← All changes | includes/Controllers/QuoteController.php +953 -565 2.1.2 → 2.4.0 View file →

		@@ -25,9 +25,9 @@
25	25	*
26	26	* @since 1.0.0
27	27	*/
28	28	class QuoteController {
29		-
	29	+
30	30	/**
31	31	* Quote repository
32	32	*
33	33	* @var QuoteRepository
		@@ -32,9 +32,9 @@
32	32	*
33	33	* @var QuoteRepository
34	34	*/
35	35	private $quote_repository;
36		-
	36	+
37	37	/**
38	38	* Client repository
39	39	*
40	40	* @var ClientRepository
		@@ -39,9 +39,9 @@
39	39	*
40	40	* @var ClientRepository
41	41	*/
42	42	private $client_repository;
43		-
	43	+
44	44	/**
45	45	* Form processor
46	46	*
47	47	* @var FormProcessor
		@@ -46,9 +46,9 @@
46	46	*
47	47	* @var FormProcessor
48	48	*/
49	49	private $form_processor;
50		-
	50	+
51	51	/**
52	52	* Quote log service
53	53	*
54	54	* @var QuoteLogService
		@@ -53,9 +53,9 @@
53	53	*
54	54	* @var QuoteLogService
55	55	*/
56	56	private $quote_log_service;
57		-
	57	+
58	58	/**
59	59	* Constructor
60	60	*
61	61	* @since 1.0.0
		@@ -65,9 +65,9 @@
65	65	$this->client_repository = new ClientRepository();
66	66	$this->form_processor = new FormProcessor();
67	67	$this->quote_log_service = new QuoteLogService();
68	68	}
69		-
	69	+
70	70	/**
71	71	* Initialize the controller
72	72	*
73	73	* @since 1.0.0
		@@ -74,43 +74,50 @@
74	74	*/
75	75	public function init(): void {
76	76	// Allow plugins to extend the controller initialization
77	77	do_action('easy_invoice_quote_controller_before_init', $this);
78		-
	78	+
79	79	// Add AJAX handlers
80	80	add_action('wp_ajax_easy_invoice_delete_quote', [$this, 'handleDeleteQuote']);
81	81	add_action('wp_ajax_easy_invoice_get_quote', [$this, 'handleGetQuote']);
82	82	add_action('wp_ajax_easy_invoice_load_quote_template', [$this, 'handleLoadQuoteTemplate']);
	83	+ add_action('wp_ajax_easy_invoice_convert_quote', [$this, 'handleConvertQuote']);
	84	+ add_filter('easy_invoice_quote_row_actions', [$this, 'addConvertRowAction'], 5, 2);
83	85	add_action('wp_ajax_easy_invoice_create_new_quote', [$this, 'handleCreateNewQuote']);
84		- add_action('wp_ajax_easy_invoice_search_clients', [$this, 'handleSearchClients']);
	86	+ // The `easy_invoice_search_clients` AJAX is owned by EasyInvoiceAjax.
	87	+ // The duplicate registration that used to live here raced with
	88	+ // EasyInvoiceAjax::searchClients() — only the first-registered
	89	+ // handler ran, and which one won depended on bootstrap order. That
	90	+ // intermittently broke the client-search dropdown in the quote
	91	+ // builder. Keep this comment as a tombstone so it doesn't get
	92	+ // added back.
85	93	add_action('wp_ajax_easy_invoice_load_quote_form', [$this, 'handleLoadQuoteForm']);
86	94	add_action('wp_ajax_easy_invoice_accept_quote', [$this, 'handleAcceptQuote']);
87	95	add_action('wp_ajax_easy_invoice_decline_quote', [$this, 'handleDeclineQuote']);
88	96	add_action('wp_ajax_nopriv_easy_invoice_accept_quote', [$this, 'handleAcceptQuote']);
89	97	add_action('wp_ajax_nopriv_easy_invoice_decline_quote', [$this, 'handleDeclineQuote']);
90		- add_action('wp_ajax_easy_invoice_update_existing_quotes', [$this, 'handleUpdateExistingQuotes']);
91		-
	98	+
92	99	// Add missing AJAX handlers for quote listing actions
93	100	add_action('wp_ajax_easy_invoice_bulk_quote_action', [$this, 'handleBulkQuoteAction']);
94	101	add_action('wp_ajax_easy_invoice_trash_quote', [$this, 'handleTrashQuote']);
95	102	add_action('wp_ajax_easy_invoice_draft_quote', [$this, 'handleDraftQuote']);
96		-
	103	+
97	104	// Add regular POST form handlers for quote actions
98	105	add_action('init', [$this, 'handleQuoteFormActions']);
99		-
	106	+
100	107	// Add new AJAX handler for restoring a trashed quote
101	108	add_action('wp_ajax_easy_invoice_restore_quote', [ $this, 'handleRestoreQuote' ]);
102		-
	109	+
103	110	// Add new AJAX handler for emptying trash
104	111	add_action('wp_ajax_easy_invoice_empty_trash', [ $this, 'handleEmptyTrash' ]);
105		-
	112	+
106	113	// Add new AJAX handler for getting quote logs
107	114	add_action('wp_ajax_easy_invoice_get_quote_logs', [ $this, 'handleGetQuoteLogs' ]);
108		-
	115	+
109	116	// Allow plugins to extend the controller initialization
110	117	do_action('easy_invoice_quote_controller_after_init', $this);
111	118	}
112		-
	119	+
113	120	/**
114	121	* Display quote pages
115	122	*
116	123	* @since 1.0.0
		@@ -118,36 +125,36 @@
118	125	*/
119	126	public function display(array $args = []): void {
120	127	// Allow plugins to modify display arguments
121	128	$args = apply_filters('easy_invoice_quote_controller_display_args', $args);
122		-
	129	+
123	130	$page = $args['page'] ?? '';
124		-
	131	+
125	132	// Allow plugins to modify the page before processing
126	133	$page = apply_filters('easy_invoice_quote_controller_display_page', $page, $args);
127		-
	134	+
128	135	switch ($page) {
129	136	case PagesSlugs::ALL_QUOTES:
130	137	$this->displayListing();
131	138	break;
132		-
	139	+
133	140	case PagesSlugs::QUOTE_NEW:
134	141	$this->displayBuilder();
135	142	break;
136		-
	143	+
137	144	case PagesSlugs::QUOTE_PREVIEW:
138	145	$this->displayPreview($args);
139	146	break;
140		-
	147	+
141	148	default:
142	149	$this->displayListing();
143	150	break;
144	151	}
145		-
	152	+
146	153	// Allow plugins to perform actions after display
147	154	do_action('easy_invoice_quote_controller_after_display', $page, $args);
148	155	}
149		-
	156	+
150	157	/**
151	158	* Display quote listing page
152	159	*
153	160	* @since 1.0.0
		@@ -157,19 +164,19 @@
157	164	global $wpdb;
158	165
159	166	// Get trash count first (based on post_status)
160	167	$trash_count = (int)$wpdb->get_var($wpdb->prepare(
161		- "SELECT COUNT(*) FROM {$wpdb->posts}
	168	+ "SELECT COUNT(*) FROM {$wpdb->posts}
162	169	WHERE post_type = %s AND post_status = 'trash'",
163	170	PostTypes::EASY_INVOICE_QUOTE_POST_TYPE
164	171	));
165		-
	172	+
166	173	// Get counts for each meta status (excluding trashed posts)
167	174	$status_counts = $wpdb->get_results($wpdb->prepare(
168		- "SELECT COALESCE(pm.meta_value, 'draft') as status, COUNT(*) as count
169		- FROM {$wpdb->posts} p
	175	+ "SELECT COALESCE(pm.meta_value, 'draft') as status, COUNT(*) as count
	176	+ FROM {$wpdb->posts} p
170	177	LEFT JOIN {$wpdb->postmeta} pm ON p.ID = pm.post_id AND pm.meta_key = '_easy_invoice_quote_status'
171		- WHERE p.post_type = %s
	178	+ WHERE p.post_type = %s
172	179	AND p.post_status != 'trash'
173	180	GROUP BY COALESCE(pm.meta_value, 'draft')",
174	181	PostTypes::EASY_INVOICE_QUOTE_POST_TYPE
175	182	));
		@@ -187,9 +194,9 @@
187	194	// Process status counts
188	195	foreach ($status_counts as $status) {
189	196	$count = (int)$status->count;
190	197	$all_count += $count; // Add to total (excluding trash)
191		-
	198	+
192	199	switch ($status->status) {
193	200	case 'draft':
194	201	$draft_count = $count;
195	202	break;
		@@ -216,11 +223,12 @@
216	223
217	224	// Now handle the display filtering
218	225	// Allow plugins to perform actions before displaying listing
219	226	do_action('easy_invoice_quote_controller_before_display_listing');
220		-
	227	+
221	228	// Get filter parameters
222	229	$status_filter = isset($_GET['status']) ? sanitize_text_field($_GET['status']) : '';
	230	+ $client_filter = isset($_GET['client_id']) ? absint($_GET['client_id']) : 0;
223	231	$search_query = isset($_GET['search']) ? sanitize_text_field(wp_unslash($_GET['search'])) : '';
224	232	$current_view = isset($_GET['view']) ? sanitize_text_field($_GET['view']) : 'all';
225	233	$current_page = isset($_GET['paged']) ? max(1, intval($_GET['paged'])) : 1;
226	234	$per_page = 20;
		@@ -240,9 +248,9 @@
240	248	// Handle view filtering
241	249	if ($current_view === 'trash' || $current_view === 'cancelled') {
242	250	// For trash and cancelled views, look at post_status = 'trash'
243	251	$query_args['post_status'] = 'trash';
244		-
	252	+
245	253	// For cancelled view, also filter by meta status
246	254	if ($current_view === 'cancelled') {
247	255	$query_args['meta_query'] = [
248	256	[
		@@ -254,9 +262,9 @@
254	262	}
255	263	} else {
256	264	// For all other views, exclude trashed posts
257	265	$query_args['post_status'] = ['publish', 'draft', 'private', 'pending'];
258		-
	266	+
259	267	if ($current_view !== 'all') {
260	268	// For specific status views, add meta query
261	269	$query_args['meta_query'] = [
262	270	[
		@@ -267,12 +275,59 @@
267	275	];
268	276	}
269	277	}
270	278
	279	+ // Add client filter if provided (merges with any existing meta_query).
	280	+ //
	281	+ // Quote model uses the `_easy_invoice_quote_*` meta-key namespace
	282	+ // (see Models/Quote.php :: saveMetaData → meta_key = `_easy_invoice_quote_` . $field_name).
	283	+ // We match on either:
	284	+ // • `_easy_invoice_quote_client_id` (when picked from the client dropdown), OR
	285	+ // • `_easy_invoice_quote_customer_email` (when entered ad-hoc inline).
	286	+ if (!empty($client_filter)) {
	287	+ $client_email = '';
	288	+ try {
	289	+ $client_repo = new \EasyInvoice\Repositories\ClientRepository();
	290	+ $client_obj = $client_repo->find($client_filter);
	291	+ if ($client_obj) {
	292	+ $client_email = (string) $client_obj->getEmail();
	293	+ }
	294	+ } catch (\Throwable $e) {
	295	+ $client_email = '';
	296	+ }
	297	+
	298	+ $client_clauses = [
	299	+ 'relation' => 'OR',
	300	+ [
	301	+ 'key' => '_easy_invoice_quote_client_id',
	302	+ 'value' => (string) $client_filter,
	303	+ 'compare' => '=',
	304	+ ],
	305	+ ];
	306	+ if ($client_email !== '') {
	307	+ $client_clauses[] = [
	308	+ 'key' => '_easy_invoice_quote_customer_email',
	309	+ 'value' => $client_email,
	310	+ 'compare' => '=',
	311	+ ];
	312	+ }
	313	+
	314	+ if (!empty($query_args['meta_query'])) {
	315	+ $existing = $query_args['meta_query'];
	316	+ if (!isset($existing['relation'])) {
	317	+ $existing = ['relation' => 'AND'] + $existing;
	318	+ }
	319	+ $existing[] = $client_clauses;
	320	+ $query_args['meta_query'] = $existing;
	321	+ } else {
	322	+ $query_args['meta_query'] = [$client_clauses];
	323	+ }
	324	+ }
	325	+
271	326	// Add search if provided
272	327	if (!empty($search_query)) {
273	328	$search_ids = [];
274		-
	329	+
275	330	// Build base query args for search
276	331	$search_query_args = [
277	332	'post_type' => PostTypes::EASY_INVOICE_QUOTE_POST_TYPE,
278	333	'post_status' => $query_args['post_status'],
		@@ -308,15 +363,16 @@
308	363	]
309	364	]
310	365	]);
311	366	$meta_search = new \WP_Query($meta_search_args);
312		-
313		- if ($meta_search->have_posts()) {
314		- $search_ids = array_merge($search_ids, wp_list_pluck($meta_search->posts, 'ID'));
315		- }
316		-
	367	+
	368	+ // 'fields' => 'ids' above: $posts already holds ids. Plucking 'ID' off
	369	+ // integers produced nulls, so a search by quote number, client name or
	370	+ // email matched nothing.
