← All changes | includes/Admin/EasyInvoiceAjax.php +351 -85 2.3.1 → 2.4.2 View file →

		@@ -80,8 +80,18 @@
80	80	if (!easy_invoice_user_can('ei_create_invoice')) {
81	81	$this->sendError(__('You do not have permission to perform this action', 'easy-invoice'));
82	82	}
83	83
	84	+ // Lifecycle-stage edit gate. Addons (PartialPayments) can return
	85	+ // false here to block edits to invoices whose state shouldn't
	86	+ // change anymore — e.g. a deposit invoice that has already been
	87	+ // paid (where editing items would silently invalidate the
	88	+ // deposit/balance pair the customer already saw).
	89	+ $editing_invoice_id = isset($_POST['invoice_id']) ? (int) $_POST['invoice_id'] : 0;
	90	+ if ($editing_invoice_id > 0 && !apply_filters('easy_invoice_can_edit_invoice', true, $editing_invoice_id)) {
	91	+ $this->sendError(__('This deposit invoice has already been paid and is locked from further edits. Add the new line item to the linked balance invoice instead.', 'easy-invoice'));
	92	+ }
	93	+
84	94	// Get the raw invoice data from the form
85	95	$raw_invoice_data = isset($_POST['invoice_data']) ? $_POST['invoice_data'] : $_POST;
86	96
87	97	// Remove non-invoice fields
		@@ -92,10 +102,11 @@
92	102	$invoice_form_manager = new \EasyInvoice\Forms\Invoice\InvoiceFormManager();
93	103	$invoice_data = $invoice_form_manager->processFormData($raw_invoice_data);
94	104
95	105	if (!empty($invoice_data['errors'])) {
	106	+ // The toast is what the user sees; the field may sit on another tab.
96	107	wp_send_json_error([
97		- 'message' => 'Validation failed',
	108	+ 'message' => implode(' ', array_map('strval', $invoice_data['errors'])),
98	109	'errors' => $invoice_data['errors']
99	110	]);
100	111	}
101	112
		@@ -157,8 +168,17 @@
157	168	if (!$invoice) {
158	169	$this->sendError(__('Failed to create invoice', 'easy-invoice'));
159	170	}
160	171
	172	+ // The repository claimed a number under its lock (or generated the next
	173	+ // one when the number the builder peeked on page load was taken
	174	+ // meanwhile). Carry that claimed number into the form data: the
	175	+ // FormProcessor below writes every posted field, and the stale peek
	176	+ // would otherwise overwrite the claim — two builders open at once
	177	+ // then saved two documents with the same number.
	178	+ $invoice_data['data']['number'] = $invoice->getNumber();
	179	+ unset($invoice_data['data']['invoice_number']);
	180	+
161	181	// Use FormProcessor to save form data to database
162	182	$form_processor = new \EasyInvoice\Forms\FormProcessor();
163	183	$all_fields = $invoice_form_manager->getAllFields();
164	184	$form_processor->saveFormDataToDatabase($invoice_data['data'], $all_fields, $invoice);
		@@ -359,9 +379,12 @@
359	379	$this->sendError(__('You do not have permission to perform this action', 'easy-invoice'));
360	380	}
361	381
362	382	$client_id = isset($_POST['client_id']) ? intval($_POST['client_id']) : 0;
363		- $delete_associated_documents = isset($_POST['delete_associated_documents']) ? (bool)$_POST['delete_associated_documents'] : false;
	383	+ // The dialog posts the literal strings "true" / "false"; a bool cast
	384	+ // made "false" true, so "Delete client only" removed the documents too.
	385	+ $delete_associated_documents = isset($_POST['delete_associated_documents'])
	386	+ && filter_var(wp_unslash($_POST['delete_associated_documents']), FILTER_VALIDATE_BOOLEAN);
364	387
365	388	if ($client_id <= 0) {
366	389	$this->sendError(__('Invalid client ID', 'easy-invoice'));
367	390	}
		@@ -388,18 +411,25 @@
388	411	"SELECT COUNT(*) FROM {$wpdb->postmeta} WHERE meta_key = '_easy_invoice_quote_client_id' AND meta_value = %d",
389	412	$client_id
390	413	));
391	414
392		- $payment_count = $wpdb->get_var($wpdb->prepare(
393		- "SELECT COUNT(*) FROM {$wpdb->postmeta} WHERE meta_key = '_easy_payment_client_id' AND meta_value = %d",
394		- $client_id
395		- ));
	415	+ // Counted through the client's invoices, because that is the only
	416	+ // link there is: payments record '_invoice_id' and no client id.
	417	+ // This counted meta '_easy_payment_client_id', which nothing writes,
	418	+ // so the confirmation dialog told every user there were no payments
	419	+ // no matter how many there were.
	420	+ $payment_count = count(\EasyInvoice\Services\ClientLedger::paymentIds((int) $client_id));
396	421
397	422	$total_documents = $invoice_count + $quote_count + $payment_count;
398	423
399	424	if ($delete_associated_documents) {
400	425	// Delete all associated documents
401		- $this->log(sprintf('Deleting client %d with all associated documents (%d invoices, %d quotes, %d payments)',
	426	+ // error_log(), not $this->log(): no such method exists on this class or
	427	+ // any trait it uses, so both branches of this handler raised
	428	+ // "Call to undefined method" — deleting a client failed with a critical
	429	+ // error whichever option the administrator chose. Matches the logging
	430	+ // used elsewhere in the plugin.
