function seckit_module_implements_alter in Security Kit 7

Implements hook_module_implements_alter().

The 'ALLOW-FROM' field of X-Frame-Options supports a single origin only. http://tools.ietf.org/html/rfc7034#section-2.3.2.3

Consequently, when multiple values are configured we must resort to hook_boot() to dynamically set the header to the Origin of the current request, if that is one of the allowed values.

Conversely, when we do not require hook_boot(), we unset our implementation, preventing _system_update_bootstrap_status() from registering it, and anything from invoking it.

See also

seckit_admin_form_submit().

File

./seckit.module, line 180

Allows administrators to improve security of the website.

Code

function seckit_module_implements_alter(&$implementations, $hook) {
  if ($hook != 'boot') {
    return;
  }
  $options = _seckit_get_options(TRUE);
  if ($options['seckit_clickjacking']['x_frame'] != SECKIT_X_FRAME_ALLOW_FROM || count($options['seckit_clickjacking']['x_frame_allow_from']) <= 1) {

    // seckit_boot() is not needed.
    unset($implementations['seckit']);

    // In this case, _seckit_x_frame() will generate the header
    // (which will be cacheable), if it is required.
  }
}