	371	+ $search_ids = array_map('intval', array_merge($search_ids, (array) $meta_search->posts));
	372	+
317	373	$search_ids = array_unique($search_ids);
318		-
	374	+
319	375	if (!empty($search_ids)) {
320	376	$query_args['post__in'] = $search_ids;
321	377	} else {
322	378	$query_args['post__in'] = [0];
		@@ -327,9 +383,9 @@
327	383	$query_args = apply_filters('easy_invoice_quote_controller_final_query_args', $query_args);
328	384	// Get filtered quotes for display
329	385	$wp_query = new \WP_Query($query_args);
330	386	$quotes = [];
331		-
	387	+
332	388	if ($wp_query->have_posts()) {
333	389	foreach ($wp_query->posts as $post) {
334	390	$quote = $this->quote_repository->find($post->ID);
335	391	if ($quote) {
		@@ -339,9 +395,9 @@
339	395	}
340	396
341	397	// Allow plugins to modify the quotes array
342	398	$quotes = apply_filters('easy_invoice_quote_controller_quotes_list', $quotes, $wp_query);
343		-
	399	+
344	400	// Get pagination info from WordPress query
345	401	$total_quotes = $wp_query->found_posts;
346	402	$total_pages = $wp_query->max_num_pages;
347	403
		@@ -379,14 +435,37 @@
379	435	$cancelled_count = $status->count;
380	436	break;
381	437	}
382	438	}
383		-
	439	+
	440	+ // Build clients list for the listing filter dropdown
	441	+ $clients_list = [];
	442	+ try {
	443	+ $client_repository = new \EasyInvoice\Repositories\ClientRepository();
	444	+ foreach ($client_repository->all() as $client) {
	445	+ $name = $client->getBusinessClientName() ?: trim($client->getFirstName() . ' ' . $client->getLastName());
	446	+ if ($name === '') {
	447	+ continue;
	448	+ }
	449	+ $clients_list[] = [
	450	+ 'id' => $client->getId(),
	451	+ 'name' => $name,
	452	+ ];
	453	+ }
	454	+ usort($clients_list, function ($a, $b) {
	455	+ return strcasecmp($a['name'], $b['name']);
	456	+ });
	457	+ } catch (\Throwable $e) {
	458	+ $clients_list = [];
	459	+ }
	460	+
384	461	// Prepare template data
385	462	$template_data = [
386	463	'quotes' => $quotes,
387	464	'current_view' => $current_view,
388	465	'status_filter' => $status_filter,
	466	+ 'client_filter' => $client_filter,
	467	+ 'clients_list' => $clients_list,
389	468	'search_query' => $search_query,
390	469	'all_count' => (int)$all_count,
391	470	'trash_count' => (int)$trash_count,
392	471	'draft_count' => (int)$draft_count,
		@@ -402,19 +481,19 @@
402	481	'total_quotes' => $total_quotes,
403	482	'total_pages' => $total_pages,
404	483	'wp_query' => $wp_query
405	484	];
406		-
	485	+
407	486	// Allow plugins to modify template data
408	487	$template_data = apply_filters('easy_invoice_quote_controller_template_data', $template_data);
409		-
	488	+
410	489	// Display the template
411	490	include EASY_INVOICE_PLUGIN_DIR . 'templates/quotes/listing.php';
412		-
	491	+
413	492	// Allow plugins to perform actions after displaying listing
414	493	do_action('easy_invoice_quote_controller_after_display_listing', $template_data);
415	494	}
416		-
	495	+
417	496	/**
418	497	* Display quote builder page
419	498	*
420	499	* @since 1.0.0
		@@ -421,18 +500,21 @@
421	500	*/
422	501	private function displayBuilder(): void {
423	502	// Allow plugins to perform actions before displaying builder
424	503	do_action('easy_invoice_quote_controller_before_display_builder');
425		-
	504	+
426	505	$quote_id = isset($_GET['id']) ? (int) $_GET['id'] : 0;
427	506	$quote = null;
428		-
	507	+
429	508	if ($quote_id > 0) {
430	509	$quote = $this->quote_repository->find($quote_id);
431	510	}
432		-
433		- $clients = $this->client_repository->all();
434		-
	511	+
	512	+ // The builder's picker searches over AJAX; the hidden mirror select only needs
	513	+ // the quote's own client (rendered by the form). Loading every client here
	514	+ // built a model per user on each open.
	515	+ $clients = [];
	516	+
435	517	// Allow plugins to modify the data
436	518	$quote = apply_filters('easy_invoice_quote_controller_builder_quote', $quote, $quote_id);
437	519	$clients = apply_filters('easy_invoice_quote_controller_builder_clients', $clients);
438	520
		@@ -437,13 +519,13 @@
437	519	$clients = apply_filters('easy_invoice_quote_controller_builder_clients', $clients);
438	520
439	521	// Include the builder template
440	522	include EASY_INVOICE_PLUGIN_DIR . 'templates/quotes/builder.php';
441		-
	523	+
442	524	// Allow plugins to perform actions after displaying builder
443	525	do_action('easy_invoice_quote_controller_after_display_builder', $quote, $clients);
444	526	}
445		-
	527	+
446	528	/**
447	529	* Display quote preview page
448	530	*
449	531	* @since 1.0.0
		@@ -451,30 +533,30 @@
451	533	*/
452	534	private function displayPreview(array $args): void {
453	535	// Allow plugins to perform actions before displaying preview
454	536	do_action('easy_invoice_quote_controller_before_display_preview', $args);
455		-
	537	+
456	538	$quote_id = isset($_GET['id']) ? (int) $_GET['id'] : 0;
457		-
	539	+
458	540	if ($quote_id <= 0) {
459		- wp_die(__('Quote not found.', 'easy-invoice'));
	541	+ wp_die(esc_html__('Quote not found.', 'easy-invoice'));
460	542	}
461		-
	543	+
462	544	$quote = $this->quote_repository->find($quote_id);
463	545	if (!$quote) {
464		- wp_die(__('Quote not found.', 'easy-invoice'));
	546	+ wp_die(esc_html__('Quote not found.', 'easy-invoice'));
465	547	}
466		-
	548	+
467	549	// Allow plugins to modify the quote
468	550	$quote = apply_filters('easy_invoice_quote_controller_preview_quote', $quote, $quote_id);
469		-
	551	+
470	552	// Include the preview template
471	553	include EASY_INVOICE_PLUGIN_DIR . 'templates/quotes/preview.php';
472		-
	554	+
473	555	// Allow plugins to perform actions after displaying preview
474	556	do_action('easy_invoice_quote_controller_after_display_preview', $quote, $args);
475	557	}
476		-
	558	+
477	559	/**
478	560	* Handle delete quote AJAX request
479	561	*
480	562	* @since 1.0.0
		@@ -483,24 +565,24 @@
483	565	// Verify nonce
484	566	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
485	567	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
486	568	}
487		-
	569	+
488	570	// Check permissions
489		- if (!current_user_can('manage_options')) {
	571	+ if (!easy_invoice_user_can('ei_delete_quote')) {
490	572	wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
491	573	}
492		-
	574	+
493	575	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
494		-
	576	+
495	577	if ($quote_id <= 0) {
496	578	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
497	579	}
498		-
	580	+
499	581	if ($this->quote_repository->delete($quote_id)) {
500	582	// Log the quote deletion
501	583	$this->quote_log_service->logDeletion($quote_id);
502		-
	584	+
503	585	wp_send_json_success([
504	586	'message' => __('Quote deleted successfully.', 'easy-invoice'),
505	587	'toast' => [
506	588	'type' => 'success',
		@@ -510,9 +592,9 @@
510	592	} else {
511	593	wp_send_json_error(['message' => __('Failed to delete quote.', 'easy-invoice')]);
512	594	}
513	595	}
514		-
	596	+
515	597	/**
516	598	* Handle get quote AJAX request
517	599	*
518	600	* @since 1.0.0
		@@ -521,29 +603,29 @@
521	603	// Verify nonce
522	604	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_get_quote')) {
523	605	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
524	606	}
525		-
	607	+
526	608	// Check permissions
527		- if (!current_user_can('manage_options')) {
	609	+ if (!easy_invoice_user_can('ei_view_quotes')) {
528	610	wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
529	611	}
530		-
	612	+
531	613	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
532		-
	614	+
533	615	if ($quote_id <= 0) {
534	616	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
535	617	}
536		-
	618	+
537	619	$quote = $this->quote_repository->find($quote_id);
538		-
	620	+
539	621	if (!$quote) {
540	622	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
541	623	}
542		-
	624	+
543	625	wp_send_json_success(['quote' => $quote->toArray()]);
544	626	}
545		-
	627	+
546	628	/**
547	629	* Handle AJAX request to load quote template
548	630	*
549	631	* @since 1.0.0
		@@ -552,47 +634,161 @@
552	634	// Verify nonce
553	635	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_nonce')) {
554	636	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
555	637	}
556		-
	638	+
557	639	// Check permissions
558		- if (!current_user_can('manage_options')) {
	640	+ if (!easy_invoice_user_can('ei_create_quote')) {
559	641	wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
560	642	}
561		-
	643	+
562	644	$template_id = sanitize_text_field($_POST['template'] ?? '');
563	645	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
564		-
	646	+
565	647	if (empty($template_id)) {
566	648	wp_send_json_error(['message' => __('Template ID is required.', 'easy-invoice')]);
567	649	}
568		-
569		- // Load quote if provided
570		- $quote = null;
	650	+
	651	+ // Validate template name securely
	652	+ $template_id = $this->validateTemplateName($template_id, 'quote');
	653	+
	654	+ // Get secure template file path
	655	+ $template_file = $this->getSecureTemplatePath($template_id, 'quote');
	656	+
	657	+ if (!$template_file) {
	658	+ wp_send_json_error(['message' => __('Template not found.', 'easy-invoice')]);
	659	+ }
	660	+
	661	+ // Load quote if provided.
	662	+ //
	663	+ // For an unsaved quote there is no id, and the quote design templates call
	664	+ // $quote->getTitle() / getNumber() / etc. unguarded — passing null made
	665	+ // previewing or switching a template on a new quote fatal, the same way it
	666	+ // did on the invoice side (see InvoiceController::handleLoadTemplate). The
	667	+ // model's constructor accepts null and fills itself from the field defaults,
	668	+ // so an empty instance renders a blank preview instead.
	669	+ $quote = new \EasyInvoice\Models\Quote();
571	670	if ($quote_id > 0) {
572		- $quote = $this->quote_repository->find($quote_id);
	671	+ $loaded = $this->quote_repository->find($quote_id);
	672	+ if ($loaded) {
	673	+ $quote = $loaded;
	674	+ }
573	675	}
574		-
575		- // Check if template file exists
576		- $template_file = EASY_INVOICE_PLUGIN_DIR . 'templates/quote-templates/' . $template_id . '.php';
577		-
578		- if (!file_exists($template_file)) {
579		- wp_send_json_error(['message' => __('Template not found.', 'easy-invoice')]);
580		- }
581		-
	676	+ // Unsaved edits from the builder take precedence over the stored values.
	677	+ $quote = \EasyInvoice\Helpers\PreviewOverlay::apply($quote, isset($_POST['form_data']) ? (string) wp_unslash($_POST['form_data']) : '', 'quote');
	678	+
582	679	// Start output buffering to capture template HTML
583	680	ob_start();
584		-
	681	+
585	682	// Include the template file
586	683	include $template_file;
587		-
	684	+
588	685	// Get the captured HTML
589	686	$html = ob_get_clean();
590		-
	687	+
591	688	wp_send_json_success(['html' => $html]);
592	689	}
593		-
	690	+
594	691	/**
	692	+ * Validate and sanitize template name to prevent directory traversal attacks
	693	+ *
	694	+ * @param string $template The template name to validate
	695	+ * @param string $type Either 'invoice' or 'quote'
	696	+ * @return string Validated template name or 'standard' as fallback
	697	+ */
	698	+ private function validateTemplateName($template, $type = 'quote') {
	699	+ // Whitelist of allowed template names
	700	+ $allowed_templates = array(
	701	+ 'invoice' => array('classic', 'corporate', 'creative', 'elegant', 'legacy', 'minimal', 'modern', 'professional', 'standard'),
	702	+ 'quote' => array('legacy', 'minimal', 'minimalist', 'modern', 'standard')
	703	+ );
	704	+
	705	+ // Strip any directory components using basename
	706	+ $template = basename($template);
	707	+
	708	+ // Remove any file extension
	709	+ $template = preg_replace('/\.(php|html|htm)$/i', '', $template);
	710	+
	711	+ // Remove any non-alphanumeric characters except hyphens and underscores
	712	+ $template = preg_replace('/[^a-z0-9_-]/i', '', $template);
	713	+
	714	+ // Check if template is in whitelist
	715	+ if (isset($allowed_templates[$type]) && in_array($template, $allowed_templates[$type], true)) {
	716	+ return $template;
	717	+ }
	718	+
	719	+ // Return default template if not in whitelist
	720	+ return 'standard';
	721	+ }
	722	+
	723	+ /**
	724	+ * Get secure template file path with directory traversal protection
	725	+ *
	726	+ * @param string $template The validated template name
	727	+ * @param string $type Either 'invoice' or 'quote'
	728	+ * @return string|false The secure template file path or false if invalid
	729	+ */
	730	+ private function getSecureTemplatePath($template, $type = 'quote') {
	731	+ // Define template directories
	732	+ $template_dirs = array(
	733	+ 'invoice' => EASY_INVOICE_PLUGIN_DIR . 'templates/invoice-templates/',
	734	+ 'quote' => EASY_INVOICE_PLUGIN_DIR . 'templates/quote-templates/'
	735	+ );
	736	+
	737	+ if (!isset($template_dirs[$type])) {
	738	+ return false;
	739	+ }
	740	+
	741	+ $template_dir = $template_dirs[$type];
	742	+
	743	+ // Ensure template directory exists and is a directory
	744	+ if (!is_dir($template_dir)) {
	745	+ return false;
	746	+ }
	747	+
	748	+ // Get the real path of the template directory (resolves any symlinks)
	749	+ $real_template_dir = realpath($template_dir);
	750	+ if ($real_template_dir === false) {
	751	+ return false;
	752	+ }
	753	+
	754	+ // Construct the template file path
	755	+ $template_file = $real_template_dir . DIRECTORY_SEPARATOR . $template . '.php';
	756	+
	757	+ // Get the real path of the template file (resolves any .. or . components)
	758	+ $real_template_file = realpath($template_file);
	759	+
	760	+ // Verify that the resolved path is within the template directory
	761	+ // This prevents directory traversal attacks
	762	+ if ($real_template_file === false || strpos($real_template_file, $real_template_dir) !== 0) {
	763	+ // If template doesn't exist or is outside the directory, use default
	764	+ $default_file = $real_template_dir . DIRECTORY_SEPARATOR . 'standard.php';
	765	+ $real_default_file = realpath($default_file);
	766	+
	767	+ if ($real_default_file !== false && strpos($real_default_file, $real_template_dir) === 0) {
	768	+ return $real_default_file;
	769	+ }
	770	+
	771	+ return false;
	772	+ }
	773	+
	774	+ // Verify the file exists and is readable
	775	+ if (!is_file($real_template_file) || !is_readable($real_template_file)) {
	776	+ // Fallback to standard template
	777	+ $default_file = $real_template_dir . DIRECTORY_SEPARATOR . 'standard.php';
	778	+ $real_default_file = realpath($default_file);
	779	+
	780	+ if ($real_default_file !== false && strpos($real_default_file, $real_template_dir) === 0 && is_file($real_default_file) && is_readable($real_default_file)) {
	781	+ return $real_default_file;
	782	+ }
	783	+
	784	+ return false;
	785	+ }
	786	+
	787	+ return $real_template_file;
	788	+ }
	789	+
	790	+ /**
595	791	* Handle AJAX request to create a new quote with just the title
596	792	*
597	793	* @since 1.0.0
598	794	*/
		@@ -601,9 +797,9 @@
601	797	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