	431	+ error_log(sprintf('Easy Invoice: deleting client %d with all associated documents (%d invoices, %d quotes, %d payments)',
402	432	$client_id, $invoice_count, $quote_count, $payment_count));
403	433
404	434	// Delete invoices
405	435	if ($invoice_count > 0) {
		@@ -423,22 +453,56 @@
423	453	}
424	454	}
425	455
426	456	// Delete payments
427		- if ($payment_count > 0) {
428		- $payments = $wpdb->get_col($wpdb->prepare(
429		- "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key = '_easy_invoice_payment_client_id' AND meta_value = %d",
430		- $client_id
431		- ));
432		- foreach ($payments as $payment_id) {
433		- wp_delete_post($payment_id, true);
434		- }
435		- }
	457	+ //
	458	+ // This queried '_easy_invoice_payment_client_id' while the matching
	459	+ // count above (and the meta cleanup below, and
	460	+ // ClientRepository::countClientPayments) all query
	461	+ // '_easy_payment_client_id' — so the count and the deletion disagreed
	462	+ // on which key identifies a client's payments. Unified on
	463	+ // '_easy_payment_client_id', the key the other three sites use.
	464	+ //
	465	+ // Payments are RETAINED, on purpose, and the message below says so.
	466	+ //
	467	+ // Neither of those meta keys is ever written: a payment stores
	468	+ // '_invoice_id' and carries no client id at all, so it is linked to
	469	+ // a client only through its invoice. Client deletion has therefore
	470	+ // never removed a payment, whatever the dialog implied.
	471	+ //
	472	+ // $payment_count is now resolved correctly through ClientLedger, so
	473	+ // the count is true even though the behaviour is unchanged. Making
	474	+ // the deletion true as well would destroy records this path has
	475	+ // never touched — a payment is the evidence money changed hands, and
	476	+ // the reasoning that stops InvoiceRetention deleting an issued
	477	+ // invoice applies to it. That is a deliberate decision to keep them,
	478	+ // not an oversight, so it is stated to the user rather than hidden.
436	479
437		- $message = sprintf(__('Client and all associated documents (%d total) deleted successfully', 'easy-invoice'), $total_documents);
	480	+ // Say what was kept as well as what went. "All associated documents
	481	+ // deleted" was never true where payments were concerned, and a
	482	+ // merchant who believes their payment records are gone will look
	483	+ // for them in the wrong place at the wrong time of year.
	484	+ $message = $payment_count > 0
	485	+ ? sprintf(
	486	+ /* translators: 1: number of documents deleted, 2: number of payment records kept. */
	487	+ _n(
	488	+ 'Client deleted, along with %1$d document. %2$d payment record was kept as a financial record.',
	489	+ 'Client deleted, along with %1$d documents. %2$d payment records were kept as financial records.',
	490	+ $payment_count,
	491	+ 'easy-invoice'
	492	+ ),
	493	+ $invoice_count + $quote_count,
	494	+ $payment_count
	495	+ )
	496	+ : sprintf(
	497	+ /* translators: %d: number of documents deleted. */
	498	+ __('Client and all associated documents (%d total) deleted successfully', 'easy-invoice'),
	499	+ $total_documents
	500	+ );
438	501	} else {
439	502	// Only remove client associations, preserve documents
440		- $this->log(sprintf('Removing client associations for client %d (%d invoices, %d quotes, %d payments)',
	503	+ // See the note on the other branch above.
	504	+ error_log(sprintf('Easy Invoice: removing client associations for client %d (%d invoices, %d quotes, %d payments)',
441	505	$client_id, $invoice_count, $quote_count, $payment_count));
442	506
443	507	// Remove client associations from invoices
444	508	if ($invoice_count > 0) {
		@@ -463,8 +527,9 @@
463	527	['meta_key' => '_easy_payment_client_id', 'meta_value' => $client_id]
464	528	);
465	529	}
466	530
	531	+ /* translators: %d: number of documents. */
467	532	$message = sprintf(__('Client deleted successfully. %d documents preserved but client associations removed.', 'easy-invoice'), $total_documents);
468	533	}
469	534
470	535	// Snapshot identity BEFORE delete — once wp_delete_user runs the
		@@ -625,10 +690,21 @@
625	690	private function sendSuccess($data = array()) {
626	691	// Check if we should suppress global toast
627	692	$suppress_toast = isset($_POST['suppress_global_toast']) && $_POST['suppress_global_toast'] === 'true';
628	693
629		- // Add toast notification if not already present and not suppressed
630		- if (!isset($data['toast']) && !$suppress_toast) {
	694	+ // Only inject the toast key when $data is an associative array
	695	+ // (or empty). If $data is a numeric-indexed list (e.g. search
	696	+ // results), adding a string key would mutate the array shape:
	697	+ // PHP keeps the mixed keys, but `wp_send_json_success` then
	698	+ // serialises the value as a JSON OBJECT instead of an array,
	699	+ // breaking any frontend that does `response.data.length` or
	700	+ // `response.data.forEach(...)` — the exact bug that caused the
	701	+ // client-search dropdown to silently render empty results.
