| @@ -24,9 +24,8 @@ | ||
| 24 | 24 | * Initialize AJAX handlers |
| 25 | 25 | */ |
| 26 | 26 | public function init() { |
| 27 | 27 | // Invoice actions |
| 28 | - //add_action('wp_ajax_easy_invoice_save', array($this, 'saveInvoice')); | |
| 29 | 28 | add_action('wp_ajax_easy_invoice_delete', array($this, 'deleteInvoice')); |
| 30 | 29 | add_action('wp_ajax_easy_invoice_get', array($this, 'getInvoice')); |
| 31 | 30 | add_action('wp_ajax_easy_invoice_save_invoice', array($this, 'saveInvoice')); |
| 32 | 31 | add_action('wp_ajax_easy_invoice_save_and_send_invoice', array($this, 'saveAndSendInvoice')); |
| @@ -77,12 +76,22 @@ | ||
| 77 | 76 | */ |
| 78 | 77 | public function saveInvoice() { |
| 79 | 78 | $this->verifyNonce('easy_invoice_nonce'); |
| 80 | 79 | |
| 81 | - if (!current_user_can('manage_options')) { | |
| 80 | + if (!easy_invoice_user_can('ei_create_invoice')) { | |
| 82 | 81 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 83 | 82 | } |
| 84 | 83 | |
| 84 | + // Lifecycle-stage edit gate. Addons (PartialPayments) can return | |
| 85 | + // false here to block edits to invoices whose state shouldn't | |
| 86 | + // change anymore — e.g. a deposit invoice that has already been | |
| 87 | + // paid (where editing items would silently invalidate the | |
| 88 | + // deposit/balance pair the customer already saw). | |
| 89 | + $editing_invoice_id = isset($_POST['invoice_id']) ? (int) $_POST['invoice_id'] : 0; | |
| 90 | + if ($editing_invoice_id > 0 && !apply_filters('easy_invoice_can_edit_invoice', true, $editing_invoice_id)) { | |
| 91 | + $this->sendError(__('This deposit invoice has already been paid and is locked from further edits. Add the new line item to the linked balance invoice instead.', 'easy-invoice')); | |
| 92 | + } | |
| 93 | + | |
| 85 | 94 | // Get the raw invoice data from the form |
| 86 | 95 | $raw_invoice_data = isset($_POST['invoice_data']) ? $_POST['invoice_data'] : $_POST; |
| 87 | 96 | |
| 88 | 97 | // Remove non-invoice fields |
| @@ -93,10 +102,11 @@ | ||
| 93 | 102 | $invoice_form_manager = new \EasyInvoice\Forms\Invoice\InvoiceFormManager(); |
| 94 | 103 | $invoice_data = $invoice_form_manager->processFormData($raw_invoice_data); |
| 95 | 104 | |
| 96 | 105 | if (!empty($invoice_data['errors'])) { |
| 106 | + // The toast is what the user sees; the field may sit on another tab. | |
| 97 | 107 | wp_send_json_error([ |
| 98 | - 'message' => 'Validation failed', | |
| 108 | + 'message' => implode(' ', array_map('strval', $invoice_data['errors'])), | |
| 99 | 109 | 'errors' => $invoice_data['errors'] |
| 100 | 110 | ]); |
| 101 | 111 | } |
| 102 | 112 | |
| @@ -158,8 +168,17 @@ | ||
| 158 | 168 | if (!$invoice) { |
| 159 | 169 | $this->sendError(__('Failed to create invoice', 'easy-invoice')); |
| 160 | 170 | } |
| 161 | 171 | |
| 172 | + // The repository claimed a number under its lock (or generated the next | |
| 173 | + // one when the number the builder peeked on page load was taken | |
| 174 | + // meanwhile). Carry that claimed number into the form data: the | |
| 175 | + // FormProcessor below writes every posted field, and the stale peek | |
| 176 | + // would otherwise overwrite the claim — two builders open at once | |
| 177 | + // then saved two documents with the same number. | |
| 178 | + $invoice_data['data']['number'] = $invoice->getNumber(); | |
| 179 | + unset($invoice_data['data']['invoice_number']); | |
| 180 | + | |