602	798	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
603	799	}
604	800	// Check permissions
605		- if (!current_user_can('manage_options')) {
	801	+ if (!easy_invoice_user_can('ei_create_quote')) {
606	802	wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
607	803	}
608	804	$title = isset($_POST['title']) ? sanitize_text_field($_POST['title']) : '';
609	805	if (empty($title)) {
		@@ -608,9 +804,9 @@
608	804	$title = isset($_POST['title']) ? sanitize_text_field($_POST['title']) : '';
609	805	if (empty($title)) {
610	806	wp_send_json_error(['message' => __('Quote title is required.', 'easy-invoice')]);
611	807	}
612		-
	808	+
613	809	// Generate a unique quote number
614	810	$quote_number = '';
615	811	if (class_exists('\\EasyInvoice\\Services\\QuoteNumberService')) {
616	812	$quote_number_service = new \EasyInvoice\Services\QuoteNumberService();
		@@ -618,9 +814,9 @@
618	814	} else {
619	815	// Fallback if service doesn't exist
620	816	$quote_number = 'QT-' . str_pad(time(), 6, '0', STR_PAD_LEFT);
621	817	}
622		-
	818	+
623	819	// Get global quote settings
624	820	$settings_controller = new \EasyInvoice\Controllers\SettingsController();
625	821	$quote_terms = $settings_controller::getQuoteTermsConditions();
626	822	$quote_footer = $settings_controller::getQuoteFooterText();
		@@ -628,16 +824,16 @@
628	824	$quote_accept_action = get_option('easy_invoice_quote_accept_action', 'email');
629	825	$quote_accept_text = get_option('easy_invoice_quote_accept_text', __('Accept Quote', 'easy-invoice'));
630	826	$quote_accepted_message = get_option('easy_invoice_quote_accepted_message', __('Thank you for accepting our quote!', 'easy-invoice'));
631	827	$quote_declined_message = get_option('easy_invoice_quote_declined_message', __('Thank you for your consideration.', 'easy-invoice'));
632		-
	828	+
633	829	// Create the quote with just the title and default values
634	830	$data = [
635	831	'title' => $title,
636	832	'status' => 'draft',
637	833	'number' => $quote_number, // Use the generated unique number
638		- 'issue_date' => date('Y-m-d'),
639		- 'expiry_date' => date('Y-m-d', strtotime('+30 days')),
	834	+ 'issue_date' => current_time('Y-m-d'),
	835	+ 'expiry_date' => wp_date('Y-m-d', strtotime('+30 days')),
640	836	'items' => [],
641	837	'notes' => '', // Ensure notes is never null
642	838	'terms' => $quote_terms, // Use global terms setting
643	839	'footer_text' => $quote_footer, // Use global footer setting
		@@ -645,9 +841,12 @@
645	841	'accept_action' => $quote_accept_action, // Use global accept action setting
646	842	'accept_text' => $quote_accept_text, // Use global accept text setting
647	843	'accepted_message' => $quote_accepted_message, // Use global accepted message setting
648	844	'declined_message' => $quote_declined_message, // Use global declined message setting
	845	+ 'template' => get_option('easy_invoice_last_quote_template', 'standard')
649	846	];
	847	+
	848	+
650	849	$quote = $this->quote_repository->create($data);
651	850	if (!$quote) {
652	851	wp_send_json_error(['message' => __('Failed to create quote.', 'easy-invoice')]);
653	852	}
		@@ -652,9 +851,9 @@
652	851	wp_send_json_error(['message' => __('Failed to create quote.', 'easy-invoice')]);
653	852	}
654	853	wp_send_json_success(['quote_id' => $quote->getId()]);
655	854	}
656		-
	855	+
657	856	/**
658	857	* Handle AJAX request to load quote form for modal
659	858	*
660	859	* @since 1.0.0
		@@ -663,14 +862,14 @@
663	862	// Verify nonce
664	863	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
665	864	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
666	865	}
667		-
	866	+
668	867	// Check permissions
669		- if (!current_user_can('manage_options')) {
	868	+ if (!easy_invoice_user_can('ei_create_quote')) {
670	869	wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
671	870	}
672		-
	871	+
673	872	// Get global quote settings
674	873	$settings_controller = new \EasyInvoice\Controllers\SettingsController();
675	874	$quote_terms = $settings_controller::getQuoteTermsConditions();
676	875	$quote_footer = $settings_controller::getQuoteFooterText();
		@@ -678,15 +877,15 @@
678	877	$quote_accept_action = get_option('easy_invoice_quote_accept_action', 'email');
679	878	$quote_accept_text = get_option('easy_invoice_quote_accept_text', __('Accept Quote', 'easy-invoice'));
680	879	$quote_accepted_message = get_option('easy_invoice_quote_accepted_message', __('Thank you for accepting our quote!', 'easy-invoice'));
681	880	$quote_declined_message = get_option('easy_invoice_quote_declined_message', __('Thank you for your consideration.', 'easy-invoice'));
682		-
	881	+
683	882	// Create a new quote object for the form
684	883	$quote_number_service = function_exists('easy_invoice_get_quote_number_service') ? easy_invoice_get_quote_number_service() : null;
685	884	$quote_data = array(
686	885	'number' => $quote_number_service ? $quote_number_service->getNextNumber() : 'QT-1',
687		- 'date' => date('Y-m-d'),
688		- 'expiry_date' => date('Y-m-d', strtotime('+30 days')),
	886	+ 'date' => current_time('Y-m-d'),
	887	+ 'expiry_date' => wp_date('Y-m-d', strtotime('+30 days')),
689	888	'client_id' => 0,
690	889	'client_name' => '',
691	890	'client_email' => '',
692	891	'client_phone' => '',
		@@ -711,9 +910,9 @@
711	910	'accept_text' => $quote_accept_text, // Use global accept text setting
712	911	'accepted_message' => $quote_accepted_message, // Use global accepted message setting
713	912	'declined_message' => $quote_declined_message, // Use global declined message setting
714	913	);
715		-
	914	+
716	915	// Create a temporary WP_Post object for new quote
717	916	$empty_post = new \WP_Post((object) array(
718	917	'ID' => 0,
719	918	'post_author' => get_current_user_id(),
		@@ -733,11 +932,11 @@
733	932	'post_mime_type' => '',
734	933	'comment_count' => 0,
735	934	'filter' => 'raw',
736	935	));
737		-
	936	+
738	937	$quote = new \EasyInvoice\Models\Quote($empty_post);
739		-
	938	+
740	939	// Set default values on the quote object
741	940	foreach ($quote_data as $key => $value) {
742	941	$setter = 'set' . easy_invoice_str_replace('_', '', ucwords($key, '_'));
743	942	if (method_exists($quote, $setter)) {
		@@ -764,142 +963,298 @@
764	963	break;
765	964	}
766	965	}
767	966	}
768		-
	967	+
769	968	// Initialize empty items array
770	969	$quote->setItems([]);
771		-
	970	+
772	971	// Set variables needed by the form template
773	972	$quote_id = 0;
774		- $clients = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository()->all();
	973	+ $clients = [];
775	974	$quote_form_manager = new \EasyInvoice\Forms\Quote\QuoteFormManager();
776	975	$quote_items_json = json_encode([]);
777	976	$admin_nonce = wp_create_nonce('easy_invoice_admin_nonce');
778	977	$quote_field_config = $quote_form_manager->getFieldConfigForJavaScript();
779		-
	978	+
780	979	// Start output buffering to capture form HTML
781	980	ob_start();
782		-
	981	+
783	982	// Include the quote form template
784	983	include EASY_INVOICE_PLUGIN_DIR . 'templates/quotes/form.php';
785		-
	984	+
786	985	// Get the captured HTML
787	986	$html = ob_get_clean();
788		-
	987	+
789	988	wp_send_json_success(['html' => $html]);
790	989	}
791		-
	990	+
	991	+
792	992	/**
793		- * Handle search clients AJAX request
	993	+ * Nonce action for quote accept/decline (includes quote ID to prevent cross-quote reuse).
	994	+ */
	995	+ private function quoteAcceptDeclineNonceAction(int $quote_id): string {
	996	+ return 'easy_invoice_quote_action_' . $quote_id;
	997	+ }
	998	+
	999	+ /**
	1000	+ * Get the per-quote access token. Lazily generated on first read.
794	1001	*
795		- * @since 1.0.0
	1002	+ * Previously the public quote page embedded an `easy_invoice_quote_action_{id}`
	1003	+ * nonce that, combined with the off-by-default `easy_invoice_pro_restrict_quote_to_client`
	1004	+ * option, let any visitor accept or decline any published quote
	1005	+ * (CVE-2026-9021). The token replaces that public-nonce-as-authorisation
	1006	+ * model: it's a cryptographically random per-quote secret that's only
	1007	+ * leaked to the legitimate quote recipient via the emailed link's
	1008	+ * `?qk=...` parameter, and is required server-side by the accept /
	1009	+ * decline handlers (alongside an unconditional ownership check on
	1010	+ * authenticated callers).
	1011	+ *
	1012	+ * The token is single-purpose (just accept/decline gating) and lives
	1013	+ * in private post meta. We generate 32 hex chars (128 bits of entropy)
	1014	+ * which is well above what's brute-forceable inside the lifetime of a
	1015	+ * published quote.
796	1016	*/
797		- public function handleSearchClients(): void {
798		- // Verify nonce
799		- if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_nonce')) {
800		- wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
	1017	+ public static function quoteAccessToken(int $quote_id): string {
	1018	+ if ($quote_id <= 0) {
	1019	+ return '';
801	1020	}
802		-
803		- // Check permissions
804		- if (!current_user_can('manage_options')) {
805		- wp_send_json_error(['message' => __('Insufficient permissions.', 'easy-invoice')]);
	1021	+ $token = (string) get_post_meta($quote_id, '_easy_invoice_quote_access_token', true);
	1022	+ if ($token === '' || strlen($token) < 32) {
	1023	+ try {
	1024	+ $token = bin2hex(random_bytes(16));
	1025	+ } catch (\Throwable $e) {
	1026	+ // Fallback for systems without CSPRNG. wp_generate_password uses
	1027	+ // random_bytes internally on modern PHP — same entropy source.
	1028	+ $token = wp_generate_password(32, false, false);
	1029	+ }
	1030	+ update_post_meta($quote_id, '_easy_invoice_quote_access_token', $token);
806	1031	}
807		-
808		- $query = sanitize_text_field($_POST['query'] ?? '');
809		-
810		- // If query is empty, get all clients
811		- if (empty($query)) {
812		- $clients = $this->client_repository->all();
813		- } else {
814		- // Search clients by name, email, or company
815		- $clients = $this->client_repository->search($query);
	1032	+ return $token;
	1033	+ }
	1034	+
	1035	+ /**
	1036	+ * Read-only sibling of quoteAccessToken(). Returns the persisted
	1037	+ * token if one already exists, or an empty string otherwise — never
	1038	+ * mints. Use this from user-controlled rendering contexts (e.g. the
	1039	+ * `[easy_quote_url]` shortcode) where allowing an arbitrary caller
	1040	+ * to MINT an Accept/Decline-authorising token for an attacker-chosen
	1041	+ * quote would be a privilege-escalation vector.
	1042	+ *
	1043	+ * Trusted server contexts (the EmailManager quote-send path) should
	1044	+ * keep calling quoteAccessToken() so first-send still works.
	1045	+ */
	1046	+ public static function quoteAccessTokenIfExists(int $quote_id): string {
	1047	+ if ($quote_id <= 0) {
	1048	+ return '';
816	1049	}
817		-
818		- $results = [];
819		- foreach ($clients as $client) {
820		- $results[] = [
821		- 'id' => $client->getId(),
822		- 'name' => $client->getBusinessClientName() ?: ($client->getFirstName() . ' ' . $client->getLastName()),
823		- 'email' => $client->getEmail(),
824		- 'company' => $client->getBusinessClientName(),
825		- 'phone' => $client->getExtraInfo(),
826		- 'website' => $client->getWebsite(),
827		- 'address' => $client->getAddress()
828		- ];
	1050	+ $token = (string) get_post_meta($quote_id, '_easy_invoice_quote_access_token', true);
	1051	+ return strlen($token) >= 32 ? $token : '';
	1052	+ }
	1053	+
	1054	+ /**
	1055	+ * Constant-time comparison helper for the access token.
	1056	+ */
	1057	+ private static function quoteTokenFromRequest(): string {
	1058	+ $token = '';
	1059	+ if (isset($_POST['access_token'])) {
	1060	+ $token = sanitize_text_field(wp_unslash($_POST['access_token']));
	1061	+ } elseif (isset($_GET['qk'])) {
	1062	+ $token = sanitize_text_field(wp_unslash($_GET['qk']));
829	1063	}
830		-
831		- wp_send_json_success($results);
	1064	+ /** This filter is documented in includes/Controllers/InvoiceController.php */
	1065	+ return (string) apply_filters('easy_invoice_presented_access_token', $token, 'quote');
832	1066	}
833		-
	1067	+
834	1068	/**
	1069	+ * Central authorisation check for quote accept/decline. Returns true
	1070	+ * when ANY of these is true:
	1071	+ *
	1072	+ * 1. The request carries a valid per-quote access token (the legitimate
	1073	+ * email-recipient flow). Constant-time compared with hash_equals.
	1074	+ * 2. The current user is logged in AND has admin-grade capability
	1075	+ * (manage_options) — admin-side accept/decline.
	1076	+ * 3. The current user is logged in AND is the quote's bound client
	1077	+ * (email match against the quote's client_id record). This was
	1078	+ * previously gated behind the off-by-default
	1079	+ * `easy_invoice_pro_restrict_quote_to_client` option — that gate
	1080	+ * is removed in 2.3.4 so the ownership check runs unconditionally.
	1081	+ *
	1082	+ * Returns false otherwise. Callers must reject the request when this
	1083	+ * returns false; we don't reject from in here so the caller can choose
	1084	+ * wp_send_json_error vs wp_die based on its transport.
	1085	+ */
	1086	+ /**
	1087	+ * Whether a quote can still be accepted or declined: it must be open
	1088	+ * (draft, available or sent) and not past its expiry date.
	1089	+ *
	1090	+ * @param object $quote Quote model.
	1091	+ * @return true|\WP_Error Error carrying the reason to show the client.
	1092	+ */
	1093	+ public static function openForDecision($quote) {
	1094	+ $status = is_callable([$quote, 'getStatus']) ? strtolower((string) $quote->getStatus()) : '';
	1095	+ if ('accepted' === $status) {
	1096	+ return new \WP_Error('easy_invoice_quote_closed', __('This quote has already been accepted.', 'easy-invoice'));
	1097	+ }
	1098	+ if ('declined' === $status) {
	1099	+ return new \WP_Error('easy_invoice_quote_closed', __('This quote has already been declined.', 'easy-invoice'));
	1100	+ }
	1101	+ if (!in_array($status, ['draft', 'available', 'sent', 'expired'], true)) {
	1102	+ return new \WP_Error('easy_invoice_quote_closed', __('This quote is no longer open.', 'easy-invoice'));
	1103	+ }
	1104	+ $expiry = is_callable([$quote, 'getExpiryDate']) ? (string) $quote->getExpiryDate() : '';
	1105	+ $expired = 'expired' === $status
	1106	+ || ('' !== $expiry && strtotime($expiry) && gmdate('Y-m-d', strtotime($expiry)) < gmdate('Y-m-d', current_time('timestamp')));
	1107	+ if ($expired) {
	1108	+ return new \WP_Error(
	1109	+ 'easy_invoice_quote_expired',
	1110	+ '' !== $expiry
	1111	+ /* translators: %s: expiry date. */
	1112	+ ? sprintf(__('This quote expired on %s. Please ask for a new one.', 'easy-invoice'), date_i18n(get_option('date_format'), strtotime($expiry)))
	1113	+ : __('This quote has expired. Please ask for a new one.', 'easy-invoice')
	1114	+ );
	1115	+ }
	1116	+ return true;
	1117	+ }
	1118	+
	1119	+ public static function canActOnQuote(int $quote_id, $quote = null): bool {
	1120	+ if ($quote_id <= 0) {
	1121	+ return false;
	1122	+ }
	1123	+
	1124	+ // Path 1: legitimate access-token flow (email link recipient).