	702	+ $is_assoc_or_empty = !is_array($data)
	703	+ || empty($data)
	704	+ || array_keys($data) !== range(0, count($data) - 1);
	705	+
	706	+ if ($is_assoc_or_empty && !isset($data['toast']) && !$suppress_toast) {
631	707	$message = isset($data['message']) ? $data['message'] : __('Operation completed successfully', 'easy-invoice');
632	708	$data['toast'] = array(
633	709	'type' => 'success',
634	710	'message' => $message,
		@@ -636,9 +712,9 @@
636	712	);
637	713	}
638	714
639	715	// Remove toast data if suppressed
640		- if ($suppress_toast && isset($data['toast'])) {
	716	+ if ($is_assoc_or_empty && $suppress_toast && isset($data['toast'])) {
641	717	unset($data['toast']);
642	718	}
643	719
644	720	wp_send_json_success($data);
		@@ -726,9 +802,9 @@
726	802	if ($result['success']) {
727	803	// Audit: who sent which invoice to which client, at what time.
728	804	if (function_exists('easy_invoice_audit_log')) {
729	805	easy_invoice_audit_log('invoice_sent', 'invoice', $invoice_id, [
730		- 'recipient' => method_exists($invoice, 'getCustomerEmail') ? $invoice->getCustomerEmail() : '',
	806	+ 'recipient' => is_callable([$invoice, 'getCustomerEmail']) ? $invoice->getCustomerEmail() : '',
731	807	'context' => 'new',
732	808	]);
733	809	}
734	810	$this->sendSuccess(array(
		@@ -773,9 +849,10 @@
773	849	'quote_data' => $quote->toArray(),
774	850	'download_url' => add_query_arg(array(
775	851	'action' => 'easy_invoice_generate_quote_pdf',
776	852	'quote_id' => $quote_id,
777		- 'nonce' => wp_create_nonce('generate_quote_pdf')
	853	+ // Bound to this quote — see the invoice equivalent above.
	854	+ 'nonce' => wp_create_nonce('generate_quote_pdf_' . $quote_id)
778	855	), admin_url('admin-ajax.php'))
779	856	));
780	857	}
781	858
		@@ -801,9 +878,9 @@
801	878	$quote_data = $quote_form_manager->processFormData($raw_quote_data);
802	879
803	880	if (!empty($quote_data['errors'])) {
804	881	wp_send_json_error([
805		- 'message' => 'Validation failed',
	882	+ 'message' => implode(' ', array_map('strval', $quote_data['errors'])),
806	883	'errors' => $quote_data['errors']
807	884	]);
808	885	}
809	886
		@@ -871,8 +948,13 @@
871	948	if (!$quote) {
872	949	$this->sendError(__('Failed to create quote', 'easy-invoice'));
873	950	}
874	951
	952	+ // Same as invoices: keep the number the repository claimed, not the one
	953	+ // the builder peeked on page load (see saveInvoice()).
	954	+ $quote_data['data']['number'] = $quote->getNumber();
	955	+ unset($quote_data['data']['quote_number']);
	956	+
875	957	// Use FormProcessor to save form data to database
876	958	$form_processor = new \EasyInvoice\Forms\FormProcessor();
877	959	$all_fields = $quote_form_manager->getAllFields();
878	960	$form_processor->saveFormDataToDatabase($quote_data['data'], $all_fields, $quote);
		@@ -1058,23 +1140,27 @@
1058	1140	// Check if required fields are present
1059	1141	$required_fields = ['business_client_name', 'email', 'username'];
1060	1142	foreach ($required_fields as $field) {
1061	1143	if (!isset($_POST[$field]) || empty($_POST[$field])) {
1062		- $this->sendError(__('Missing required field: ' . $field, 'easy-invoice'));
	1144	+ /* translators: %s: form field name. */
	1145	+ $this->sendError(sprintf(__('Missing required field: %s', 'easy-invoice'), $field));
1063	1146	}
1064	1147	}
1065	1148
1066	1149	// Prepare client data
	1150	+ // Optional fields may be absent from the request entirely.
	1151	+ $post_text = static function ($key) { return isset($_POST[$key]) ? sanitize_text_field(wp_unslash($_POST[$key])) : ''; }; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- checked above.
