<?php
/* $Id$ */
(defined('MCMS') && (basename(__FILE__) != basename($_SERVER['PHP_SELF']))) or die('ACCESS DENIED');

use \MCMS\Context;
use \MCMS\Response;
use \MCMS\System;
use \MCMS\Plugin\iPlugInContent;

/**
 * Content Security Policy plugin
 * 
 * @author Stefan Daurer
 * @see http://www.w3.org/TR/CSP/
 *
 *
 */
class PlugInMMPICSP implements \Mammut\Plugin\iPlugIn {
	private $installed = true;

	public function __construct() {
		$this->installed = System::getInstance()->getDB()->table('installinfo')->getObject(array(
				'type' => 'plugin','key' => 'content:mcms.mmpicsp'));
	}

	public function run(Response &$response, $step, Context $context) {
		if(!$this->installed)
			return;
		
		if($step == iPlugInContent::STEP_AFTER_RUN) {
			$type = strtolower($response->getType());
			if(!in_array($type, array('','text/html')))
				return;
			if(defined('DEBUG')) {
				header("Content-Security-Report-Only: default-src 'self'; img-src *;");
				header("X-Content-Security-Report-Only: default-src 'self'; img-src *;");
			}
			else {
				header("Content-Security-Policy: default-src 'self'; img-src *;");
				header("X-Content-Security-Policy: default-src 'self'; img-src *;");
			}
		}
	}
}