| 1 |
<?php |
| 2 |
|
| 3 |
if (!defined('ABSPATH')) { |
| 4 |
exit; |
| 5 |
} |
| 6 |
|
| 7 |
/** |
| 8 |
* Shared nonce + admin permission gate for AJAX handlers. |
| 9 |
* |
| 10 |
* Extracts the nonce from POST or GET, verifies it, and checks |
| 11 |
* userIsPluginAdmin(). On failure, sends a JSON 403 and terminates. |
| 12 |
*/ |
| 13 |
trait ABJ_404_Solution_AjaxSecurityTrait { |
| 14 |
|
| 15 |
/** |
| 16 |
* Verify nonce and admin permissions. Sends JSON error and terminates on failure. |
| 17 |
* |
| 18 |
* @param string $action The nonce action string. |
| 19 |
* @param string $nonceParam The POST/GET parameter name holding the nonce (default 'nonce'). |
| 20 |
* @return void |
| 21 |
*/ |
| 22 |
private static function requireAdminWithNonce(string $action, string $nonceParam = 'nonce'): void { |
| 23 |
$nonce = ''; |
| 24 |
if (isset($_POST[$nonceParam]) && is_string($_POST[$nonceParam])) { |
| 25 |
$nonce = sanitize_text_field($_POST[$nonceParam]); |
| 26 |
} elseif (isset($_GET[$nonceParam]) && is_string($_GET[$nonceParam])) { |
| 27 |
$nonce = sanitize_text_field($_GET[$nonceParam]); |
| 28 |
} |
| 29 |
|
| 30 |
if (!wp_verify_nonce($nonce, $action)) { |
| 31 |
wp_send_json_error(array('message' => __('Invalid security token', '404-solution')), 403); |
| 32 |
return; // @phpstan-ignore deadCode.unreachable |
| 33 |
} |
| 34 |
|
| 35 |
if (!abj_service('plugin_logic')->userIsPluginAdmin()) { |
| 36 |
wp_send_json_error(array('message' => __('Unauthorized', '404-solution')), 403); |
| 37 |
return; // @phpstan-ignore deadCode.unreachable |
| 38 |
} |
| 39 |
} |
| 40 |
} |
| 41 |
|