	1152	+ $post_area = static function ($key) { return isset($_POST[$key]) ? sanitize_textarea_field(wp_unslash($_POST[$key])) : ''; }; // phpcs:ignore WordPress.Security.NonceVerification.Missing
1067	1153	$client_data = [
1068		- ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field($_POST['business_client_name']),
1069		- ClientFields::EMAIL => sanitize_email($_POST['email']),
1070		- ClientFields::USERNAME => sanitize_user($_POST['username']),
1071		- ClientFields::PASSWORD => $_POST['password'],
1072		- ClientFields::ADDRESS => sanitize_textarea_field($_POST['address']),
1073		- ClientFields::EXTRA_INFO => sanitize_textarea_field($_POST['extra_info']),
1074		- ClientFields::FIRST_NAME => sanitize_text_field($_POST['first_name']),
1075		- ClientFields::LAST_NAME => sanitize_text_field($_POST['last_name']),
1076		- ClientFields::WEBSITE => esc_url_raw($_POST['website']),
	1154	+ ClientFields::BUSINESS_CLIENT_NAME => $post_text('business_client_name'),
	1155	+ ClientFields::EMAIL => sanitize_email(wp_unslash(($_POST['email'] ?? ''))),
	1156	+ ClientFields::USERNAME => sanitize_user(wp_unslash(($_POST['username'] ?? ''))),
	1157	+ ClientFields::PASSWORD => isset($_POST['password']) ? (string) wp_unslash($_POST['password']) : '',
	1158	+ ClientFields::ADDRESS => $post_area('address'),
	1159	+ ClientFields::EXTRA_INFO => $post_area('extra_info'),
	1160	+ ClientFields::FIRST_NAME => $post_text('first_name'),
	1161	+ ClientFields::LAST_NAME => $post_text('last_name'),
	1162	+ ClientFields::WEBSITE => isset($_POST['website']) ? esc_url_raw(wp_unslash($_POST['website'])) : '',
1077	1163	ClientFields::PHONE => isset($_POST['phone']) ? sanitize_text_field($_POST['phone']) : '',
1078	1164	];
1079	1165
1080	1166
		@@ -1093,16 +1179,27 @@
1093	1179	// Create new client
1094	1180	$client = $repository->create($client_data);
1095	1181
1096	1182	if (!$client) {
1097		- $this->sendError(__('Failed to create client', 'easy-invoice'));
	1183	+ $reason = method_exists($repository, 'getLastError') ? $repository->getLastError() : '';
	1184	+ $this->sendError($reason !== '' ? $reason : __('Failed to create client', 'easy-invoice'));
1098	1185	}
1099	1186
1100	1187	$client_id = $client->getId();
1101	1188
	1189	+ // Pull the WP role assigned during user creation. The
	1190	+ // Clients-page row template needs this so the new-row badge
	1191	+ // matches the role that will be re-rendered server-side on the
	1192	+ // next page load. Without this, the JS template would have to
	1193	+ // hardcode a role label and could drift from PHP's value.
	1194	+ $user = get_user_by('id', $client_id);
	1195	+ $role = ($user && !empty($user->roles)) ? (string) $user->roles[0] : 'customer';
	1196	+
1102	1197	$response_data = array(
1103	1198	'message' => __('Client added successfully', 'easy-invoice'),
1104	1199	'client_id' => $client_id,
	1200	+ 'role' => $role,
	1201	+ 'role_label' => ucfirst($role),
1105	1202	'client' => $client->toArray(),
1106	1203	);
1107	1204
1108	1205	$this->sendSuccess($response_data);
		@@ -1125,18 +1222,18 @@
1125	1222	}
1126	1223
1127	1224	// Prepare client data
1128	1225	$client_data = [
1129		- ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field($_POST['business_client_name']),
1130		- ClientFields::EMAIL => sanitize_email($_POST['email']),
1131		- ClientFields::USERNAME => sanitize_user($_POST['username']),
1132		- ClientFields::PASSWORD => $_POST['password'], // Keep password as is, don't sanitize
1133		- ClientFields::ADDRESS => sanitize_textarea_field($_POST['address']),
	1226	+ ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field(($_POST['business_client_name'] ?? '')),
	1227	+ ClientFields::EMAIL => sanitize_email(($_POST['email'] ?? '')),
	1228	+ ClientFields::USERNAME => sanitize_user(($_POST['username'] ?? '')),
	1229	+ ClientFields::PASSWORD => ($_POST['password'] ?? ''), // Keep password as is, don't sanitize
	1230	+ ClientFields::ADDRESS => sanitize_textarea_field(($_POST['address'] ?? '')),
1134	1231	ClientFields::PHONE => isset($_POST['phone']) ? sanitize_text_field($_POST['phone']) : '',
1135		- ClientFields::EXTRA_INFO => sanitize_textarea_field($_POST['extra_info']),
1136		- ClientFields::FIRST_NAME => sanitize_text_field($_POST['first_name']),
1137		- ClientFields::LAST_NAME => sanitize_text_field($_POST['last_name']),
1138		- ClientFields::WEBSITE => esc_url_raw($_POST['website'])
	1232	+ ClientFields::EXTRA_INFO => sanitize_textarea_field(($_POST['extra_info'] ?? '')),
	1233	+ ClientFields::FIRST_NAME => sanitize_text_field(($_POST['first_name'] ?? '')),
	1234	+ ClientFields::LAST_NAME => sanitize_text_field(($_POST['last_name'] ?? '')),
	1235	+ ClientFields::WEBSITE => esc_url_raw(($_POST['website'] ?? ''))
1139	1236	];
1140	1237
1141	1238	// Remove empty values except password (password can be empty for updates)
1142	1239	$client_data = array_filter($client_data, function($value, $key) {
		@@ -1250,8 +1347,9 @@
1250	1347	}
1251	1348	}
1252	1349
1253	1350	$this->sendSuccess(array(
	1351	+ /* translators: %d: number updated. */
1254	1352	'message' => sprintf(__('Updated %d invoices with missing data', 'easy-invoice'), $updated_count),
1255	1353	'updated_count' => $updated_count
1256	1354	));
1257	1355	}
		@@ -1269,21 +1367,30 @@
1269	1367	if (!$invoice_id) {
1270	1368	$this->sendError(__('Invalid invoice ID', 'easy-invoice'));
1271	1369	}
1272	1370
1273		- // Get invoice from repository (only published invoices for public access)
1274	1371	$repository = InvoiceServiceProvider::getInvoiceRepository();
	1372	+ $invoice = $repository->find($invoice_id);
1275	1373
1276		- // For admins, allow access to any invoice status
1277		- if (current_user_can('manage_options')) {
1278		- $invoice = $repository->find($invoice_id);
1279		- } else {
1280		- // For non-admins, only allow access to published invoices
1281		- $invoice = $repository->findPublished($invoice_id);
	1374	+ if (!$invoice) {
	1375	+ $this->sendError(__('Invoice not found', 'easy-invoice'));
1282	1376	}
1283	1377
1284		- if (!$invoice) {
1285		- $this->sendError(__('Invoice not found', 'easy-invoice'));
	1378	+ // Authorisation.
