RoleCapabilityNamingConventionCheck.php — Advanced Access Manager – Access Governance for WordPress trunk

advanced-access-manager / application / Audit / RoleCapabilityNamingConventionCheck.php

advanced-access-manager / application / Audit Last commit date

AuditCheckTrait.php 1 year ago CoreUserRoleOptionIntegrityCheck.php 1 year ago EditableFileSystemCheck.php 7 months ago ElevatedCoreRoleCheck.php 7 months ago EmptyUnusedRoleCheck.php 7 months ago HighPrivilegeContentModeratorCheck.php 7 months ago HighPrivilegeOrElevatedUserCheck.php 7 months ago HighPrivilegeRoleCheck.php 7 months ago HighPrivilegeUserCountCheck.php 7 months ago RestfulAutoDiscoverEndpointCheck.php 7 months ago RoleCapabilityNamingConventionCheck.php 7 months ago RoleIntegrityCheck.php 7 months ago RoleTransparencyCheck.php 7 months ago XmlRpcEndpointCheck.php 7 months ago

RoleCapabilityNamingConventionCheck.php

140 lines

1	<?php
2
3	/**
4	* ======================================================================
5	* LICENSE: This file is subject to the terms and conditions defined in *
6	* file 'license.txt', which is part of this source code package. *
7	* ======================================================================
8	*/
9
10	/**
11	* Check if roles and capabilities follow proper naming convention
12	*
13	* @package AAM
14	* @version 7.0.0
15	*/
16	class AAM_Audit_RoleCapabilityNamingConventionCheck
17	{
18
19	use AAM_Audit_AuditCheckTrait;
20
21	/**
22	* Step ID
23	*
24	* @version 7.0.0
25	*/
26	const ID = 'roles_caps_naming_convention';
27
28	/**
29	* Run the check
30	*
31	* @return array
32	*
33	* @access public
34	* @static
35	*
36	* @version 7.0.0
37	*/
38	public static function run()
39	{
40	$issues = [];
41	$response = [ 'is_completed' => true ];
42
43	try {
44	array_push(
45	$issues,
46	...self::_validate_naming_convention(self::_read_role_key_option())
47	);
48	} catch (Exception $e) {
49	array_push($issues, self::_format_issue(
50	'APPLICATION_ERROR',
51	[
52	'message' => $e->getMessage()
53	],
54	'error'
55	));
56	}
57
58	if (count($issues) > 0) {
59	$response['issues'] = $issues;
60	}
61
62	// Determine final status for the check
63	self::_determine_check_status($response);
64
65	return $response;
66	}
67
68	/**
69	* Get a collection of error messages for current step
70	*
71	* @return array
72	* @access private
73	* @static
74	*
75	* @version 7.0.0
76	*/
77	private static function _get_message_templates()
78	{
79	return [
80	'INVALID_ROLE_SLUG' => __(
81	'Detected role %s (%s) with invalid slug',
82	'advanced-access-manager'
83	),
84	'INVALID_CAP_SLUG' => __(
85	'Detected invalid capability %s for %s (%s) role',
86	'advanced-access-manager'
87	)
88	];
89	}
90
91	/**
92	* Validate that all roles and capabilities are following proper naming
93	* convention
94	*
95	* @param array $db_roles
96	*
97	* @return array
98	*
99	* @access private
100	* @static
101	*
102	* @version 7.0.0
103	*/
104	private static function _validate_naming_convention($db_roles)
105	{
106	$response = [];
107
108	foreach($db_roles as $role_id => $role) {
109	if (preg_match('/^[a-z\d_\-]+$/', $role_id) !== 1) {
110	array_push($response, self::_format_issue(
111	'INVALID_ROLE_SLUG',
112	[
113	'name' => translate_user_role(
114	!empty($role['name']) ? $role['name'] : $role_id
115	),
116	'slug' => $role_id
117	]
118	));
119	}
120
121	foreach(array_keys($role['capabilities']) as $cap) {
122	if (preg_match('/^[a-z\d_\-]+$/', $cap) !== 1) {
123	array_push($response, self::_format_issue(
124	'INVALID_CAP_SLUG',
125	[
126	'slug' => $cap,
127	'role_name' => translate_user_role(
128	!empty($role['name']) ? $role['name'] : $role_id
129	),
130	'role_slug' => $role_id
131	]
132	));
133	}
134	}
135	}
136
137	return $response;
138	}
139
140	}