<?php

error_reporting(0);
date_default_timezone_set('Europe/Berlin');

// enable debug output
$aConfig['MVC_DEBUG'] = false;

//-------------------------------------------------------------------------------------
// Module {module}

$aConfig['MODULE_{module}'] = array();

/**
 * Where to activate Session;
 * name Controllers
 */
$aConfig['MODULE_{module}']['SESSION'] = array(

    'aEnableSessionForController' => array(
        'Index',
    ),
);

/**
 * Event Bindings
 */
$aConfig['MODULE_{module}']['EVENT_BIND'] = array(

    'mvc.request.saveRequest.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.request.redirect' => array(
        function (\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        },
    ),
    'mvc.request.prepareQueryVarsForUsage.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.runTargetClassPreconstruct.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.setSession.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.setSession.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.policy.apply.execute' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.controller.construct.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.reflex.reflect.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.reflex.reflect.targetObject.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        },
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) use ($aConfig) {
            \MVC\Minify::init();
        }
    ),
    'mvc.reflex.reflect.targetObject.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.controller.construct.invalidRequest' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.controller.construct.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.view.render.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.view.renderString.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.view.renderString.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.view.render.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.reflex.destruct.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.controller.destruct.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.application.construct.after' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.application.destruct.before' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.helper.stop.after' => array(
        function (\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE("\n\n*** STOP ***\n" . print_r($oDTArrayObject->get_akeyvalue()[0]->get_sValue(), true));
        }
    ),
    'mvc.lock.create' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'mvc.log');
        }
    ),
    'mvc.error' => array(
        function(\MVC\DataType\DTArrayObject $oDTArrayObject) {
            \MVC\Log::WRITE($oDTArrayObject, 'error.log');
        }
    ),
);


//-------------------------------------------------------------------------------------
// Frontend

/**
 * For further Rules Explanation @see https://content-security-policy.com/
 */
$aConfig['CONTENT_SECURITY_POLICY'] = array();

/**
 * Websites (URLs) which are allowed to embed our Site into e.g. a <frame>
 */
$aConfig['CONTENT_SECURITY_POLICY']['X-Frame-Options'] = "'none'";

$aConfig['CONTENT_SECURITY_POLICY']['Content-Security-Policy'] = ""

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
     */
    .   "default-src  'self'; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
     */
    .   "script-src   'self' " .
        "'unsafe-inline' " .
        "; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
     */
    .   "style-src    'self' " .
        "'unsafe-inline' " .
        "; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
     */
    .   "img-src      'self' " .
        "blob: " .
        "data: " .
        "; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
     */
    .   "connect-src  'self'; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
     */
    .   "font-src     'self' " .
        "; "

    /**
     * To disallow all plugins, the object-src directive should be set to 'none' which will disallow plugins.
     * The plugin-types directive is only used if you are allowing plugins with object-src at all.
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/plugin-types
     */
    .   "object-src   'none'; "
    #. "plugin-types ;"

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/media-src
     */
    .   "media-src    'self'; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src
     */
    .   "child-src    'self';"

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
     */
    .   "sandbox      " .
        "allow-forms " .
        "allow-same-origin " .
        "allow-scripts " .
        "allow-popups " .
        "allow-modals " .
        "allow-orientation-lock " .
        "allow-pointer-lock " .
        "allow-presentation " .
        "allow-popups-to-escape-sandbox " .
        "allow-top-navigation; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
     */
    .   "report-uri   /; "

    /**
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action
     */
    .   "form-action  'self'; "

    /**
     * The HTTP Content-Security-Policy (CSP) frame-ancestors directive specifies valid parents
     * that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
     */
    .   "frame-ancestors " . $aConfig['CONTENT_SECURITY_POLICY']['X-Frame-Options'] . "; "

    /**
     * frames
     * that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.
     */
    .   "frame-src 'self'; "

    //end
    ;

/**
 * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
 */
$aConfig['CONTENT_SECURITY_POLICY']['X-XSS-Protection'] = '1; mode=block';

/**
 * 63072000 for 24 months
 * @see https://support.servertastic.com/knowledgebase/article/http-strict-transport-security-php
 */
$aConfig['CONTENT_SECURITY_POLICY']['Strict-Transport-Security'] = 'max-age=63072000'; # 63072000 for 24 months