	1125	+ $presented = self::quoteTokenFromRequest();
	1126	+ if ($presented !== '') {
	1127	+ $stored = (string) get_post_meta($quote_id, '_easy_invoice_quote_access_token', true);
	1128	+ if ($stored !== '' && hash_equals($stored, $presented)) {
	1129	+ return true;
	1130	+ }
	1131	+ }
	1132	+
	1133	+ // Path 2: admin override.
	1134	+ if (current_user_can('manage_options')) {
	1135	+ return true;
	1136	+ }
	1137	+
	1138	+ // Path 3: authenticated owner. ONLY when the current user is the
	1139	+ // quote's bound client (email match). Previously this was
	1140	+ // skipped entirely when the Pro option was 'no' (the default) —
	1141	+ // which is what made the CVE exploitable. Now it always runs.
	1142	+ //
	1143	+ // Note: Quote model resolves `getClientId()` via __call magic,
	1144	+ // so method_exists() returns FALSE for it (PHP's method_exists
	1145	+ // does not recognise __call-resolved methods). Use is_callable
	1146	+ // instead — it correctly returns TRUE when the receiver has a
	1147	+ // __call that can field the message, so this guard actually
	1148	+ // permits the bound-client path on real Quote objects.
	1149	+ if (is_user_logged_in() && $quote && is_callable([$quote, 'getClientId']) && $quote->getClientId()) {
	1150	+ $current_user = wp_get_current_user();
	1151	+ $client_repository = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository();
	1152	+ $client = $client_repository->find($quote->getClientId());
	1153	+ if ($client && strcasecmp((string) $client->getEmail(), (string) $current_user->user_email) === 0) {
	1154	+ return true;
	1155	+ }
	1156	+ }
	1157	+
	1158	+ return false;
	1159	+ }
	1160	+
	1161	+ /**
835	1162	* Handle AJAX request to accept a quote
836	1163	*
837	1164	* @since 1.0.0
838	1165	*/
839	1166	public function handleAcceptQuote(): void {
840		- // Verify nonce
841		- if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_quote_action')) {
842		- wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
843		- }
844		-
845	1167	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
846		-
	1168	+
847	1169	if ($quote_id <= 0) {
848	1170	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
849	1171	}
850		-
851		- // Get the quote
852		- $quote = $this->quote_repository->find($quote_id);
853		-
	1172	+
	1173	+ // Quote-scoped nonce prevents cross-quote IDOR with a leaked global nonce.
	1174	+ if (!wp_verify_nonce($_POST['nonce'] ?? '', $this->quoteAcceptDeclineNonceAction($quote_id))) {
	1175	+ wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
	1176	+ }
	1177	+
	1178	+ $is_admin = current_user_can('manage_options');
	1179	+ if ($is_admin) {
	1180	+ $quote = $this->quote_repository->find($quote_id);
	1181	+ } else {
	1182	+ $quote = $this->quote_repository->findPublished($quote_id);
	1183	+ }
	1184	+
854	1185	if (!$quote) {
855	1186	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
856	1187	}
857		-
858		- // Check if user has permission to accept this quote
	1188	+
	1189	+ // SECURITY (CVE-2026-9021): authorise unconditionally — admin, valid
	1190	+ // access token (email-link path), or authenticated client whose
	1191	+ // email matches the quote's bound client. The previous gating
	1192	+ // behind easy_invoice_pro_restrict_quote_to_client was OFF by
	1193	+ // default, letting any anonymous visitor who could read the public
	1194	+ // single-quote page harvest the nonce and accept arbitrary quotes.
	1195	+ if (!self::canActOnQuote($quote_id, $quote)) {
	1196	+ wp_send_json_error(['message' => __('You do not have permission to accept this quote.', 'easy-invoice')]);
	1197	+ }
	1198	+
	1199	+ $ei_open = self::openForDecision($quote);
	1200	+ if (is_wp_error($ei_open)) {
	1201	+ wp_send_json_error(['message' => $ei_open->get_error_message()]);
	1202	+ }
	1203	+
859	1204	$current_user = wp_get_current_user();
860		- $is_admin = current_user_can('manage_options');
861		-
862		- if (!$is_admin) {
863		- // For non-admins, check if they are the client
864		- if ($quote->getClientId()) {
865		- $client_repository = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository();
866		- $client = $client_repository->find($quote->getClientId());
867		-
868		- if (!$client || $client->getEmail() !== $current_user->user_email) {
869		- wp_send_json_error(['message' => __('You do not have permission to accept this quote.', 'easy-invoice')]);
870		- }
871		- } else {
872		- wp_send_json_error(['message' => __('You do not have permission to accept this quote.', 'easy-invoice')]);
873		- }
874		- }
875		-
	1205	+
876	1206	// Get global accept action setting
877	1207	$settings_controller = new \EasyInvoice\Controllers\SettingsController();
878	1208	$accept_action = $settings_controller::getQuoteAcceptAction();
879		-
	1209	+
880	1210	// Update quote status to accepted
881	1211	$quote->setStatus('accepted');
882		- $quote->setAcceptedDate(date('Y-m-d H:i:s'));
	1212	+ $quote->setAcceptedDate(gmdate('Y-m-d H:i:s'));
883	1213	$quote->setAcceptedBy($current_user->ID);
884		-
	1214	+
885	1215	// Save the quote
886	1216	$saved = $quote->save();
887		-
	1217	+
888	1218	if (!$saved) {
889	1219	wp_send_json_error(['message' => __('Failed to accept quote.', 'easy-invoice')]);
890	1220	}
891		-
	1221	+
892	1222	// Log the quote acceptance
893	1223	$this->quote_log_service->logAcceptance($quote_id, [
894	1224	'accept_action' => $accept_action,
895	1225	'user_type' => $is_admin ? 'admin' : 'client'
896	1226	]);
897		-
	1227	+
	1228	+ // What the acceptance was made with. The signature is a data-URL PNG
	1229	+ // from the page's signature pad (only present when an addon asked for
	1230	+ // it); it is validated here and stored by whoever listens.
	1231	+ $signature = isset($_POST['signature']) ? (string) wp_unslash($_POST['signature']) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- validated below.
	1232	+ if ('' !== $signature && !preg_match('#^data:image/png;base64,[A-Za-z0-9+/=]+$#', $signature)) {
	1233	+ $signature = '';
	1234	+ }
	1235	+ /**
	1236	+ * Fires once a quote has been accepted and saved.
	1237	+ *
	1238	+ * @param int $quote_id Quote id.
	1239	+ * @param object $quote Quote model.
	1240	+ * @param array $context accept_action, user_type, signature (data URL or ''),
	1241	+ * signer_name, ip, user_agent, accepted_at.
	1242	+ */
	1243	+ do_action('easy_invoice_quote_accepted', $quote_id, $quote, [
	1244	+ 'accept_action' => $accept_action,
	1245	+ 'user_type' => $is_admin ? 'admin' : 'client',
	1246	+ 'signature' => $signature,
	1247	+ 'signer_name' => isset($_POST['signer_name']) ? sanitize_text_field(wp_unslash($_POST['signer_name'])) : '',
	1248	+ 'ip' => isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '',
	1249	+ 'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '',
	1250	+ 'accepted_at' => current_time('mysql'),
	1251	+ ]);
	1252	+
898	1253	// Perform the configured accept action
899	1254	$invoice_id = null;
900	1255	$action_message = '';
901		-
	1256	+
902	1257	switch ($accept_action) {
903	1258	case 'convert':
904	1259	// Convert quote to invoice (Draft status)
905	1260	$invoice_id = $this->convertQuoteToInvoice($quote, 'draft');
		@@ -907,9 +1262,9 @@
907	1262	$this->quote_log_service->logConversionToInvoice($quote_id, $invoice_id);
908	1263	}
909	1264	$action_message = __('Quote converted to invoice successfully.', 'easy-invoice');
910	1265	break;
911		-
	1266	+
912	1267	case 'convert_available':
913	1268	// Convert quote to invoice (Available status)
914	1269	$invoice_id = $this->convertQuoteToInvoice($quote, 'available');
915	1270	if ($invoice_id) {
		@@ -916,9 +1271,9 @@
916	1271	$this->quote_log_service->logConversionToInvoice($quote_id, $invoice_id);
917	1272	}
918	1273	$action_message = __('Quote converted to invoice successfully.', 'easy-invoice');
919	1274	break;
920		-
	1275	+
921	1276	case 'convert_send':
922	1277	// Convert quote to invoice and send to client (Available status)
923	1278	$invoice_id = $this->convertQuoteToInvoice($quote, 'available');
924	1279	if ($invoice_id) {
		@@ -925,9 +1280,9 @@
925	1280	$this->sendInvoiceToClient($invoice_id);
926	1281	}
927	1282	$action_message = __('Quote converted to invoice and sent to client successfully.', 'easy-invoice');
928	1283	break;
929		-
	1284	+
930	1285	case 'duplicate':
931	1286	// Create new invoice, keep quote as-is (Draft status)
932	1287	$invoice_id = $this->createInvoiceFromQuote($quote, 'draft');
933	1288	if ($invoice_id) {
		@@ -934,9 +1289,9 @@
934	1289	$this->quote_log_service->logDuplicationToInvoice($quote_id, $invoice_id);
935	1290	}
936	1291	$action_message = __('New invoice created from quote successfully.', 'easy-invoice');
937	1292	break;
938		-
	1293	+
939	1294	case 'duplicate_send':
940	1295	// Create new invoice and send to client, keep quote as-is (Available status)
941	1296	$invoice_id = $this->createInvoiceFromQuote($quote, 'available');
942	1297	if ($invoice_id) {
		@@ -943,9 +1298,9 @@
943	1298	$this->sendInvoiceToClient($invoice_id);
944	1299	}
945	1300	$action_message = __('New invoice created and sent to client successfully.', 'easy-invoice');
946	1301	break;
947		-
	1302	+
948	1303	case 'do_nothing':
949	1304	default:
950	1305	// Do nothing additional
951	1306	$action_message = __('Quote accepted successfully.', 'easy-invoice');
		@@ -950,30 +1305,30 @@
950	1305	// Do nothing additional
951	1306	$action_message = __('Quote accepted successfully.', 'easy-invoice');
952	1307	break;
953	1308	}
954		-
	1309	+
955	1310	// Send notification email to admin
956	1311	if (!$is_admin) {
957	1312	$this->sendQuoteAcceptanceNotification($quote);
958	1313	}
959		-
	1314	+
960	1315	// Get URLs for the new invoice
961	1316	$invoice_url = null;
962	1317	$secure_url = null;
963		-
	1318	+
964	1319	if ($invoice_id) {
965	1320	// Always use WordPress permalink
966	1321	$invoice_url = get_permalink($invoice_id);
967	1322	// If Pro and secure link available, use secure link
968		- if (class_exists('\EasyInvoicePro\Controllers\PermalinkController')) {
969		- $secure_url = \EasyInvoicePro\Controllers\PermalinkController::getInvoiceSecureLinkUrl($invoice_id);
	1323	+ if (class_exists('\EasyInvoicePro\Addons\SecureLinks\Controllers\PermalinkController')) {
	1324	+ $secure_url = \EasyInvoicePro\Addons\SecureLinks\Controllers\PermalinkController::getInvoiceSecureLinkUrl($invoice_id);
970	1325	if ($secure_url) {
971	1326	$invoice_url = $secure_url;
972	1327	}
973	1328	}
974	1329	}
975		-
	1330	+
976	1331	wp_send_json_success([
977	1332	'message' => $action_message,
978	1333	'invoice_id' => $invoice_id,
979	1334	'invoice_url' => $invoice_url,
		@@ -983,9 +1338,9 @@
983	1338	'message' => $action_message
984	1339	]
985	1340	]);
986	1341	}
987		-
	1342	+
988	1343	/**
989	1344	* Convert quote to invoice
990	1345	*
991	1346	* @param \EasyInvoice\Models\Quote $quote The quote to convert
		@@ -991,20 +1346,94 @@
991	1346	* @param \EasyInvoice\Models\Quote $quote The quote to convert
992	1347	* @param string $status The status for the new invoice ('draft' or 'available')
993	1348	* @return int|null The invoice ID if successful, null otherwise
994	1349	*/
	1350	+ /**
	1351	+ * "Convert to invoice" on the quote row — for the quote the client accepted
	1352	+ * by phone or in person, which the public Accept button never sees.
	1353	+ *
	1354	+ * @param array $actions Row actions.
	1355	+ * @param object $quote Quote model.
	1356	+ * @return array
	1357	+ */
	1358	+ public function addConvertRowAction($actions, $quote): array {
	1359	+ $actions = is_array($actions) ? $actions : [];
	1360	+ if (!easy_invoice_user_can('ei_create_invoice') || !is_callable([$quote, 'getId'])) {
	1361	+ return $actions;
	1362	+ }
	1363	+ $converted = (int) get_post_meta((int) $quote->getId(), '_easy_invoice_quote_converted_invoice_id', true);
	1364	+ if ($converted > 0 && get_post($converted)) {
	1365	+ $actions['convert'] = sprintf(
	1366	+ '<a href="%s" class="text-emerald-700 font-semibold" title="%s">%s</a>',
	1367	+ esc_url(admin_url('admin.php?page=easy-invoice-builder&invoice_id=' . $converted)),
	1368	+ esc_attr__('Open the invoice made from this quote', 'easy-invoice'),
	1369	+ esc_html__('Invoice', 'easy-invoice')
	1370	+ );
	1371	+ return $actions;
	1372	+ }
	1373	+ $actions['convert'] = sprintf(
	1374	+ '<a href="#" class="convert-quote text-indigo-600 font-semibold" data-quote-id="%d" data-quote-number="%s">%s</a>',
	1375	+ (int) $quote->getId(),
	1376	+ esc_attr((string) $quote->getNumber()),
	1377	+ esc_html__('Convert to invoice', 'easy-invoice')
	1378	+ );
	1379	+ return $actions;
	1380	+ }
	1381	+
	1382	+ /**
	1383	+ * AJAX: make a draft invoice from a quote and mark the quote accepted.