| 162 | 181 | // Use FormProcessor to save form data to database |
| 163 | 182 | $form_processor = new \EasyInvoice\Forms\FormProcessor(); |
| 164 | 183 | $all_fields = $invoice_form_manager->getAllFields(); |
| 165 | 184 | $form_processor->saveFormDataToDatabase($invoice_data['data'], $all_fields, $invoice); |
| @@ -215,9 +234,10 @@ | ||
| 215 | 234 | */ |
| 216 | 235 | public function saveAndSendInvoice() { |
| 217 | 236 | $this->verifyNonce('easy_invoice_nonce'); |
| 218 | 237 | |
| 219 | - if (!current_user_can('manage_options')) { | |
| 238 | + // Compound action: needs both create-edit and send rights. | |
| 239 | + if (!easy_invoice_user_can('ei_create_invoice') || !easy_invoice_user_can('ei_send_invoice')) { | |
| 220 | 240 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 221 | 241 | } |
| 222 | 242 | |
| 223 | 243 | // First save the invoice |
| @@ -249,9 +269,9 @@ | ||
| 249 | 269 | */ |
| 250 | 270 | public function deleteInvoice() { |
| 251 | 271 | $this->verifyNonce('easy_invoice_nonce'); |
| 252 | 272 | |
| 253 | - if (!current_user_can('manage_options')) { | |
| 273 | + if (!easy_invoice_user_can('ei_delete_invoice')) { | |
| 254 | 274 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 255 | 275 | } |
| 256 | 276 | |
| 257 | 277 | $invoice_id = isset($_POST['invoice_id']) ? intval($_POST['invoice_id']) : 0; |
| @@ -278,9 +298,9 @@ | ||
| 278 | 298 | */ |
| 279 | 299 | public function getInvoice() { |
| 280 | 300 | $this->verifyNonce('easy_invoice_nonce'); |
| 281 | 301 | |
| 282 | - if (!current_user_can('manage_options')) { | |
| 302 | + if (!easy_invoice_user_can('ei_view_invoices')) { | |
| 283 | 303 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 284 | 304 | } |
| 285 | 305 | |
| 286 | 306 | $invoice_id = isset($_REQUEST['invoice_id']) ? intval($_REQUEST['invoice_id']) : 0; |
| @@ -306,9 +326,9 @@ | ||
| 306 | 326 | */ |
| 307 | 327 | public function saveClient() { |
| 308 | 328 | $this->verifyNonce('easy_invoice_nonce'); |
| 309 | 329 | |
| 310 | - if (!current_user_can('manage_options')) { | |
| 330 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 311 | 331 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 312 | 332 | } |
| 313 | 333 | |
| 314 | 334 | $client_id = isset($_POST['client_id']) ? intval($_POST['client_id']) : 0; |
| @@ -354,14 +374,17 @@ | ||
| 354 | 374 | public function deleteClient() { |
| 355 | 375 | try { |
| 356 | 376 | $this->verifyNonce('easy_invoice_nonce'); |
| 357 | 377 | |
| 358 | - if (!current_user_can('manage_options')) { | |
| 378 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 359 | 379 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 360 | 380 | } |
| 361 | 381 | |
| 362 | 382 | $client_id = isset($_POST['client_id']) ? intval($_POST['client_id']) : 0; |
| 363 | - $delete_associated_documents = isset($_POST['delete_associated_documents']) ? (bool)$_POST['delete_associated_documents'] : false; | |
| 383 | + // The dialog posts the literal strings "true" / "false"; a bool cast | |
| 384 | + // made "false" true, so "Delete client only" removed the documents too. | |
| 385 | + $delete_associated_documents = isset($_POST['delete_associated_documents']) | |
| 386 | + && filter_var(wp_unslash($_POST['delete_associated_documents']), FILTER_VALIDATE_BOOLEAN); | |
| 364 | 387 | |
| 365 | 388 | if ($client_id <= 0) { |
| 366 | 389 | $this->sendError(__('Invalid client ID', 'easy-invoice')); |