	1379	+ //
	1380	+ // This used to read: admins get find(), everyone else gets findPublished().
	1381	+ // That was not a check at all — Models\Invoice::save() writes every invoice
	1382	+ // with post_status 'publish' regardless of its workflow status, so
	1383	+ // findPublished() returned the same record find() would have, for anyone.
	1384	+ // This endpoint is registered for wp_ajax_nopriv, so the effective gate was
	1385	+ // the nonce alone and any caller holding one could pull the PDF data for an
	1386	+ // arbitrary invoice id, including drafts.
	1387	+ //
	1388	+ // Uses the same helper as the rest of the plugin so there is a single
	1389	+ // definition of who may see a document: valid ?ik= token, administrator, or
	1390	+ // the logged-in client the invoice is bound to.
	1391	+ if (!\EasyInvoice\Controllers\InvoiceController::canSubmitPaymentForInvoice($invoice_id, $invoice)) {
	1392	+ $this->sendError(__('You do not have permission to access this invoice', 'easy-invoice'));
1286	1393	}
1287	1394
1288	1395	// Get invoice data for PDF generation
1289	1396	$invoice_data = \EasyInvoice\Includes\Helpers\PdfHelper::getInvoiceDataForPdf($invoice);
		@@ -1295,9 +1402,12 @@
1295	1402	'invoice_data' => $invoice_data,
1296	1403	'download_url' => add_query_arg(array(
1297	1404	'action' => 'easy_invoice_generate_pdf',
1298	1405	'invoice_id' => $invoice_id,
1299		- 'nonce' => wp_create_nonce('generate_pdf')
	1406	+ // Bound to this invoice: an unscoped 'generate_pdf' nonce could be
	1407	+ // taken from a document the caller may legitimately see and replayed
	1408	+ // against any other invoice id.
	1409	+ 'nonce' => wp_create_nonce('generate_pdf_' . $invoice_id)
1300	1410	), admin_url('admin-ajax.php'))
1301	1411	));
1302	1412	}
1303	1413
		@@ -1315,19 +1425,21 @@
1315	1425	}
1316	1426
1317	1427	// Get invoice from repository (only published invoices for public access)
1318	1428	$repository = InvoiceServiceProvider::getInvoiceRepository();
	1429	+ $invoice = $repository->find($invoice_id);
1319	1430
1320		- // For admins, allow access to any invoice status
1321		- if (current_user_can('manage_options')) {
1322		- $invoice = $repository->find($invoice_id);
1323		- } else {
1324		- // For non-admins, only allow access to published invoices
1325		- $invoice = $repository->findPublished($invoice_id);
	1431	+ if (!$invoice) {
	1432	+ $this->sendError(__('Invoice not found', 'easy-invoice'));
1326	1433	}
1327	1434
1328		- if (!$invoice) {
1329		- $this->sendError(__('Invoice not found', 'easy-invoice'));
	1435	+ // Authorisation. The previous admin / findPublished() split was not a check:
	1436	+ // every invoice is saved with post_status 'publish', so findPublished()
	1437	+ // returned exactly what find() would, for any caller. This endpoint is
	1438	+ // registered nopriv, so without this an unauthorised caller could make the
	1439	+ // site email an arbitrary invoice out to its client. See downloadInvoicePdf().
	1440	+ if (!\EasyInvoice\Controllers\InvoiceController::canSubmitPaymentForInvoice($invoice_id, $invoice)) {
	1441	+ $this->sendError(__('You do not have permission to access this invoice', 'easy-invoice'));
1330	1442	}
1331	1443
1332	1444	// Use EmailManager to send the email
1333	1445	$email_manager = \EasyInvoice\Services\EmailManager::getInstance();
		@@ -1354,17 +1466,18 @@
1354	1466	$this->sendError(__('Invalid quote ID', 'easy-invoice'));
1355	1467	}
1356	1468
1357	1469	$repository = \EasyInvoice\Providers\QuoteServiceProvider::getQuoteRepository();
	1470	+ $quote = $repository->find($quote_id);
1358	1471
1359		- if (current_user_can('manage_options')) {
1360		- $quote = $repository->find($quote_id);
1361		- } else {
1362		- $quote = $repository->findPublished($quote_id);
	1472	+ if (!$quote) {
	1473	+ $this->sendError(__('Quote not found', 'easy-invoice'));
1363	1474	}
1364	1475
1365		- if (!$quote) {
1366		- $this->sendError(__('Quote not found', 'easy-invoice'));
	1476	+ // Authorisation — same reasoning as the invoice path above. Quotes are also
	1477	+ // always stored with post_status 'publish', so findPublished() gated nothing.