	1384	+ */
	1385	+ public function handleConvertQuote(): void {
	1386	+ if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'easy_invoice_admin_nonce')) {
	1387	+ wp_send_json_error(['message' => __('Security check failed. Please reload the page and try again.', 'easy-invoice')]);
	1388	+ }
	1389	+ if (!easy_invoice_user_can('ei_create_invoice')) {
	1390	+ wp_send_json_error(['message' => __('You do not have permission to create invoices.', 'easy-invoice')]);
	1391	+ }
	1392	+ $quote_id = isset($_POST['quote_id']) ? absint($_POST['quote_id']) : 0;
	1393	+ $quote = $quote_id > 0 ? $this->quote_repository->find($quote_id) : null;
	1394	+ if (!$quote) {
	1395	+ wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
	1396	+ }
	1397	+ $existing = (int) get_post_meta($quote_id, '_easy_invoice_quote_converted_invoice_id', true);
	1398	+ if ($existing > 0 && get_post($existing)) {
	1399	+ wp_send_json_success(['invoice_id' => $existing, 'already' => true, 'message' => __('This quote already has an invoice.', 'easy-invoice')]);
	1400	+ }
	1401	+ $invoice_id = $this->convertQuoteToInvoice($quote, 'draft');
	1402	+ if (!$invoice_id) {
	1403	+ wp_send_json_error(['message' => __('The invoice could not be created.', 'easy-invoice')]);
	1404	+ }
	1405	+ update_post_meta($quote_id, '_easy_invoice_quote_converted_invoice_id', $invoice_id);
	1406	+ update_post_meta($invoice_id, '_easy_invoice_converted_from_quote', $quote_id);
	1407	+ if (!in_array((string) $quote->getStatus(), ['accepted', 'declined', 'cancelled'], true)) {
	1408	+ update_post_meta($quote_id, '_easy_invoice_quote_status', 'accepted');
	1409	+ }
	1410	+ /**
	1411	+ * Fires after an administrator converts a quote into an invoice by hand.
	1412	+ *
	1413	+ * @param int $quote_id Quote.
	1414	+ * @param int $invoice_id New draft invoice.
	1415	+ */
	1416	+ do_action('easy_invoice_quote_converted_manually', $quote_id, $invoice_id);
	1417	+ wp_send_json_success([
	1418	+ 'invoice_id' => $invoice_id,
	1419	+ 'message' => __('Draft invoice created from the quote.', 'easy-invoice'),
	1420	+ 'redirect' => admin_url('admin.php?page=easy-invoice-builder&invoice_id=' . $invoice_id),
	1421	+ ]);
	1422	+ }
	1423	+
995	1424	private function convertQuoteToInvoice($quote, $status = 'draft'): ?int {
996	1425	try {
997	1426	// Get invoice repository
998	1427	$invoice_repository = \EasyInvoice\Providers\InvoiceServiceProvider::getInvoiceRepository();
999		-
	1428	+
1000	1429	// Create invoice data from quote - convert ALL fields
1001	1430	$invoice_data = [
1002	1431	'title' => $quote->getTitle() ?: 'Invoice from Quote ' . $quote->getNumber(),
1003	1432	'number' => $this->generateInvoiceNumber(),
1004	1433	'status' => $status,
1005		- 'issue_date' => date('Y-m-d'),
1006		- 'due_date' => date('Y-m-d', strtotime('+30 days')),
	1434	+ 'issue_date' => current_time('Y-m-d'),
	1435	+ 'due_date' => wp_date('Y-m-d', strtotime('+30 days')),
1007	1436	'client_id' => $quote->getClientId(),
1008	1437	'customer_name' => $quote->getCustomerName(),
1009	1438	'customer_email' => $quote->getCustomerEmail(),
1010	1439	'customer_address' => $quote->getCustomerAddress(),
		@@ -1019,8 +1448,9 @@
1019	1448	'payment_gateways' => [], // Invoice-specific field, leave empty
1020	1449	'template' => $quote->getTemplate(),
1021	1450	'subtotal' => $quote->getSubtotal(),
1022	1451	'tax_rate' => $quote->getTaxRate(),
	1452	+ 'tax_enabled' => $quote->getTaxEnabled() ?: (get_option('easy_invoice_tax_enabled', 'no') === 'yes' ? 'yes' : 'no'),
1023	1453	'tax_amount' => $quote->getTaxAmount(),
1024	1454	'discount_type' => $quote->getDiscountType(),
1025	1455	'discount_value' => $quote->getDiscountValue(),
1026	1456	'discount_amount' => $quote->getDiscountAmount(),
		@@ -1031,29 +1461,51 @@
1031	1461	'calculation_method' => 'standard', // Default calculation method for invoices
1032	1462	'prices_include_tax' => $quote->getPricesIncludeTax(),
1033	1463	'custom_fields' => $quote->getCustomFields(), // Transfer custom fields
1034	1464	];
1035		-
	1465	+
	1466	+ /**
	1467	+ * Filter the data an invoice is created from when a quote is
	1468	+ * converted, so addons can carry their own quote fields across.
	1469	+ *
	1470	+ * @param array $invoice_data
	1471	+ * @param Quote $quote
	1472	+ */
	1473	+ $invoice_data = apply_filters('easy_invoice_quote_to_invoice_data', $invoice_data, $quote);
	1474	+
1036	1475	// Create the invoice
1037	1476	$invoice = $invoice_repository->create($invoice_data);
1038		-
	1477	+
1039	1478	if ($invoice) {
1040	1479	// Store the quote ID in the invoice's meta for tracking
1041	1480	update_post_meta($invoice->getId(), '_converted_from_quote', $quote->getId());
1042		-
1043		- // Update quote to reference the created invoice
	1481	+ update_post_meta($invoice->getId(), '_easy_invoice_converted_from_quote', $quote->getId());
	1482	+
	1483	+ // Update quote to reference the created invoice — the same key
	1484	+ // the quote list and "convert" guard read, whichever path
	1485	+ // (manual convert, accept-and-convert) produced the invoice.
	1486	+ update_post_meta($quote->getId(), '_easy_invoice_quote_converted_invoice_id', (int) $invoice->getId());
1044	1487	$quote->setCustomField('converted_invoice_id', $invoice->getId());
1045	1488	$quote->save();
1046		-
	1489	+
1047	1490	// Ensure secure link is generated for the new invoice (Pro version)
1048		- if (class_exists('\EasyInvoicePro\Controllers\PermalinkController')) {
1049		- // Trigger the save_post hook to generate secure link
1050		- do_action('save_post_easy_invoice', $invoice->getId(), get_post($invoice->getId()));
	1491	+ if (class_exists('\EasyInvoicePro\Addons\SecureLinks\Controllers\PermalinkController')) {
	1492	+ // Trigger the save_post hook to generate secure link.
	1493	+ //
	1494	+ // Core's save_post_{post_type} passes three arguments — $post_id,
	1495	+ // $post and $update — and callbacks are written against that
	1496	+ // signature. Firing it with two put a client-facing fatal on the
	1497	+ // quote-acceptance path: Team Roles' audit logger declares all three
	1498	+ // as required, so accepting a quote raised ArgumentCountError and
	1499	+ // the customer got "There has been a critical error on this website"
	1500	+ // after the invoice had already been created. Passing `true` for
	1501	+ // $update because the invoice row exists by this point.
	1502	+ do_action('save_post_easy_invoice', $invoice->getId(), get_post($invoice->getId()), true);
1051	1503	}
1052		-
	1504	+
1053	1505	return $invoice->getId();
1054	1506	}
1055		-
	1507	+
1056	1508	return null;
1057	1509	} catch (\Exception $e) {
1058	1510	// Error converting quote to invoice
1059	1511	return null;
		@@ -1058,9 +1510,9 @@
1058	1510	// Error converting quote to invoice
1059	1511	return null;
1060	1512	}
1061	1513	}
1062		-
	1514	+
1063	1515	/**
1064	1516	* Create new invoice from quote (duplicate)
1065	1517	*
1066	1518	* @param \EasyInvoice\Models\Quote $quote The quote to duplicate
		@@ -1070,16 +1522,16 @@
1070	1522	private function createInvoiceFromQuote($quote, $status = 'draft'): ?int {
1071	1523	try {
1072	1524	// Get invoice repository
1073	1525	$invoice_repository = \EasyInvoice\Providers\InvoiceServiceProvider::getInvoiceRepository();
1074		-
	1526	+
1075	1527	// Create invoice data from quote - convert ALL fields
1076	1528	$invoice_data = [
1077	1529	'title' => 'Invoice from Quote ' . $quote->getNumber(),
1078	1530	'number' => $this->generateInvoiceNumber(),
1079	1531	'status' => $status,
1080		- 'issue_date' => date('Y-m-d'),
1081		- 'due_date' => date('Y-m-d', strtotime('+30 days')),
	1532	+ 'issue_date' => current_time('Y-m-d'),
	1533	+ 'due_date' => wp_date('Y-m-d', strtotime('+30 days')),
1082	1534	'client_id' => $quote->getClientId(),
1083	1535	'customer_name' => $quote->getCustomerName(),
1084	1536	'customer_email' => $quote->getCustomerEmail(),
1085	1537	'customer_address' => $quote->getCustomerAddress(),
		@@ -1094,8 +1546,9 @@
1094	1546	'payment_gateways' => [], // Invoice-specific field, leave empty
1095	1547	'template' => $quote->getTemplate(),
1096	1548	'subtotal' => $quote->getSubtotal(),
1097	1549	'tax_rate' => $quote->getTaxRate(),
	1550	+ 'tax_enabled' => $quote->getTaxEnabled() ?: (get_option('easy_invoice_tax_enabled', 'no') === 'yes' ? 'yes' : 'no'),
1098	1551	'tax_amount' => $quote->getTaxAmount(),
1099	1552	'discount_type' => $quote->getDiscountType(),
1100	1553	'discount_value' => $quote->getDiscountValue(),
1101	1554	'discount_amount' => $quote->getDiscountAmount(),
		@@ -1106,26 +1559,44 @@
1106	1559	'calculation_method' => 'standard', // Default calculation method for invoices
1107	1560	'prices_include_tax' => $quote->getPricesIncludeTax(),
1108	1561	'custom_fields' => $quote->getCustomFields(), // Transfer custom fields
1109	1562	];
1110		-
	1563	+
	1564	+ /**
	1565	+ * Filter the data an invoice is created from when a quote is
	1566	+ * converted, so addons can carry their own quote fields across.
	1567	+ *
	1568	+ * @param array $invoice_data
	1569	+ * @param Quote $quote
	1570	+ */
	1571	+ $invoice_data = apply_filters('easy_invoice_quote_to_invoice_data', $invoice_data, $quote);
	1572	+
1111	1573	// Create the invoice
1112	1574	$invoice = $invoice_repository->create($invoice_data);
1113		-
	1575	+
1114	1576	if ($invoice) {
1115	1577	// Link the invoice to the quote
1116	1578	$quote->setCustomField('related_invoice_id', $invoice->getId());
1117	1579	$quote->save();
1118		-
	1580	+
1119	1581	// Ensure secure link is generated for the new invoice (Pro version)
1120		- if (class_exists('\EasyInvoicePro\Controllers\PermalinkController')) {
1121		- // Trigger the save_post hook to generate secure link
1122		- do_action('save_post_easy_invoice', $invoice->getId(), get_post($invoice->getId()));
	1582	+ if (class_exists('\EasyInvoicePro\Addons\SecureLinks\Controllers\PermalinkController')) {
	1583	+ // Trigger the save_post hook to generate secure link.
	1584	+ //
	1585	+ // Core's save_post_{post_type} passes three arguments — $post_id,
	1586	+ // $post and $update — and callbacks are written against that
	1587	+ // signature. Firing it with two put a client-facing fatal on the
	1588	+ // quote-acceptance path: Team Roles' audit logger declares all three
	1589	+ // as required, so accepting a quote raised ArgumentCountError and
	1590	+ // the customer got "There has been a critical error on this website"
	1591	+ // after the invoice had already been created. Passing `true` for
	1592	+ // $update because the invoice row exists by this point.
	1593	+ do_action('save_post_easy_invoice', $invoice->getId(), get_post($invoice->getId()), true);
1123	1594	}
1124		-
	1595	+
1125	1596	return $invoice->getId();
1126	1597	}
1127		-
	1598	+
1128	1599	return null;
1129	1600	} catch (\Exception $e) {
1130	1601	// Error creating invoice from quote
1131	1602	return null;
		@@ -1130,9 +1601,9 @@
1130	1601	// Error creating invoice from quote
1131	1602	return null;
1132	1603	}
1133	1604	}
1134		-
	1605	+
1135	1606	/**
1136	1607	* Send invoice to client
1137	1608	*
1138	1609	* @param int $invoice_id The invoice ID
		@@ -1142,19 +1613,19 @@
1142	1613	try {
1143	1614	// Get invoice
1144	1615	$invoice_repository = \EasyInvoice\Providers\InvoiceServiceProvider::getInvoiceRepository();
1145	1616	$invoice = $invoice_repository->find($invoice_id);
1146		-
	1617	+
1147	1618	if (!$invoice) {
1148	1619	return false;
1149	1620	}
1150		-
	1621	+
1151	1622	// Get email manager
1152	1623	$email_manager = \EasyInvoice\Services\EmailManager::getInstance();
1153		-
	1624	+
1154	1625	// Send invoice email
1155	1626	$result = $email_manager->sendInvoiceEmail($invoice, 'new');
1156		-
	1627	+
1157	1628	return $result['success'];
1158	1629	} catch (\Exception $e) {
1159	1630	// Error sending invoice to client
1160	1631	return false;
		@@ -1159,9 +1630,9 @@
1159	1630	// Error sending invoice to client
1160	1631	return false;
1161	1632	}
1162	1633	}
1163		-
	1634	+
1164	1635	/**
1165	1636	* Convert quote items to invoice items
1166	1637	*
1167	1638	* @param array $quote_items Array of quote items
		@@ -1168,19 +1639,29 @@
1168	1639	* @return array Array of invoice items
1169	1640	*/
1170	1641	private function convertQuoteItemsToInvoiceItems(array $quote_items): array {
1171	1642	$invoice_items = [];
1172		-
	1643	+
1173	1644	foreach ($quote_items as $quote_item) {
1174	1645	if (is_object($quote_item) && method_exists($quote_item, 'toArray')) {
1175		- // Convert QuoteItem object to InvoiceItem array
	1646	+ // A saved quote stores its lines as title/total, an invoice as
	1647	+ // name/amount; read through the model, which knows both, or
	1648	+ // the converted invoice has nameless lines that add up to 0.
