easy-invoice / includes / Traits / SecurityTrait.php

SecurityTrait.php in Easy Invoice – Invoice Generator, PDF Quotes & Payments 2.1.2, at includes/Traits/SecurityTrait.php

89 lines 2.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Security Trait
4	*
5	* @package Easy_Invoice
6	* @subpackage Traits
7	*/
8
9	namespace EasyInvoice\Traits;
10
11	/**
12	* SecurityTrait contains methods for handling security checks, nonce verification, and capability checks
13	*/
14	trait SecurityTrait {
15	/**
16	* Verify nonce for AJAX requests
17	*
18	* @param string $nonce The nonce to verify
19	* @param string $action The nonce action
20	* @return bool\|WP_Error True if verified, WP_Error otherwise
21	*/
22	protected function verifyNonce($nonce, $action = 'easy_invoice_nonce') {
23	if (!isset($nonce) \|\| !wp_verify_nonce($nonce, $action)) {
24	return new \WP_Error('invalid_nonce', __('Security verification failed. Please refresh the page and try again.', 'easy-invoice'));
25	}
26
27	return true;
28	}
29
30	/**
31	* Check if current user has required capability
32	*
33	* @param string $capability The required capability, defaults to manage_options
34	* @return bool\|WP_Error True if has capability, WP_Error otherwise
35	*/
36	protected function checkCapability($capability = 'manage_options') {
37	if (!current_user_can($capability)) {
38	return new \WP_Error('invalid_capability', __('You do not have permission to perform this action.', 'easy-invoice'));
39	}
40
41	return true;
42	}
43
44	/**
45	* Common security check for AJAX requests
46	*
47	* @param string $nonce The nonce to verify
48	* @param string $nonce_action The nonce action
49	* @param string $capability The required capability
50	* @return bool\|WP_Error True if checks pass, WP_Error otherwise
51	*/
52	protected function securityCheck($nonce, $nonce_action = 'easy_invoice_nonce', $capability = 'manage_options') {
53	// Check nonce
54	$nonce_check = $this->verifyNonce($nonce, $nonce_action);
55	if (is_wp_error($nonce_check)) {
56	return $nonce_check;
57	}
58
59	// Check capability
60	$cap_check = $this->checkCapability($capability);
61	if (is_wp_error($cap_check)) {
62	return $cap_check;
63	}
64
65	return true;
66	}
67
68	/**
69	* Handle AJAX security check and send error response if needed
70	*
71	* @param string $nonce The nonce to verify
72	* @param string $nonce_action The nonce action
73	* @param string $capability The required capability
74	* @return bool True if checks pass, false otherwise (and sends JSON error)
75	*/
76	protected function handleAjaxSecurity($nonce, $nonce_action = 'easy_invoice_nonce', $capability = 'manage_options') {
77	$security_check = $this->securityCheck($nonce, $nonce_action, $capability);
78
79	if (is_wp_error($security_check)) {
80	wp_send_json_error([
81	'message' => $security_check->get_error_message(),
82	'code' => $security_check->get_error_code()
83	]);
84	return false;
85	}
86
87	return true;
88	}
89	}