	1478	+ if (!\EasyInvoice\Controllers\QuoteController::canActOnQuote($quote_id, $quote)) {
	1479	+ $this->sendError(__('You do not have permission to access this quote', 'easy-invoice'));
1367	1480	}
1368	1481
1369	1482	$email_manager = \EasyInvoice\Services\EmailManager::getInstance();
1370	1483	$result = $email_manager->sendQuoteEmail($quote, 'new');
		@@ -1384,10 +1497,18 @@
1384	1497	/**
1385	1498	* Generate invoice PDF
1386	1499	*/
1387	1500	public function generateInvoicePdf() {
1388		- // Verify nonce
1389		- $this->verifyNonce('generate_pdf');
	1501	+ // Explicitly bust intermediate caching on this admin-ajax URL. Some
	1502	+ // page-caching stacks (WP Rocket, LiteSpeed, Cloudflare full-page
	1503	+ // cache, some CDNs) will cache a 302 Location header keyed by URL —
	1504	+ // the URL always looks the same to the cache because both the nonce
	1505	+ // AND the target invoice-permalink change per user, so a first-hit
	1506	+ // response can be replayed to other users, breaking the redirect or
	1507	+ // returning a blank body.
	1508	+ nocache_headers();
	1509	+ header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
	1510	+ header('Pragma: no-cache');
1390	1511
1391	1512	// Get invoice ID
1392	1513	$invoice_id = isset($_REQUEST['invoice_id']) ? intval($_REQUEST['invoice_id']) : 0;
1393	1514
		@@ -1394,8 +1515,57 @@
1394	1515	if (!$invoice_id) {
1395	1516	$this->sendError(__('Invalid invoice ID', 'easy-invoice'));
1396	1517	}
1397	1518
	1519	+ // Authorisation with graceful fallback.
	1520	+ //
	1521	+ // The original design gated this endpoint on a per-request WP
	1522	+ // nonce, which is fragile in real deployments: page-caching
	1523	+ // layers (WP Rocket, LiteSpeed, Cloudflare full-page cache)
	1524	+ // cache the intermediate JSON response that mints the URL,
	1525	+ // browser SameSite / ITP behaviour, and admin_url()
	1526	+ // scheme-mismatch after login can all cause wp_verify_nonce()
	1527	+ // to return false on the intended recipient's tab — leaving
	1528	+ // the user stranded on this admin-ajax URL with no download.
	1529	+ //
	1530	+ // Accept ANY of:
	1531	+ // 1. A valid `generate_pdf` nonce (fast path — most users,
	1532	+ // most of the time, when the session cookie survives).
	1533	+ // 2. An admin session (manage_options) — bypasses the nonce
	1534	+ // because the invoice-listing button that creates this
	1535	+ // URL is admin-only and the admin owns the request.
	1536	+ // 3. A valid per-invoice access token (?ik=<token>) — the
	1537	+ // same model canSubmitPaymentForInvoice uses, so emailed
	1538	+ // invoice links can also drive a session-less download.
	1539	+ // Only when all three paths fail do we refuse.
	1540	+ $authorized = false;
	1541	+
	1542	+ // Match the same dual-key nonce lookup the removed verifyNonce()
	1543	+ // helper did — `nonce` (client-form format used by our JS) AND
	1544	+ // `_nonce` (standard WP form field name) — so any external
	1545	+ // caller of this endpoint that used _nonce still works.
	1546	+ $submitted_nonce = '';
	1547	+ if (isset($_REQUEST['nonce'])) {
	1548	+ $submitted_nonce = (string) $_REQUEST['nonce'];
	1549	+ } elseif (isset($_REQUEST['_nonce'])) {
	1550	+ $submitted_nonce = (string) $_REQUEST['_nonce'];
	1551	+ }
	1552	+ if ($submitted_nonce !== '' && wp_verify_nonce($submitted_nonce, 'generate_pdf_' . $invoice_id)) {
	1553	+ $authorized = true;
	1554	+ } elseif (current_user_can('manage_options')) {
	1555	+ $authorized = true;
	1556	+ } elseif (isset($_REQUEST['ik']) && is_string($_REQUEST['ik'])) {
	1557	+ $presented = sanitize_text_field(wp_unslash($_REQUEST['ik']));
	1558	+ $stored = (string) get_post_meta($invoice_id, '_easy_invoice_invoice_access_token', true);
	1559	+ if ($stored !== '' && $presented !== '' && hash_equals($stored, $presented)) {
	1560	+ $authorized = true;
	1561	+ }
	1562	+ }
	1563	+
	1564	+ if (!$authorized) {
	1565	+ $this->sendError(__('Security check failed', 'easy-invoice'));
	1566	+ }
	1567	+
1398	1568	// Get invoice from repository
1399	1569	$repository = InvoiceServiceProvider::getInvoiceRepository();
1400	1570
1401	1571	// For admins, allow access to any invoice status
		@@ -1409,16 +1579,24 @@
1409	1579	if (!$invoice) {
1410	1580	$this->sendError(__('Invoice not found', 'easy-invoice'));
1411	1581	}
1412	1582
1413		- // Redirect to the invoice single page with PDF generation
	1583	+ // Redirect to the invoice single page with PDF generation.
