|
51
|
51
|
]; |
|
52
|
52
|
|
|
53
|
|
- foreach ($urls as [$verb,$url,$validStatuses]) { |
|
|
53
|
+ foreach ($urls as [$verb, $url, $validStatuses]) { |
|
54
|
54
|
$works = null; |
|
55
|
55
|
foreach ($this->runRequest($verb, $url, ['httpErrors' => false]) as $response) { |
|
56
|
56
|
// Check that the response status matches |
|
@@ -65,9 +65,9 @@ discard block |
|
|
block discarded – undo |
|
65
|
65
|
$value = preg_replace('/,\s+/', ',', strtolower($response->getHeader($header))); |
|
66
|
66
|
if ($value !== $expected) { |
|
67
|
67
|
if ($accepted !== null && $value === $accepted) { |
|
68
|
|
- $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n"; |
|
|
68
|
+ $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected])."\n"; |
|
69
|
69
|
} else { |
|
70
|
|
- $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n"; |
|
|
70
|
+ $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected])."\n"; |
|
71
|
71
|
} |
|
72
|
72
|
} |
|
73
|
73
|
} |
|
@@ -84,7 +84,7 @@ discard block |
|
|
block discarded – undo |
|
84
|
84
|
'strict-origin-when-cross-origin', |
|
85
|
85
|
'same-origin', |
|
86
|
86
|
] |
|
87
|
|
- ) . "\n"; |
|
|
87
|
+ )."\n"; |
|
88
|
88
|
$msgParameters['w3c-recommendation'] = [ |
|
89
|
89
|
'type' => 'highlight', |
|
90
|
90
|
'id' => 'w3c-recommendation', |
|
@@ -96,19 +96,19 @@ discard block |
|
|
block discarded – undo |
|
96
|
96
|
$transportSecurityValidity = $response->getHeader('Strict-Transport-Security'); |
|
97
|
97
|
$minimumSeconds = 15552000; |
|
98
|
98
|
if (preg_match('/^max-age=(\d+)(;.*)?$/', $transportSecurityValidity, $m)) { |
|
99
|
|
- $transportSecurityValidity = (int)$m[1]; |
|
|
99
|
+ $transportSecurityValidity = (int) $m[1]; |
|
100
|
100
|
if ($transportSecurityValidity < $minimumSeconds) { |
|
101
|
|
- $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity]) . "\n"; |
|
|
101
|
+ $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity])."\n"; |
|
102
|
102
|
} |
|
103
|
103
|
} elseif (!empty($transportSecurityValidity)) { |
|
104
|
|
- $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity]) . "\n"; |
|
|
104
|
+ $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity])."\n"; |
|
105
|
105
|
} else { |
|
106
|
|
- $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds]) . "\n"; |
|
|
106
|
+ $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds])."\n"; |
|
107
|
107
|
} |
|
108
|
108
|
|
|
109
|
109
|
if (!empty($msg)) { |
|
110
|
110
|
return SetupResult::warning( |
|
111
|
|
- $this->l10n->t('Some headers are not set correctly on your instance') . "\n" . $msg, |
|
|
111
|
+ $this->l10n->t('Some headers are not set correctly on your instance')."\n".$msg, |
|
112
|
112
|
$this->urlGenerator->linkToDocs('admin-security'), |
|
113
|
113
|
$msgParameters, |
|
114
|
114
|
); |
nextcloud /
server
