easy-invoice / includes / Traits / SecurityTrait.php

SecurityTrait.php in Easy Invoice – Invoice Generator, PDF Quotes & Payments 2.4.1, at includes/Traits/SecurityTrait.php

90 lines 3.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Security Trait
4	*
5	* @package Easy_Invoice
6	* @subpackage Traits
7	*/
8
9	namespace EasyInvoice\Traits;
10
11	/**
12	* SecurityTrait contains methods for handling security checks, nonce verification, and capability checks
13	*/
14	trait SecurityTrait {
15	/**
16	* Verify nonce for AJAX requests
17	*
18	* @param string $nonce The nonce to verify
19	* @param string $action The nonce action
20	* @return bool\|WP_Error True if verified, WP_Error otherwise
21	*/
22	protected function verifyNonce($nonce, $action = 'easy_invoice_nonce') {
23	if (!isset($nonce) \|\| !wp_verify_nonce($nonce, $action)) {
24	return new \WP_Error('invalid_nonce', __('Security verification failed. Please refresh the page and try again.', 'easy-invoice'));
25	}
26
27	return true;
28	}
29
30	/**
31	* Check if current user has required capability
32	*
33	* @param string $capability The required capability, defaults to manage_options
34	* @return bool\|WP_Error True if has capability, WP_Error otherwise
35	*/
36	protected function checkCapability($capability = 'manage_options') {
37	$allowed = function_exists('easy_invoice_user_can') ? easy_invoice_user_can($capability) : current_user_can($capability);
38	if (!$allowed) {
39	return new \WP_Error('invalid_capability', __('You do not have permission to perform this action.', 'easy-invoice'));
40	}
41
42	return true;
43	}
44
45	/**
46	* Common security check for AJAX requests
47	*
48	* @param string $nonce The nonce to verify
49	* @param string $nonce_action The nonce action
50	* @param string $capability The required capability
51	* @return bool\|WP_Error True if checks pass, WP_Error otherwise
52	*/
53	protected function securityCheck($nonce, $nonce_action = 'easy_invoice_nonce', $capability = 'manage_options') {
54	// Check nonce
55	$nonce_check = $this->verifyNonce($nonce, $nonce_action);
56	if (is_wp_error($nonce_check)) {
57	return $nonce_check;
58	}
59
60	// Check capability
61	$cap_check = $this->checkCapability($capability);
62	if (is_wp_error($cap_check)) {
63	return $cap_check;
64	}
65
66	return true;
67	}
68
69	/**
70	* Handle AJAX security check and send error response if needed
71	*
72	* @param string $nonce The nonce to verify
73	* @param string $nonce_action The nonce action
74	* @param string $capability The required capability
75	* @return bool True if checks pass, false otherwise (and sends JSON error)
76	*/
77	protected function handleAjaxSecurity($nonce, $nonce_action = 'easy_invoice_nonce', $capability = 'manage_options') {
78	$security_check = $this->securityCheck($nonce, $nonce_action, $capability);
79
80	if (is_wp_error($security_check)) {
81	wp_send_json_error([
82	'message' => $security_check->get_error_message(),
83	'code' => $security_check->get_error_code()
84	]);
85	return false;
86	}
87
88	return true;
89	}
90	}