From 35e531a56bab90532a4c4eac2d15015a87885344 Mon Sep 17 00:00:00 2001 From: Skylar Ittner Date: Sun, 8 Apr 2018 16:08:08 -0600 Subject: [PATCH] Add link preload headers --- app.php | 8 ++++++++ index.php | 5 +++++ required.php | 6 ++++-- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/app.php b/app.php index a08fca3..3f4f432 100644 --- a/app.php +++ b/app.php @@ -18,6 +18,12 @@ if (!is_empty($_GET['page'])) { $pageid = "404"; } } + +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=script", false); +header("Link: ; rel=preload; as=script", false); ?> @@ -43,6 +49,7 @@ if (!is_empty($_GET['page'])) { if (isset(PAGES[$pageid]['styles'])) { foreach (PAGES[$pageid]['styles'] as $style) { echo "\n"; + header("Link: <$style>; rel=preload; as=style", false); } } ?> @@ -169,6 +176,7 @@ END; if (isset(PAGES[$pageid]['scripts'])) { foreach (PAGES[$pageid]['scripts'] as $script) { echo "\n"; + header("Link: <$script>; rel=preload; as=script", false); } } ?> diff --git a/index.php b/index.php index 6a8c7e2..5872a67 100644 --- a/index.php +++ b/index.php @@ -72,6 +72,11 @@ if (checkLoginServer()) { } else { $alert = lang("login server unavailable", false); } +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=style", false); +header("Link: ; rel=preload; as=script", false); +header("Link: ; rel=preload; as=script", false); ?> diff --git a/required.php b/required.php index eaaba47..1b6714f 100644 --- a/required.php +++ b/required.php @@ -7,10 +7,12 @@ ob_start(); // allow sending headers after content // Unicode, solves almost all stupid encoding problems header('Content-Type: text/html; charset=utf-8'); -// l33t $ecurity h4x +// Strip PHP version +header('X-Powered-By: PHP'); + +// Security header('X-Content-Type-Options: nosniff'); header('X-XSS-Protection: 1; mode=block'); -header('X-Powered-By: PHP'); // no versions makes it harder to find vulns header('X-Frame-Options: "DENY"'); header('Referrer-Policy: "no-referrer, strict-origin-when-cross-origin"'); $SECURE_NONCE = base64_encode(random_bytes(8));