| 367 | 390 | } |
| @@ -388,18 +411,25 @@ | ||
| 388 | 411 | "SELECT COUNT(*) FROM {$wpdb->postmeta} WHERE meta_key = '_easy_invoice_quote_client_id' AND meta_value = %d", |
| 389 | 412 | $client_id |
| 390 | 413 | )); |
| 391 | 414 | |
| 392 | - $payment_count = $wpdb->get_var($wpdb->prepare( | |
| 393 | - "SELECT COUNT(*) FROM {$wpdb->postmeta} WHERE meta_key = '_easy_payment_client_id' AND meta_value = %d", | |
| 394 | - $client_id | |
| 395 | - )); | |
| 415 | + // Counted through the client's invoices, because that is the only | |
| 416 | + // link there is: payments record '_invoice_id' and no client id. | |
| 417 | + // This counted meta '_easy_payment_client_id', which nothing writes, | |
| 418 | + // so the confirmation dialog told every user there were no payments | |
| 419 | + // no matter how many there were. | |
| 420 | + $payment_count = count(\EasyInvoice\Services\ClientLedger::paymentIds((int) $client_id)); | |
| 396 | 421 | |
| 397 | 422 | $total_documents = $invoice_count + $quote_count + $payment_count; |
| 398 | 423 | |
| 399 | 424 | if ($delete_associated_documents) { |
| 400 | 425 | // Delete all associated documents |
| 401 | - $this->log(sprintf('Deleting client %d with all associated documents (%d invoices, %d quotes, %d payments)', | |
| 426 | + // error_log(), not $this->log(): no such method exists on this class or | |
| 427 | + // any trait it uses, so both branches of this handler raised | |
| 428 | + // "Call to undefined method" — deleting a client failed with a critical | |
| 429 | + // error whichever option the administrator chose. Matches the logging | |
| 430 | + // used elsewhere in the plugin. | |
| 431 | + error_log(sprintf('Easy Invoice: deleting client %d with all associated documents (%d invoices, %d quotes, %d payments)', | |
| 402 | 432 | $client_id, $invoice_count, $quote_count, $payment_count)); |
| 403 | 433 | |
| 404 | 434 | // Delete invoices |
| 405 | 435 | if ($invoice_count > 0) { |
| @@ -423,22 +453,56 @@ | ||
| 423 | 453 | } |
| 424 | 454 | } |
| 425 | 455 | |
| 426 | 456 | // Delete payments |
| 427 | - if ($payment_count > 0) { | |
| 428 | - $payments = $wpdb->get_col($wpdb->prepare( | |
| 429 | - "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key = '_easy_invoice_payment_client_id' AND meta_value = %d", | |
| 430 | - $client_id | |
| 431 | - )); | |
| 432 | - foreach ($payments as $payment_id) { | |
| 433 | - wp_delete_post($payment_id, true); | |
| 434 | - } | |
| 435 | - } | |
| 457 | + // | |
| 458 | + // This queried '_easy_invoice_payment_client_id' while the matching | |
| 459 | + // count above (and the meta cleanup below, and | |
| 460 | + // ClientRepository::countClientPayments) all query | |
| 461 | + // '_easy_payment_client_id' — so the count and the deletion disagreed | |
| 462 | + // on which key identifies a client's payments. Unified on | |
| 463 | + // '_easy_payment_client_id', the key the other three sites use. | |
| 464 | + // | |
| 465 | + // Payments are RETAINED, on purpose, and the message below says so. | |
| 466 | + // | |
| 467 | + // Neither of those meta keys is ever written: a payment stores | |
| 468 | + // '_invoice_id' and carries no client id at all, so it is linked to | |
| 469 | + // a client only through its invoice. Client deletion has therefore | |
| 470 | + // never removed a payment, whatever the dialog implied. | |
| 471 | + // | |
| 472 | + // $payment_count is now resolved correctly through ClientLedger, so | |