1176	1649	$item_data = $quote_item->toArray();
	1650	+ $name = (string) (is_callable([$quote_item, 'getName']) ? $quote_item->getName() : '');
	1651	+ if ('' === $name) {
	1652	+ $name = (string) ($item_data['name'] ?? $item_data['title'] ?? '');
	1653	+ }
	1654	+ $amount = $item_data['amount'] ?? $item_data['total'] ?? null;
	1655	+ if (null === $amount || '' === $amount) {
	1656	+ $amount = is_callable([$quote_item, 'getAmount']) ? $quote_item->getAmount() : (float) ($item_data['quantity'] ?? 0) * (float) ($item_data['price'] ?? 0);
	1657	+ }
1177	1658	$invoice_items[] = [
1178		- 'name' => $item_data['name'] ?? '',
	1659	+ 'name' => $name,
1179	1660	'description' => $item_data['description'] ?? '',
1180		- 'quantity' => $item_data['quantity'] ?? 1,
	1661	+ 'quantity' => $item_data['quantity'] ?? 0,
1181	1662	'price' => $item_data['price'] ?? 0,
1182		- 'amount' => $item_data['amount'] ?? 0,
	1663	+ 'amount' => $amount,
1183	1664	'taxable' => $item_data['taxable'] ?? true,
1184	1665	// Map adjust_percentage to a similar field if needed
1185	1666	'adjust_percentage' => $item_data['adjust_percentage'] ?? 0,
1186	1667	];
		@@ -1188,9 +1669,9 @@
1188	1669	// Convert array item directly
1189	1670	$invoice_items[] = [
1190	1671	'name' => $quote_item['name'] ?? $quote_item['title'] ?? '',
1191	1672	'description' => $quote_item['description'] ?? '',
1192		- 'quantity' => $quote_item['quantity'] ?? 1,
	1673	+ 'quantity' => $quote_item['quantity'] ?? 0,
1193	1674	'price' => $quote_item['price'] ?? 0,
1194	1675	'amount' => $quote_item['amount'] ?? $quote_item['total'] ?? 0,
1195	1676	'taxable' => $quote_item['taxable'] ?? true,
1196	1677	'adjust_percentage' => $quote_item['adjust_percentage'] ?? 0,
		@@ -1196,12 +1677,12 @@
1196	1677	'adjust_percentage' => $quote_item['adjust_percentage'] ?? 0,
1197	1678	];
1198	1679	}
1199	1680	}
1200		-
	1681	+
1201	1682	return $invoice_items;
1202	1683	}
1203		-
	1684	+
1204	1685	/**
1205	1686	* Generate unique invoice number
1206	1687	*
1207	1688	* @return string The invoice number
		@@ -1211,13 +1692,13 @@
1211	1692	if (class_exists('\\EasyInvoice\\Services\\InvoiceNumberService')) {
1212	1693	$invoice_number_service = new \EasyInvoice\Services\InvoiceNumberService();
1213	1694	return $invoice_number_service->generateUniqueNumber();
1214	1695	}
1215		-
	1696	+
1216	1697	// Fallback to timestamp-based number
1217	1698	return 'INV-' . str_pad(time(), 6, '0', STR_PAD_LEFT);
1218	1699	}
1219		-
	1700	+
1220	1701	/**
1221	1702	* Get changes between two quote versions
1222	1703	*
1223	1704	* @param \EasyInvoice\Models\Quote $old_quote Old quote
		@@ -1225,9 +1706,9 @@
1225	1706	* @return array Array of changes
1226	1707	*/
1227	1708	private function getQuoteChanges($old_quote, $new_quote): array {
1228	1709	$changes = [];
1229		-
	1710	+
1230	1711	// Compare key fields
1231	1712	$fields_to_compare = [
1232	1713	'title' => 'Title',
1233	1714	'status' => 'Status',
		@@ -1239,25 +1720,25 @@
1239	1720	'total' => 'Total Amount',
1240	1721	'notes' => 'Notes',
1241	1722	'terms' => 'Terms',
1242	1723	];
1243		-
	1724	+
1244	1725	foreach ($fields_to_compare as $field => $label) {
1245	1726	$method_name = 'get' . easy_invoice_str_replace('_', '', ucwords($field, '_'));
1246		-
	1727	+
1247	1728	if (method_exists($old_quote, $method_name) && method_exists($new_quote, $method_name)) {
1248	1729	$old_value = $old_quote->$method_name();
1249	1730	$new_value = $new_quote->$method_name();
1250		-
	1731	+
1251	1732	if ($old_value !== $new_value) {
1252	1733	$changes[$field] = $new_value;
1253	1734	}
1254	1735	}
1255	1736	}
1256		-
	1737	+
1257	1738	return $changes;
1258	1739	}
1259		-
	1740	+
1260	1741	/**
1261	1742	* Handle AJAX request to decline a quote
1262	1743	*
1263	1744	* @since 1.0.0
		@@ -1262,78 +1743,77 @@
1262	1743	*
1263	1744	* @since 1.0.0
1264	1745	*/
1265	1746	public function handleDeclineQuote(): void {
1266		- // Verify nonce
1267		- if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_quote_action')) {
1268		- wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1269		- }
1270		-
1271	1747	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1272	1748	$decline_reason = isset($_POST['decline_reason']) ? sanitize_textarea_field($_POST['decline_reason']) : '';
1273		-
	1749	+
1274	1750	if ($quote_id <= 0) {
1275	1751	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
1276	1752	}
1277		-
1278		- // Get the quote
1279		- $quote = $this->quote_repository->find($quote_id);
1280		-
	1753	+
	1754	+ if (!wp_verify_nonce($_POST['nonce'] ?? '', $this->quoteAcceptDeclineNonceAction($quote_id))) {
	1755	+ wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
	1756	+ }
	1757	+
	1758	+ $is_admin = current_user_can('manage_options');
	1759	+ if ($is_admin) {
	1760	+ $quote = $this->quote_repository->find($quote_id);
	1761	+ } else {
	1762	+ $quote = $this->quote_repository->findPublished($quote_id);
	1763	+ }
	1764	+
1281	1765	if (!$quote) {
1282	1766	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
1283	1767	}
1284		-
	1768	+
1285	1769	// Check if decline reason is required by global settings
1286	1770	$settings_controller = new \EasyInvoice\Controllers\SettingsController();
1287	1771	if ($settings_controller::isDeclineReasonRequired() && empty(trim($decline_reason))) {
1288	1772	wp_send_json_error(['message' => __('Reason for declining is required.', 'easy-invoice')]);
1289	1773	}
1290		-
1291		- // Check if user has permission to decline this quote
	1774	+
	1775	+ // SECURITY (CVE-2026-9021): unconditional authorisation — see
	1776	+ // handleAcceptQuote for the full rationale. Same three paths:
	1777	+ // admin / valid access token / authenticated bound client.
	1778	+ if (!self::canActOnQuote($quote_id, $quote)) {
	1779	+ wp_send_json_error(['message' => __('You do not have permission to decline this quote.', 'easy-invoice')]);
	1780	+ }
	1781	+
	1782	+ $ei_open = self::openForDecision($quote);
	1783	+ if (is_wp_error($ei_open)) {
	1784	+ wp_send_json_error(['message' => $ei_open->get_error_message()]);
	1785	+ }
	1786	+
1292	1787	$current_user = wp_get_current_user();
1293		- $is_admin = current_user_can('manage_options');
1294		-
1295		- if (!$is_admin) {
1296		- // For non-admins, check if they are the client
1297		- if ($quote->getClientId()) {
1298		- $client_repository = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository();
1299		- $client = $client_repository->find($quote->getClientId());
1300		-
1301		- if (!$client || $client->getEmail() !== $current_user->user_email) {
1302		- wp_send_json_error(['message' => __('You do not have permission to decline this quote.', 'easy-invoice')]);
1303		- }
1304		- } else {
1305		- wp_send_json_error(['message' => __('You do not have permission to decline this quote.', 'easy-invoice')]);
1306		- }
1307		- }
1308		-
	1788	+
1309	1789	// Update quote status to declined
1310	1790	$quote->setStatus('declined');
1311		- $quote->setDeclinedDate(date('Y-m-d H:i:s'));
	1791	+ $quote->setDeclinedDate(gmdate('Y-m-d H:i:s'));
1312	1792	$quote->setDeclinedBy($current_user->ID);
1313		-
	1793	+
1314	1794	// Save decline reason if provided
1315	1795	if (!empty($decline_reason)) {
1316	1796	$quote->setDeclineReason($decline_reason);
1317	1797	}
1318		-
	1798	+
1319	1799	// Save the quote
1320	1800	$saved = $quote->save();
1321		-
	1801	+
1322	1802	if (!$saved) {
1323	1803	wp_send_json_error(['message' => __('Failed to decline quote.', 'easy-invoice')]);
1324	1804	}
1325		-
	1805	+
1326	1806	// Log the quote decline
1327	1807	$this->quote_log_service->logDecline($quote_id, $decline_reason, [
1328	1808	'user_type' => $is_admin ? 'admin' : 'client'
1329	1809	]);
1330		-
	1810	+
1331	1811	// Send notification email to admin
1332	1812	if (!$is_admin) {
1333	1813	$this->sendQuoteDeclineNotification($quote);
1334	1814	}
1335		-
	1815	+
1336	1816	wp_send_json_success([
1337	1817	'message' => __('Quote declined successfully.', 'easy-invoice'),
1338	1818	'toast' => [
1339	1819	'type' => 'success',
		@@ -1340,9 +1820,9 @@
1340	1820	'message' => __('Quote declined successfully.', 'easy-invoice')
1341	1821	]
1342	1822	]);
1343	1823	}
1344		-
	1824	+
1345	1825	/**
1346	1826	* Send quote acceptance notification to admin
1347	1827	*
1348	1828	* @param \EasyInvoice\Models\Quote $quote The quote that was accepted
		@@ -1347,41 +1827,13 @@
1347	1827	*
1348	1828	* @param \EasyInvoice\Models\Quote $quote The quote that was accepted
1349	1829	*/
1350	1830	private function sendQuoteAcceptanceNotification($quote): void {
1351		- $admin_email = get_option('admin_email');
1352		- $site_name = get_bloginfo('name');
1353		-
1354		- $subject = sprintf(__('Quote %s has been accepted', 'easy-invoice'), $quote->getNumber());
1355		-
1356		- $message = sprintf(
1357		- __('Hello,
	1831	+ // Use EmailManager to send admin notification
	1832	+ $email_manager = \EasyInvoice\Services\EmailManager::getInstance();
	1833	+ $email_manager->sendAdminQuoteNotification($quote, 'accepted');
	1834	+ }
1358	1835
1359		-The quote %s for %s has been accepted by the client.
1360		-
1361		-Quote Details:
1362		-- Quote Number: %s
1363		-- Client: %s
1364		-- Total Amount: %s
1365		-- Accepted Date: %s
1366		-
1367		-You can view the quote at: %s
1368		-
1369		-Best regards,
1370		-%s', 'easy-invoice'),
1371		- $quote->getNumber(),
1372		- $quote->getCustomerName(),
1373		- $quote->getNumber(),
1374		- $quote->getCustomerName(),
1375		- $this->formatCurrency($quote->getTotal(), $quote),
1376		- date_i18n(get_option('date_format') . ' ' . get_option('time_format')),
1377		- get_permalink($quote->getId()),
1378		- $site_name
1379		- );
1380		-
1381		- wp_mail($admin_email, $subject, $message);
1382		- }
1383		-
1384	1836	/**
1385	1837	* Send quote decline notification to admin
1386	1838	*
1387	1839	* @param \EasyInvoice\Models\Quote $quote The quote that was declined
		@@ -1386,91 +1838,15 @@
1386	1838	*
1387	1839	* @param \EasyInvoice\Models\Quote $quote The quote that was declined
1388	1840	*/
1389	1841	private function sendQuoteDeclineNotification($quote): void {
1390		- $admin_email = get_option('admin_email');
1391		- $site_name = get_bloginfo('name');
1392		-
1393		- $subject = sprintf(__('Quote %s has been declined', 'easy-invoice'), $quote->getNumber());
1394		-
1395		- $message = sprintf(
1396		- __('Hello,
	1842	+ // Use EmailManager to send admin notification
	1843	+ $email_manager = \EasyInvoice\Services\EmailManager::getInstance();
	1844	+ $email_manager->sendAdminQuoteNotification($quote, 'declined');
	1845	+ }
1397	1846
1398		-The quote %s for %s has been declined by the client.
