Ubuntu
X-Powered-By to avoid leaking sensitive information.
* Main Module: discloses
* Author: SecuPress
* Version: 1.1.1
*/
defined( 'SECUPRESS_VERSION' ) or die( 'Cheatin’ uh?' );
/** --------------------------------------------------------------------------------------------- */
/** IN CASE THE REWRITE RULES DON'T WORK ======================================================== */
/** --------------------------------------------------------------------------------------------- */
if ( ! headers_sent() ) {
header_remove( 'X-Powered-By' );
}
/** --------------------------------------------------------------------------------------------- */
/** ACTIVATION / DEACTIVATION =================================================================== */
/** --------------------------------------------------------------------------------------------- */
add_action( 'secupress.modules.activate_submodule_' . basename( __FILE__, '.php' ), 'secupress_no_x_powered_by_activation' );
/**
* On module activation, maybe write the rules.
*
* @since 1.0
*/
function secupress_no_x_powered_by_activation() {
global $is_apache, $is_nginx, $is_iis7;
// Apache.
if ( $is_apache ) {
$rules = secupress_no_x_powered_by_apache_rules();
}
// IIS7.
elseif ( $is_iis7 ) {
$rules = secupress_no_x_powered_by_iis7_rules();
}
// Nginx.
elseif ( $is_nginx ) {
$rules = secupress_no_x_powered_by_nginx_rules();
}
// Not supported.
else {
$rules = '';
}
secupress_add_module_rules_or_notice( array(
'rules' => $rules,
'marker' => 'no_x_powered_by',
'iis_args' => array(
'path' => 'httpProtocol/customHeaders',
'attribute' => 'id',
),
'title' => __( 'PHP Version Disclosure', 'secupress' ),
) );
}
add_action( 'secupress.modules.deactivate_submodule_' . basename( __FILE__, '.php' ), 'secupress_no_x_powered_by_deactivate' );
/**
* On module deactivation, maybe remove rewrite rules from the `.htaccess`/`web.config` file.
*
* @since 1.0
*/
function secupress_no_x_powered_by_deactivate() {
secupress_remove_module_rules_or_notice( 'no_x_powered_by', __( 'PHP Version Disclosure', 'secupress' ) );
}
add_filter( 'secupress.plugins.activation.write_rules', 'secupress_no_x_powered_by_plugin_activate', 10, 2 );
/**
* On SecuPress activation, add the rules to the list of the rules to write.
*
* @since 1.0
*
* @param (array) $rules Other rules to write.
*
* @return (array) Rules to write.
*/
function secupress_no_x_powered_by_plugin_activate( $rules ) {
global $is_apache, $is_nginx, $is_iis7;
$marker = 'no_x_powered_by';
if ( $is_apache ) {
$rules[ $marker ] = secupress_no_x_powered_by_apache_rules();
} elseif ( $is_iis7 ) {
$rules[ $marker ] = array(
'nodes_string' => secupress_no_x_powered_by_iis7_rules(),
'path' => 'httpProtocol/customHeaders',
'attribute' => 'id',
);
} elseif ( $is_nginx ) {
$rules[ $marker ] = secupress_no_x_powered_by_nginx_rules();
}
return $rules;
}
/** --------------------------------------------------------------------------------------------- */
/** RULES ======================================================================================= */
/** --------------------------------------------------------------------------------------------- */
/**
* No X-Powered-By: get rules for apache.
*
* @since 1.0
*
* @return (string)
*/
function secupress_no_x_powered_by_apache_rules() {
$rules = "ServerSignature Off\n";
$rules = "\n";
$rules .= " Header unset X-Powered-By\n";
$rules .= "\n";
return $rules;
}
/**
* No X-Powered-By: get rules for iis7.
*
* @since 1.0
*
* @return (string)
*/
function secupress_no_x_powered_by_iis7_rules() {
$marker = 'no_x_powered_by';
$spaces = str_repeat( ' ', 8 );
// - https://www.iis.net/configreference/system.webserver/httpprotocol/customheaders
// - https://stackoverflow.com/questions/1178831/remove-server-response-header-iis7
$rules = "\n";
$rules .= "$spaces\n";
$rules .= "$spaces";
return $rules;
}
/**
* No X-Powered-By: get rules for nginx.
*
* @since 1.0
*
* @return (string)
*/
function secupress_no_x_powered_by_nginx_rules() {
$marker = 'no_x_powered_by';
// - http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
$rules = "
server {
# BEGIN SecuPress $marker
server_tokens off;
proxy_hide_header X-Powered-By;
fastcgi_hide_header X-Powered-By;
# END SecuPress
}";
return trim( $rules );
}