| 473 | + // the count is true even though the behaviour is unchanged. Making | |
| 474 | + // the deletion true as well would destroy records this path has | |
| 475 | + // never touched — a payment is the evidence money changed hands, and | |
| 476 | + // the reasoning that stops InvoiceRetention deleting an issued | |
| 477 | + // invoice applies to it. That is a deliberate decision to keep them, | |
| 478 | + // not an oversight, so it is stated to the user rather than hidden. | |
| 436 | 479 | |
| 437 | - $message = sprintf(__('Client and all associated documents (%d total) deleted successfully', 'easy-invoice'), $total_documents); | |
| 480 | + // Say what was kept as well as what went. "All associated documents | |
| 481 | + // deleted" was never true where payments were concerned, and a | |
| 482 | + // merchant who believes their payment records are gone will look | |
| 483 | + // for them in the wrong place at the wrong time of year. | |
| 484 | + $message = $payment_count > 0 | |
| 485 | + ? sprintf( | |
| 486 | + /* translators: 1: number of documents deleted, 2: number of payment records kept. */ | |
| 487 | + _n( | |
| 488 | + 'Client deleted, along with %1$d document. %2$d payment record was kept as a financial record.', | |
| 489 | + 'Client deleted, along with %1$d documents. %2$d payment records were kept as financial records.', | |
| 490 | + $payment_count, | |
| 491 | + 'easy-invoice' | |
| 492 | + ), | |
| 493 | + $invoice_count + $quote_count, | |
| 494 | + $payment_count | |
| 495 | + ) | |
| 496 | + : sprintf( | |
| 497 | + /* translators: %d: number of documents deleted. */ | |
| 498 | + __('Client and all associated documents (%d total) deleted successfully', 'easy-invoice'), | |
| 499 | + $total_documents | |
| 500 | + ); | |
| 438 | 501 | } else { |
| 439 | 502 | // Only remove client associations, preserve documents |
| 440 | - $this->log(sprintf('Removing client associations for client %d (%d invoices, %d quotes, %d payments)', | |
| 503 | + // See the note on the other branch above. | |
| 504 | + error_log(sprintf('Easy Invoice: removing client associations for client %d (%d invoices, %d quotes, %d payments)', | |
| 441 | 505 | $client_id, $invoice_count, $quote_count, $payment_count)); |
| 442 | 506 | |
| 443 | 507 | // Remove client associations from invoices |
| 444 | 508 | if ($invoice_count > 0) { |
| @@ -463,11 +527,17 @@ | ||
| 463 | 527 | ['meta_key' => '_easy_payment_client_id', 'meta_value' => $client_id] |
| 464 | 528 | ); |
| 465 | 529 | } |
| 466 | 530 | |
| 531 | + /* translators: %d: number of documents. */ | |
| 467 | 532 | $message = sprintf(__('Client deleted successfully. %d documents preserved but client associations removed.', 'easy-invoice'), $total_documents); |
| 468 | 533 | } |
| 469 | 534 | |
| 535 | + // Snapshot identity BEFORE delete — once wp_delete_user runs the | |
| 536 | + // user record is gone and we can't backfill the audit context. | |
| 537 | + $deleted_login = $user && $user->user_login ? $user->user_login : ''; | |
| 538 | + $deleted_email = $user && $user->user_email ? $user->user_email : ''; | |
| 539 | + | |
| 470 | 540 | // Delete the WordPress user |
| 471 | 541 | require_once(ABSPATH . 'wp-admin/includes/user.php'); |
| 472 | 542 | $result = wp_delete_user($client_id); |
| 473 | 543 | |
| @@ -474,8 +544,20 @@ | ||
| 474 | 544 | if (!$result) { |