	1584	+ // Forward the ?ik= access token onwards so the single-page
	1585	+ // template can also authorise the recipient (the same token
	1586	+ // that got us through Path 3 above).
1414	1587	$invoice_url = get_permalink($invoice_id);
1415		- if ($invoice_url) {
1416		- wp_redirect(add_query_arg('auto_download_pdf', '1', $invoice_url));
1417		- exit;
1418		- } else {
	1588	+ if (!$invoice_url) {
1419	1589	$this->sendError(__('Could not generate invoice URL', 'easy-invoice'));
1420	1590	}
	1591	+
	1592	+ $target_args = ['auto_download_pdf' => '1'];
	1593	+ if (isset($_REQUEST['ik']) && is_string($_REQUEST['ik']) && $_REQUEST['ik'] !== '') {
	1594	+ $target_args['ik'] = sanitize_text_field(wp_unslash($_REQUEST['ik']));
	1595	+ }
	1596	+ $target_url = add_query_arg($target_args, $invoice_url);
	1597	+
	1598	+ $this->redirectWithFallback($target_url);
1421	1599	}
1422	1600
1423	1601	/**
1424	1602	* Generate quote PDF
		@@ -1423,10 +1601,12 @@
1423	1601	/**
1424	1602	* Generate quote PDF
1425	1603	*/
1426	1604	public function generateQuotePdf() {
1427		- // Verify nonce
1428		- $this->verifyNonce('generate_quote_pdf');
	1605	+ // Same cache-busting as generateInvoicePdf — see comment there.
	1606	+ nocache_headers();
	1607	+ header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
	1608	+ header('Pragma: no-cache');
1429	1609
1430	1610	// Get quote ID
1431	1611	$quote_id = isset($_REQUEST['quote_id']) ? intval($_REQUEST['quote_id']) : 0;
1432	1612
		@@ -1433,8 +1613,45 @@
1433	1613	if (!$quote_id) {
1434	1614	$this->sendError(__('Invalid quote ID', 'easy-invoice'));
1435	1615	}
1436	1616
	1617	+ // Authorisation with graceful fallback. Same three-path model
	1618	+ // as generateInvoicePdf — see that method's comment for the
	1619	+ // full rationale (nonce fragility across caching layers,
	1620	+ // cross-tab session cookie behaviour, etc.). Paths accepted:
	1621	+ //
	1622	+ // 1. Valid `generate_quote_pdf` nonce (fast path).
	1623	+ // 2. Admin session (manage_options) — the quote-listing
	1624	+ // button that mints this URL is admin-only.
	1625	+ // 3. Valid per-quote access token (?qk=<token>) — mirrors
	1626	+ // the CVE-2026-9021 model so emailed quote links can
	1627	+ // drive a session-less PDF download.
	1628	+ $authorized = false;
	1629	+
	1630	+ // Same dual-key nonce lookup as the invoice handler — see
	1631	+ // generateInvoicePdf for the backward-compat rationale.
	1632	+ $submitted_nonce = '';
	1633	+ if (isset($_REQUEST['nonce'])) {
	1634	+ $submitted_nonce = (string) $_REQUEST['nonce'];
	1635	+ } elseif (isset($_REQUEST['_nonce'])) {
	1636	+ $submitted_nonce = (string) $_REQUEST['_nonce'];
	1637	+ }
	1638	+ if ($submitted_nonce !== '' && wp_verify_nonce($submitted_nonce, 'generate_quote_pdf_' . $quote_id)) {
	1639	+ $authorized = true;
	1640	+ } elseif (current_user_can('manage_options')) {
	1641	+ $authorized = true;
	1642	+ } elseif (isset($_REQUEST['qk']) && is_string($_REQUEST['qk'])) {
	1643	+ $presented = sanitize_text_field(wp_unslash($_REQUEST['qk']));
	1644	+ $stored = (string) get_post_meta($quote_id, '_easy_invoice_quote_access_token', true);
	1645	+ if ($stored !== '' && $presented !== '' && hash_equals($stored, $presented)) {
	1646	+ $authorized = true;
	1647	+ }
	1648	+ }
	1649	+
	1650	+ if (!$authorized) {
	1651	+ $this->sendError(__('Security check failed', 'easy-invoice'));
	1652	+ }
	1653	+
1437	1654	// Get quote from repository — mirror invoice PDF: only published quotes for non-admins (incl. nopriv).