1399	1847
1400		-Quote Details:
1401		-- Quote Number: %s
1402		-- Client: %s
1403		-- Total Amount: %s
1404		-- Declined Date: %s
1405		-
1406		-You can view the quote at: %s
1407		-
1408		-Best regards,
1409		-%s', 'easy-invoice'),
1410		- $quote->getNumber(),
1411		- $quote->getCustomerName(),
1412		- $quote->getNumber(),
1413		- $quote->getCustomerName(),
1414		- $this->formatCurrency($quote->getTotal(), $quote),
1415		- date_i18n(get_option('date_format') . ' ' . get_option('time_format')),
1416		- get_permalink($quote->getId()),
1417		- $site_name
1418		- );
1419		-
1420		- wp_mail($admin_email, $subject, $message);
1421		- }
1422		-
1423	1848	/**
1424		- * Handle AJAX request to update existing quotes with missing data
1425		- *
1426		- * @since 1.0.0
1427		- */
1428		- public function handleUpdateExistingQuotes(): void {
1429		- // Verify nonce - match the nonce being sent from JavaScript
1430		- if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1431		- wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1432		- }
1433		-
1434		- // Check permissions
1435		- if (!current_user_can('manage_options')) {
1436		- wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1437		- }
1438		-
1439		- $updated_count = 0;
1440		- $quotes = $this->quote_repository->findAll();
1441		-
1442		- foreach ($quotes as $quote) {
1443		- $post = get_post($quote->getId());
1444		- if ($post && empty($post->post_name)) {
1445		- // Generate a proper slug for this quote
1446		- $post_title = $quote->getTitle() ?: $quote->getNumber() ?: 'Untitled Quote';
1447		- $post_name = sanitize_title($post_title);
1448		-
1449		- // Ensure uniqueness
1450		- $original_slug = $post_name;
1451		- $counter = 1;
1452		- while (get_page_by_path($post_name, OBJECT, \EasyInvoice\Constants\PostTypes::EASY_INVOICE_QUOTE_POST_TYPE)) {
1453		- $post_name = $original_slug . '-' . $counter;
1454		- $counter++;
1455		- }
1456		-
1457		- // Update the post with the new slug
1458		- wp_update_post([
1459		- 'ID' => $quote->getId(),
1460		- 'post_name' => $post_name
1461		- ]);
1462		-
1463		- $updated_count++;
1464		- }
1465		- }
1466		-
1467		- wp_send_json_success([
1468		- 'message' => sprintf(__('Updated %d quotes with proper URLs.', 'easy-invoice'), $updated_count)
1469		- ]);
1470		- }
1471		-
1472		- /**
1473	1849	* Handle AJAX request to duplicate a quote
1474	1850	*
1475	1851	* @since 1.0.0
1476	1852	*/
		@@ -1478,26 +1854,26 @@
1478	1854	// Verify nonce
1479	1855	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1480	1856	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1481	1857	}
1482		-
	1858	+
1483	1859	// Check permissions
1484		- if (!current_user_can('manage_options')) {
	1860	+ if (!easy_invoice_user_can('ei_create_quote')) {
1485	1861	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1486	1862	}
1487		-
	1863	+
1488	1864	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1489		-
	1865	+
1490	1866	if ($quote_id <= 0) {
1491	1867	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
1492	1868	}
1493		-
	1869	+
1494	1870	$quote = $this->quote_repository->find($quote_id);
1495		-
	1871	+
1496	1872	if (!$quote) {
1497	1873	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
1498	1874	}
1499		-
	1875	+
1500	1876	// Get global quote settings
1501	1877	$settings_controller = new \EasyInvoice\Controllers\SettingsController();
1502	1878	$quote_terms = $settings_controller::getQuoteTermsConditions();
1503	1879	$quote_footer = $settings_controller::getQuoteFooterText();
		@@ -1505,16 +1881,16 @@
1505	1881	$quote_accept_action = get_option('easy_invoice_quote_accept_action', 'email');
1506	1882	$quote_accept_text = get_option('easy_invoice_quote_accept_text', __('Accept Quote', 'easy-invoice'));
1507	1883	$quote_accepted_message = get_option('easy_invoice_quote_accepted_message', __('Thank you for accepting our quote!', 'easy-invoice'));
1508	1884	$quote_declined_message = get_option('easy_invoice_quote_declined_message', __('Thank you for your consideration.', 'easy-invoice'));
1509		-
	1885	+
1510	1886	// Create the duplicate quote
1511	1887	$duplicate_data = [
1512	1888	'title' => $quote->getTitle() . ' (Copy)',
1513	1889	'status' => 'draft',
1514	1890	'number' => $this->generateInvoiceNumber(), // Use invoice number service for consistency
1515		- 'issue_date' => date('Y-m-d'),
1516		- 'expiry_date' => date('Y-m-d', strtotime('+30 days')),
	1891	+ 'issue_date' => current_time('Y-m-d'),
	1892	+ 'expiry_date' => wp_date('Y-m-d', strtotime('+30 days')),
1517	1893	'items' => $this->convertQuoteItemsToInvoiceItems($quote->getItems()), // Use invoice item conversion
1518	1894	'notes' => $quote->getNotes(),
1519	1895	'description' => $quote->getDescription(),
1520	1896	'terms' => $quote_terms,
		@@ -1524,14 +1900,14 @@
1524	1900	'accept_text' => $quote_accept_text,
1525	1901	'accepted_message' => $quote_accepted_message,
1526	1902	'declined_message' => $quote_declined_message,
1527	1903	];
1528		-
	1904	+
1529	1905	// Set client ID to 0 for a new quote
1530	1906	$duplicate_data['client_id'] = 0;
1531		-
	1907	+
1532	1908	$duplicate_quote = $this->quote_repository->create($duplicate_data);
1533		-
	1909	+
1534	1910	if ($duplicate_quote) {
1535	1911	$this->quote_log_service->logActivity($quote_id, 'duplicate', 'Quote duplicated', ['duplicate_id' => $duplicate_quote->getId()]);
1536	1912	wp_send_json_success([
1537	1913	'message' => __('Quote duplicated successfully.', 'easy-invoice'),
		@@ -1544,9 +1920,9 @@
1544	1920	} else {
1545	1921	wp_send_json_error(['message' => __('Failed to duplicate quote.', 'easy-invoice')]);
1546	1922	}
1547	1923	}
1548		-
	1924	+
1549	1925	/**
1550	1926	* Handle regular POST form actions for quote accept/decline
1551	1927	*
1552	1928	* @since 1.0.0
		@@ -1555,20 +1931,20 @@
1555	1931	// Only process on POST requests
1556	1932	if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
1557	1933	return;
1558	1934	}
1559		-
	1935	+
1560	1936	// Handle accept quote
1561	1937	if (isset($_POST['accept_quote']) && isset($_POST['quote_id'])) {
1562	1938	$this->handleAcceptQuoteForm();
1563	1939	}
1564		-
	1940	+
1565	1941	// Handle decline quote
1566	1942	if (isset($_POST['decline_quote']) && isset($_POST['quote_id'])) {
1567	1943	$this->handleDeclineQuoteForm();
1568	1944	}
1569	1945	}
1570		-
	1946	+
1571	1947	/**
1572	1948	* Handle accept quote form submission
1573	1949	*
1574	1950	* @since 1.0.0
		@@ -1573,67 +1949,65 @@
1573	1949	*
1574	1950	* @since 1.0.0
1575	1951	*/
1576	1952	private function handleAcceptQuoteForm(): void {
1577		- // Verify nonce
1578		- if (!wp_verify_nonce($_POST['quote_nonce'] ?? '', 'easy_invoice_quote_action')) {
1579		- wp_die(__('Security check failed.', 'easy-invoice'));
1580		- }
1581		-
1582	1953	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1583		-
	1954	+
1584	1955	if ($quote_id <= 0) {
1585		- wp_die(__('Invalid quote ID.', 'easy-invoice'));
	1956	+ wp_die(esc_html__('Invalid quote ID.', 'easy-invoice'));
1586	1957	}
1587		-
1588		- // Get the quote
1589		- $quote = $this->quote_repository->find($quote_id);
1590		-
1591		- if (!$quote) {
1592		- wp_die(__('Quote not found.', 'easy-invoice'));
	1958	+
	1959	+ if (!wp_verify_nonce($_POST['quote_nonce'] ?? '', $this->quoteAcceptDeclineNonceAction($quote_id))) {
	1960	+ wp_die(esc_html__('Security check failed.', 'easy-invoice'));
1593	1961	}
1594		-
1595		- // Check if user has permission to accept this quote
	1962	+
1596	1963	$current_user = wp_get_current_user();
1597	1964	$is_admin = current_user_can('manage_options');
1598		-
1599		- if (!$is_admin) {
1600		- // For non-admins, check if they are the client
1601		- if ($quote->getClientId()) {
1602		- $client_repository = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository();
1603		- $client = $client_repository->find($quote->getClientId());
1604		-
1605		- if (!$client || $client->getEmail() !== $current_user->user_email) {
1606		- wp_die(__('You do not have permission to accept this quote.', 'easy-invoice'));
1607		- }
1608		- } else {
1609		- wp_die(__('You do not have permission to accept this quote.', 'easy-invoice'));
1610		- }
	1965	+
	1966	+ if ($is_admin) {
	1967	+ $quote = $this->quote_repository->find($quote_id);
	1968	+ } else {
	1969	+ $quote = $this->quote_repository->findPublished($quote_id);
1611	1970	}
1612		-
	1971	+
	1972	+ if (!$quote) {
	1973	+ wp_die(esc_html__('Quote not found.', 'easy-invoice'));
	1974	+ }
	1975	+
	1976	+ // SECURITY (CVE-2026-9021): unconditional authorisation. See
	1977	+ // handleAcceptQuote (AJAX path) for full rationale.
	1978	+ if (!self::canActOnQuote($quote_id, $quote)) {
	1979	+ wp_die(esc_html__('You do not have permission to accept this quote.', 'easy-invoice'));
	1980	+ }
	1981	+
	1982	+ $ei_open = self::openForDecision($quote);
	1983	+ if (is_wp_error($ei_open)) {
	1984	+ wp_die(esc_html($ei_open->get_error_message()));
	1985	+ }
	1986	+
1613	1987	// Update quote status to accepted
1614	1988	$quote->setStatus('accepted');
1615		- $quote->setAcceptedDate(date('Y-m-d H:i:s'));
	1989	+ $quote->setAcceptedDate(gmdate('Y-m-d H:i:s'));
1616	1990	$quote->setAcceptedBy($current_user->ID);
1617		-
	1991	+
1618	1992	// Save the quote
1619	1993	$saved = $quote->save();
1620		-
	1994	+
1621	1995	if (!$saved) {
1622		- wp_die(__('Failed to accept quote.', 'easy-invoice'));
	1996	+ wp_die(esc_html__('Failed to accept quote.', 'easy-invoice'));
1623	1997	}
1624		-
	1998	+
1625	1999	// Send notification email to admin
1626	2000	if (!$is_admin) {
1627	2001	$this->sendQuoteAcceptanceNotification($quote);
1628	2002	}
1629		-
	2003	+
1630	2004	// Redirect back to the quote page with success message
1631	2005	$redirect_url = add_query_arg('action', 'accepted', get_permalink($quote_id));
1632		- wp_redirect($redirect_url);
	2006	+ wp_safe_redirect($redirect_url);
1633	2007	exit;
1634	2008	}
1635		-
	2009	+
1636	2010	/**
1637	2011	* Handle decline quote form submission
1638	2012	*
1639	2013	* @since 1.0.0
		@@ -1638,67 +2012,65 @@
1638	2012	*
1639	2013	* @since 1.0.0
1640	2014	*/
1641	2015	private function handleDeclineQuoteForm(): void {
1642		- // Verify nonce
1643		- if (!wp_verify_nonce($_POST['quote_nonce'] ?? '', 'easy_invoice_quote_action')) {
1644		- wp_die(__('Security check failed.', 'easy-invoice'));
1645		- }
1646		-
1647	2016	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1648		-
	2017	+
1649	2018	if ($quote_id <= 0) {
1650		- wp_die(__('Invalid quote ID.', 'easy-invoice'));
	2019	+ wp_die(esc_html__('Invalid quote ID.', 'easy-invoice'));
1651	2020	}
1652		-
1653		- // Get the quote
1654		- $quote = $this->quote_repository->find($quote_id);
1655		-
1656		- if (!$quote) {
1657		- wp_die(__('Quote not found.', 'easy-invoice'));
	2021	+
	2022	+ if (!wp_verify_nonce($_POST['quote_nonce'] ?? '', $this->quoteAcceptDeclineNonceAction($quote_id))) {
	2023	+ wp_die(esc_html__('Security check failed.', 'easy-invoice'));
1658	2024	}
1659		-
1660		- // Check if user has permission to decline this quote
	2025	+
1661	2026	$current_user = wp_get_current_user();
1662	2027	$is_admin = current_user_can('manage_options');
1663		-
1664		- if (!$is_admin) {
1665		- // For non-admins, check if they are the client
1666		- if ($quote->getClientId()) {
1667		- $client_repository = \EasyInvoice\Providers\ClientServiceProvider::getClientRepository();
1668		- $client = $client_repository->find($quote->getClientId());
1669		-
1670		- if (!$client || $client->getEmail() !== $current_user->user_email) {
1671		- wp_die(__('You do not have permission to decline this quote.', 'easy-invoice'));
1672		- }
1673		- } else {
1674		- wp_die(__('You do not have permission to decline this quote.', 'easy-invoice'));
1675		- }
	2028	+
	2029	+ if ($is_admin) {
	2030	+ $quote = $this->quote_repository->find($quote_id);
	2031	+ } else {
	2032	+ $quote = $this->quote_repository->findPublished($quote_id);
1676	2033	}
1677		-
	2034	+
	2035	+ if (!$quote) {
	2036	+ wp_die(esc_html__('Quote not found.', 'easy-invoice'));
	2037	+ }
	2038	+
	2039	+ // SECURITY (CVE-2026-9021): unconditional authorisation. See
	2040	+ // handleAcceptQuote (AJAX path) for full rationale.
	2041	+ if (!self::canActOnQuote($quote_id, $quote)) {
	2042	+ wp_die(esc_html__('You do not have permission to decline this quote.', 'easy-invoice'));
	2043	+ }
	2044	+
	2045	+ $ei_open = self::openForDecision($quote);
	2046	+ if (is_wp_error($ei_open)) {
	2047	+ wp_die(esc_html($ei_open->get_error_message()));
	2048	+ }
	2049	+
1678	2050	// Update quote status to declined
1679	2051	$quote->setStatus('declined');
1680		- $quote->setDeclinedDate(date('Y-m-d H:i:s'));
	2052	+ $quote->setDeclinedDate(gmdate('Y-m-d H:i:s'));
1681	2053	$quote->setDeclinedBy($current_user->ID);
1682		-
	2054	+
1683	2055	// Save the quote
1684	2056	$saved = $quote->save();
1685		-
	2057	+
1686	2058	if (!$saved) {
1687		- wp_die(__('Failed to decline quote.', 'easy-invoice'));
	2059	+ wp_die(esc_html__('Failed to decline quote.', 'easy-invoice'));
1688	2060	}
1689		-
	2061	+
1690	2062	// Send notification email to admin
1691	2063	if (!$is_admin) {
1692	2064	$this->sendQuoteDeclineNotification($quote);
1693	2065	}
1694		-
	2066	+
1695	2067	// Redirect back to the quote page with success message
1696	2068	$redirect_url = add_query_arg('action', 'declined', get_permalink($quote_id));
1697		- wp_redirect($redirect_url);
	2069	+ wp_safe_redirect($redirect_url);
1698	2070	exit;
1699	2071	}
1700		-
	2072	+
1701	2073	/**
1702	2074	* Handle AJAX request for bulk quote actions
1703	2075	*
1704	2076	* @since 1.0.0
		@@ -1707,36 +2079,44 @@
1707	2079	// Verify nonce
1708	2080	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1709	2081	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1710	2082	}
1711		-
1712		- // Check permissions
1713		- if (!current_user_can('manage_options')) {
	2083	+
	2084	+ // Check permissions — gate at ei_create_quote (state transitions like
	2085	+ // trash/draft/restore). Permanent-delete actions are additionally
	2086	+ // gated below by ei_delete_quote per action.
	2087	+ if (!easy_invoice_user_can('ei_create_quote')) {
1714	2088	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1715	2089	}
1716		-
	2090	+
1717	2091	$quote_ids = isset($_POST['quote_ids']) ? array_map('intval', $_POST['quote_ids']) : [];
1718	2092	$bulk_action = sanitize_text_field($_POST['bulk_action'] ?? '');
1719		-
	2093	+
	2094	+ // Per-action gate: permanent delete requires the stricter delete cap.