1438	1655	$repository = \EasyInvoice\Providers\QuoteServiceProvider::getQuoteRepository();
1439	1656	if (current_user_can('manage_options')) {
1440	1657	$quote = $repository->find($quote_id);
		@@ -1445,16 +1662,62 @@
1445	1662	if (!$quote) {
1446	1663	$this->sendError(__('Quote not found', 'easy-invoice'));
1447	1664	}
1448	1665
1449		- // Redirect to the quote single page with PDF generation
	1666	+ // Redirect to the quote single page with PDF generation.
	1667	+ // Forward the ?qk= access token so the single-page template
	1668	+ // can also authorise the recipient with the same key that
	1669	+ // got us through Path 3.
1450	1670	$quote_url = get_permalink($quote_id);
1451		- if ($quote_url) {
1452		- wp_redirect(add_query_arg('auto_download_pdf', '1', $quote_url));
	1671	+ if (!$quote_url) {
	1672	+ $this->sendError(__('Could not generate quote URL', 'easy-invoice'));
	1673	+ }
	1674	+
	1675	+ $target_args = ['auto_download_pdf' => '1'];
	1676	+ if (isset($_REQUEST['qk']) && is_string($_REQUEST['qk']) && $_REQUEST['qk'] !== '') {
	1677	+ $target_args['qk'] = sanitize_text_field(wp_unslash($_REQUEST['qk']));
	1678	+ }
	1679	+ $target_url = add_query_arg($target_args, $quote_url);
	1680	+
	1681	+ $this->redirectWithFallback($target_url);
	1682	+ }
	1683	+
	1684	+ /**
	1685	+ * Redirect the current request to $url, with a client-side fallback
	1686	+ * when the server-side redirect can't fire.
	1687	+ *
	1688	+ * `wp_safe_redirect()` silently no-ops if headers have already been sent
	1689	+ * (BOM in a plugin file, plugin echoing during an action, PHP warning
	1690	+ * output, etc.). Because we also `exit;` immediately after, that failure
	1691	+ * mode produces a 200 OK with an empty body — the reported blank-page
	1692	+ * bug on the invoice-listing PDF download.
	1693	+ *
	1694	+ * This helper detects the headers-sent case and emits a minimal HTML
	1695	+ * document that redirects via meta-refresh (works with JS disabled) and
	1696	+ * `window.location.replace()` (JS-enabled, doesn't add a history entry).
	1697	+ * Both point at the same escaped URL so misconfigured stacks still get
	1698	+ * the user to the target page.
	1699	+ */
	1700	+ private function redirectWithFallback(string $url): void {
	1701	+ // Suppress cache one more time in case some plugin filtered our
	1702	+ // earlier headers away between then and now.
	1703	+ nocache_headers();
	1704	+
	1705	+ if (!headers_sent()) {
	1706	+ wp_safe_redirect($url);
1453	1707	exit;
1454		- } else {
1455		- $this->sendError(__('Could not generate quote URL', 'easy-invoice'));
1456	1708	}
	1709	+
	1710	+ // Fallback: server-side redirect impossible. Emit a client-side one.
	1711	+ $safe_url = esc_url_raw($url);
	1712	+ echo '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">';
	1713	+ echo '<meta http-equiv="refresh" content="0; url=' . esc_attr($safe_url) . '">';
	1714	+ echo '<title>Redirecting…</title>';
	1715	+ echo '<script>window.location.replace(' . wp_json_encode($safe_url) . ');</script>';
	1716	+ echo '</head><body>';
	1717	+ echo '<p>Redirecting to <a href="' . esc_url($safe_url) . '">' . esc_html($safe_url) . '</a>…</p>';
	1718	+ echo '</body></html>';
	1719	+ exit;
1457	1720	}
1458	1721
1459	1722	/**
1460	1723	* Search clients for the dropdown
		@@ -1486,10 +1749,13 @@
1486	1749	}));
1487	1750	}
1488	1751	}
1489	1752
	1753	+ // Bypass $this->sendSuccess() — search is a read endpoint and
	1754	+ // shouldn't show "Operation completed successfully" toasts on
	1755	+ // every keystroke. Use wp_send_json_success directly.
1490	1756	if (empty($clients)) {
1491		- $this->sendSuccess(array());
	1757	+ wp_send_json_success(array());
1492	1758	}
1493	1759
1494	1760	// Format clients for dropdown
1495	1761	$formatted_clients = array();
		@@ -1526,9 +1792,9 @@
1526	1792	'display_name' => $client_name . ' (' . $email . ')'
1527	1793	);
1528	1794	}
1529	1795
1530		- $this->sendSuccess($formatted_clients);
	1796	+ wp_send_json_success($formatted_clients);
1531	1797	}
1532	1798
1533	1799	/**
1534	1800	* Save additional CSS for invoice/quote
		@@ -1534,9 +1800,9 @@
1534	1800	* Save additional CSS for invoice/quote
1535	1801	*/
1536	1802	public function saveAdditionalCSS() {
1537	1803	// Verify nonce
1538		- if (!wp_verify_nonce($_POST['nonce'], 'save_additional_css_nonce')) {
	1804	+ if (!wp_verify_nonce(($_POST['nonce'] ?? ''), 'save_additional_css_nonce')) {
1539	1805	$this->sendError('Security check failed');
1540	1806	return;
1541	1807	}
1542	1808