	2095	+ if (in_array($bulk_action, ['delete', 'permanent-delete', 'empty-trash'], true)
	2096	+ && !easy_invoice_user_can('ei_delete_quote')) {
	2097	+ wp_send_json_error(['message' => __('You do not have permission to delete quotes.', 'easy-invoice')]);
	2098	+ }
	2099	+
1720	2100	if (empty($quote_ids)) {
1721	2101	wp_send_json_error(['message' => __('No quotes selected.', 'easy-invoice')]);
1722	2102	}
1723		-
	2103	+
1724	2104	if (empty($bulk_action)) {
1725	2105	wp_send_json_error(['message' => __('No action selected.', 'easy-invoice')]);
1726	2106	}
1727		-
	2107	+
1728	2108	$success_count = 0;
1729	2109	$error_count = 0;
1730		-
	2110	+
1731	2111	foreach ($quote_ids as $quote_id) {
1732	2112	$quote = $this->quote_repository->find($quote_id);
1733		-
	2113	+
1734	2114	if (!$quote) {
1735	2115	$error_count++;
1736	2116	continue;
1737	2117	}
1738		-
	2118	+
1739	2119	try {
1740	2120	switch ($bulk_action) {
1741	2121	case 'delete':
1742	2122	if ($this->quote_repository->delete($quote_id)) {
		@@ -1745,9 +2125,9 @@
1745	2125	} else {
1746	2126	$error_count++;
1747	2127	}
1748	2128	break;
1749		-
	2129	+
1750	2130	case 'trash':
1751	2131	$old_status = $quote->getStatus();
1752	2132	$quote->setStatus('cancelled'); // Using cancelled as trash status
1753	2133	if ($quote->save()) {
		@@ -1756,9 +2136,9 @@
1756	2136	} else {
1757	2137	$error_count++;
1758	2138	}
1759	2139	break;
1760		-
	2140	+
1761	2141	case 'draft':
1762	2142	$old_status = $quote->getStatus();
1763	2143	$quote->setStatus('draft');
1764	2144	if ($quote->save()) {
		@@ -1767,9 +2147,9 @@
1767	2147	} else {
1768	2148	$error_count++;
1769	2149	}
1770	2150	break;
1771		-
	2151	+
1772	2152	case 'restore':
1773	2153	$old_status = $quote->getStatus();
1774	2154	$quote->setStatus('draft');
1775	2155	if ($quote->save()) {
		@@ -1778,9 +2158,9 @@
1778	2158	} else {
1779	2159	$error_count++;
1780	2160	}
1781	2161	break;
1782		-
	2162	+
1783	2163	default:
1784	2164	$error_count++;
1785	2165	break;
1786	2166	}
		@@ -1788,28 +2168,32 @@
1788	2168	$error_count++;
1789	2169	// Error in bulk action
1790	2170	}
1791	2171	}
1792		-
	2172	+
1793	2173	if ($error_count > 0) {
1794	2174	wp_send_json_success([
1795		- 'message' => sprintf(__('Processed %d quotes successfully. %d failed.', 'easy-invoice'), $success_count, $error_count),
	2175	+ /* translators: %1$d: number processed; %2$d: number failed. */
	2176	+ 'message' => sprintf(__('Processed %1$d quotes successfully. %2$d failed.', 'easy-invoice'), $success_count, $error_count),
1796	2177	'toast' => [
1797	2178	'type' => 'warning',
1798		- 'message' => sprintf(__('Processed %d quotes successfully. %d failed.', 'easy-invoice'), $success_count, $error_count)
	2179	+ /* translators: %1$d: number processed; %2$d: number failed. */
	2180	+ 'message' => sprintf(__('Processed %1$d quotes successfully. %2$d failed.', 'easy-invoice'), $success_count, $error_count)
1799	2181	]
1800	2182	]);
1801	2183	} else {
1802	2184	wp_send_json_success([
	2185	+ /* translators: %d: number processed. */
1803	2186	'message' => sprintf(__('Successfully processed %d quotes.', 'easy-invoice'), $success_count),
1804	2187	'toast' => [
1805	2188	'type' => 'success',
	2189	+ /* translators: %d: number processed. */
1806	2190	'message' => sprintf(__('Successfully processed %d quotes.', 'easy-invoice'), $success_count)
1807	2191	]
1808	2192	]);
1809	2193	}
1810	2194	}
1811		-
	2195	+
1812	2196	/**
1813	2197	* Handle AJAX request to trash a quote
1814	2198	*
1815	2199	* @since 1.0.0
		@@ -1818,34 +2202,34 @@
1818	2202	// Verify nonce
1819	2203	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1820	2204	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1821	2205	}
1822		-
1823		- // Check permissions
1824		- if (!current_user_can('manage_options')) {
	2206	+
	2207	+ // Check permissions — trash is reversible, gated at the create-quote cap.
	2208	+ if (!easy_invoice_user_can('ei_create_quote')) {
1825	2209	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1826	2210	}
1827		-
	2211	+
1828	2212	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1829		-
	2213	+
1830	2214	if ($quote_id <= 0) {
1831	2215	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
1832	2216	}
1833		-
	2217	+
1834	2218	$quote = $this->quote_repository->find($quote_id);
1835		-
	2219	+
1836	2220	if (!$quote) {
1837	2221	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
1838	2222	}
1839		-
	2223	+
1840	2224	// Set status to cancelled before moving to trash
1841	2225	$old_status = $quote->getStatus();
1842	2226	$quote->setStatus('cancelled');
1843	2227	$quote->save();
1844		-
	2228	+
1845	2229	// Move the post to trash status
1846	2230	$result = wp_trash_post($quote_id);
1847		-
	2231	+
1848	2232	if ($result) {
1849	2233	$this->quote_log_service->logStatusChange($quote_id, $old_status, 'cancelled');
1850	2234	wp_send_json_success([
1851	2235	'message' => __('Quote moved to trash successfully.', 'easy-invoice'),
		@@ -1857,9 +2241,9 @@
1857	2241	} else {
1858	2242	wp_send_json_error(['message' => __('Failed to move quote to trash.', 'easy-invoice')]);
1859	2243	}
1860	2244	}
1861		-
	2245	+
1862	2246	/**
1863	2247	* Handle AJAX request to move a quote to draft
1864	2248	*
1865	2249	* @since 1.0.0
		@@ -1868,30 +2252,30 @@
1868	2252	// Verify nonce
1869	2253	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1870	2254	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1871	2255	}
1872		-
1873		- // Check permissions
1874		- if (!current_user_can('manage_options')) {
	2256	+
	2257	+ // Check permissions — moving to draft is an edit, not a delete.
	2258	+ if (!easy_invoice_user_can('ei_create_quote')) {
1875	2259	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1876	2260	}
1877		-
	2261	+
1878	2262	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1879		-
	2263	+
1880	2264	if ($quote_id <= 0) {
1881	2265	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
1882	2266	}
1883		-
	2267	+
1884	2268	$quote = $this->quote_repository->find($quote_id);
1885		-
	2269	+
1886	2270	if (!$quote) {
1887	2271	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
1888	2272	}
1889		-
	2273	+
1890	2274	// Set status to draft
1891	2275	$old_status = $quote->getStatus();
1892	2276	$quote->setStatus('draft');
1893		-
	2277	+
1894	2278	if ($quote->save()) {
1895	2279	$this->quote_log_service->logStatusChange($quote_id, $old_status, 'draft');
1896	2280	wp_send_json_success([
1897	2281	'message' => __('Quote moved to draft successfully.', 'easy-invoice'),
		@@ -1903,9 +2287,9 @@
1903	2287	} else {
1904	2288	wp_send_json_error(['message' => __('Failed to move quote to draft.', 'easy-invoice')]);
1905	2289	}
1906	2290	}
1907		-
	2291	+
1908	2292	/**
1909	2293	* Handle AJAX request to restore a trashed quote
1910	2294	*
1911	2295	* @since 1.0.0
		@@ -1914,34 +2298,34 @@
1914	2298	// Verify nonce
1915	2299	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
1916	2300	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1917	2301	}
1918		-
1919		- // Check permissions
1920		- if (!current_user_can('manage_options')) {
	2302	+
	2303	+ // Check permissions — restoring from trash is an edit operation.
	2304	+ if (!easy_invoice_user_can('ei_create_quote')) {
1921	2305	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1922	2306	}
1923		-
	2307	+
1924	2308	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
1925		-
	2309	+
1926	2310	if ($quote_id <= 0) {
1927	2311	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
1928	2312	}
1929		-
	2313	+
1930	2314	$quote = $this->quote_repository->find($quote_id);
1931		-
	2315	+
1932	2316	if (!$quote) {
1933	2317	wp_send_json_error(['message' => __('Quote not found.', 'easy-invoice')]);
1934	2318	}
1935		-
	2319	+
1936	2320	// Restore the post from trash
1937	2321	$result = wp_untrash_post($quote_id);
1938		-
	2322	+
1939	2323	if ($result) {
1940	2324	// After restoring from trash, set the meta status to available
1941	2325	$quote->setStatus('available');
1942	2326	$quote->save();
1943		-
	2327	+
1944	2328	$this->quote_log_service->logRestoration($quote_id);
1945	2329	wp_send_json_success([
1946	2330	'message' => __('Quote restored successfully.', 'easy-invoice'),
1947	2331	'toast' => [
		@@ -1952,9 +2336,9 @@
1952	2336	} else {
1953	2337	wp_send_json_error(['message' => __('Failed to restore quote.', 'easy-invoice')]);
1954	2338	}
1955	2339	}
1956		-
	2340	+
1957	2341	/**
1958	2342	* Handle AJAX request to empty trash
1959	2343	*
1960	2344	* @since 1.0.0
		@@ -1964,30 +2348,30 @@
1964	2348	// Verify nonce
1965	2349	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_nonce')) {
1966	2350	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
1967	2351	}
1968		-
1969		- // Check permissions
1970		- if (!current_user_can('manage_options')) {
	2352	+
	2353	+ // Check permissions — emptying trash permanently deletes quotes.
	2354	+ if (!easy_invoice_user_can('ei_delete_quote')) {
1971	2355	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
1972	2356	}
1973		-
	2357	+
1974	2358	// Get all quotes in trash (post_status = 'trash')
1975	2359	global $wpdb;
1976	2360	$quote_ids = $wpdb->get_col($wpdb->prepare(
1977		- "SELECT ID FROM {$wpdb->posts}
1978		- WHERE post_type = %s
	2361	+ "SELECT ID FROM {$wpdb->posts}
	2362	+ WHERE post_type = %s
1979	2363	AND post_status = 'trash'",
1980	2364	PostTypes::EASY_INVOICE_QUOTE_POST_TYPE
1981	2365	));
1982		-
	2366	+
1983	2367	if (empty($quote_ids)) {
1984	2368	wp_send_json_error(['message' => __('No quotes found in trash.', 'easy-invoice')]);
1985	2369	}
1986		-
	2370	+
1987	2371	$success_count = 0;
1988	2372	$error_count = 0;
1989		-
	2373	+
1990	2374	foreach ($quote_ids as $quote_id) {
1991	2375	if (wp_delete_post($quote_id, true)) {
1992	2376	$this->quote_log_service->logDeletion($quote_id);
1993	2377	$success_count++;
		@@ -1994,31 +2378,35 @@
1994	2378	} else {
1995	2379	$error_count++;
1996	2380	}
1997	2381	}
1998		-
	2382	+
1999	2383	if ($error_count > 0) {
2000	2384	wp_send_json_success([
2001		- 'message' => sprintf(__('Emptied trash: %d quotes deleted successfully, %d failed.', 'easy-invoice'), $success_count, $error_count),
	2385	+ /* translators: %1$d: number processed; %2$d: number failed. */
	2386	+ 'message' => sprintf(__('Emptied trash: %1$d quotes deleted successfully, %2$d failed.', 'easy-invoice'), $success_count, $error_count),
2002	2387	'success_count' => $success_count,
2003	2388	'error_count' => $error_count,
2004	2389	'toast' => [
2005	2390	'type' => 'warning',
2006		- 'message' => sprintf(__('Emptied trash: %d quotes deleted successfully, %d failed.', 'easy-invoice'), $success_count, $error_count)
	2391	+ /* translators: %1$d: number processed; %2$d: number failed. */
	2392	+ 'message' => sprintf(__('Emptied trash: %1$d quotes deleted successfully, %2$d failed.', 'easy-invoice'), $success_count, $error_count)
2007	2393	]
2008	2394	]);
2009	2395	} else {
2010	2396	wp_send_json_success([
	2397	+ /* translators: %d: number processed. */
2011	2398	'message' => sprintf(__('Successfully emptied trash: %d quotes deleted.', 'easy-invoice'), $success_count),
2012	2399	'success_count' => $success_count,
2013	2400	'error_count' => 0,
2014	2401	'toast' => [
2015	2402	'type' => 'success',
	2403	+ /* translators: %d: number processed. */
2016	2404	'message' => sprintf(__('Successfully emptied trash: %d quotes deleted.', 'easy-invoice'), $success_count)
2017	2405	]
2018	2406	]);
2019	2407	}
2020		-
	2408	+
2021	2409	} catch (\Exception $e) {
2022	2410	error_log('Error emptying quote trash: ' . $e->getMessage());
2023	2411	wp_send_json_error([
2024	2412	'message' => __('Failed to empty trash.', 'easy-invoice'),
		@@ -2025,9 +2413,9 @@
2025	2413	'debug' => $e->getMessage()
2026	2414	]);
2027	2415	}
2028	2416	}
2029		-
	2417	+
2030	2418	/**
2031	2419	* Handle AJAX request to get quote logs
2032	2420	*
2033	2421	* @since 1.0.0
		@@ -2036,23 +2424,23 @@
2036	2424	// Verify nonce
2037	2425	if (!wp_verify_nonce($_POST['nonce'] ?? '', 'easy_invoice_admin_nonce')) {
2038	2426	wp_send_json_error(['message' => __('Security check failed.', 'easy-invoice')]);
2039	2427	}
2040		-
2041		- // Check permissions
2042		- if (!current_user_can('manage_options')) {
	2428	+
	2429	+ // Check permissions — viewing quote activity log.
	2430	+ if (!easy_invoice_user_can('ei_view_quotes')) {
2043	2431	wp_send_json_error(['message' => __('You do not have permission to perform this action.', 'easy-invoice')]);
2044	2432	}
2045		-
	2433	+
2046	2434	$quote_id = isset($_POST['quote_id']) ? (int) $_POST['quote_id'] : 0;
2047		-
	2435	+
2048	2436	if ($quote_id <= 0) {
2049	2437	wp_send_json_error(['message' => __('Invalid quote ID.', 'easy-invoice')]);
2050	2438	}
2051		-
	2439	+
2052	2440	try {
2053	2441	$logs = $this->quote_log_service->getLogs($quote_id);
2054		-
	2442	+
2055	2443	// Convert QuoteLog objects to arrays for JSON response
2056	2444	$logs_data = [];
2057	2445	foreach ($logs as $log) {
2058	2446	$logs_data[] = [
		@@ -2065,14 +2453,14 @@
2065	2453	'additional_data' => $log->getAdditionalData(),
2066	2454	'created_date' => $log->getCreatedDate(),
2067	2455	];
2068	2456	}
2069		-
	2457	+
2070	2458	wp_send_json_success([
2071	2459	'logs' => $logs_data,
2072	2460	'count' => count($logs_data)
2073	2461	]);
2074		-
	2462	+
2075	2463	} catch (\Exception $e) {
2076	2464	wp_send_json_error([
2077	2465	'message' => __('Error retrieving quote logs.', 'easy-invoice'),
2078	2466	'debug' => $e->getMessage()
		@@ -2078,9 +2466,9 @@
2078	2466	'debug' => $e->getMessage()
2079	2467	]);
2080	2468	}
2081	2469	}
2082		-
	2470	+
2083	2471	/**
2084	2472	* Format currency amount using QuoteFormatter
2085	2473	*
2086	2474	* @param float $amount The amount to format
		@@ -2090,5 +2478,5 @@
2090	2478	private function formatCurrency(float $amount, $quote = null): string {
2091	2479	$formatter = new \EasyInvoice\Helpers\QuoteFormatter($quote);
2092	2480	return $formatter->format($amount);
2093	2481	}
2094		-}
	2482	+}