| 475 | 545 | $this->sendError(__('Failed to delete client', 'easy-invoice')); |
| 476 | 546 | } |
| 477 | 547 | |
| 548 | + // Audit: record the delete with enough context to investigate later. | |
| 549 | + if (function_exists('easy_invoice_audit_log')) { | |
| 550 | + easy_invoice_audit_log('client_deleted', 'client', $client_id, [ | |
| 551 | + 'login' => $deleted_login, | |
| 552 | + 'email' => $deleted_email, | |
| 553 | + 'invoices_affected' => (int) $invoice_count, | |
| 554 | + 'quotes_affected' => (int) $quote_count, | |
| 555 | + 'payments_affected' => (int) $payment_count, | |
| 556 | + 'cascade_delete' => $delete_associated_documents, | |
| 557 | + ]); | |
| 558 | + } | |
| 559 | + | |
| 478 | 560 | $this->sendSuccess(array( |
| 479 | 561 | 'message' => $message, |
| 480 | 562 | 'client_id' => $client_id, |
| 481 | 563 | 'documents_deleted' => $delete_associated_documents, |
| @@ -492,9 +574,9 @@ | ||
| 492 | 574 | */ |
| 493 | 575 | public function getClient() { |
| 494 | 576 | $this->verifyNonce('easy_invoice_nonce'); |
| 495 | 577 | |
| 496 | - if (!current_user_can('manage_options')) { | |
| 578 | + if (!easy_invoice_user_can('ei_view_clients')) { | |
| 497 | 579 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 498 | 580 | } |
| 499 | 581 | |
| 500 | 582 | $client_id = isset($_REQUEST['client_id']) ? intval($_REQUEST['client_id']) : 0; |
| @@ -608,10 +690,21 @@ | ||
| 608 | 690 | private function sendSuccess($data = array()) { |
| 609 | 691 | // Check if we should suppress global toast |
| 610 | 692 | $suppress_toast = isset($_POST['suppress_global_toast']) && $_POST['suppress_global_toast'] === 'true'; |
| 611 | 693 | |
| 612 | - // Add toast notification if not already present and not suppressed | |
| 613 | - if (!isset($data['toast']) && !$suppress_toast) { | |
| 694 | + // Only inject the toast key when $data is an associative array | |
| 695 | + // (or empty). If $data is a numeric-indexed list (e.g. search | |
| 696 | + // results), adding a string key would mutate the array shape: | |
| 697 | + // PHP keeps the mixed keys, but `wp_send_json_success` then | |
| 698 | + // serialises the value as a JSON OBJECT instead of an array, | |
| 699 | + // breaking any frontend that does `response.data.length` or | |
| 700 | + // `response.data.forEach(...)` — the exact bug that caused the | |
| 701 | + // client-search dropdown to silently render empty results. | |
| 702 | + $is_assoc_or_empty = !is_array($data) | |
| 703 | + || empty($data) | |
| 704 | + || array_keys($data) !== range(0, count($data) - 1); | |
| 705 | + | |
| 706 | + if ($is_assoc_or_empty && !isset($data['toast']) && !$suppress_toast) { | |
| 614 | 707 | $message = isset($data['message']) ? $data['message'] : __('Operation completed successfully', 'easy-invoice'); |
| 615 | 708 | $data['toast'] = array( |
| 616 | 709 | 'type' => 'success', |
| 617 | 710 | 'message' => $message, |
| @@ -619,9 +712,9 @@ | ||
| 619 | 712 | ); |
| 620 | 713 | } |
| 621 | 714 | |
| 622 | 715 | // Remove toast data if suppressed |
| 623 | - if ($suppress_toast && isset($data['toast'])) { | |
| 716 | + if ($is_assoc_or_empty && $suppress_toast && isset($data['toast'])) { | |
| 624 | 717 | unset($data['toast']); |
| 625 | 718 | } |
| 626 | 719 | |
| 627 | 720 | wp_send_json_success($data); |
| @@ -648,9 +741,9 @@ | ||
| 648 | 741 | // Verify nonce |
| 649 | 742 | $this->verifyNonce('easy_invoice_nonce'); |
| 650 | 743 | |
| 651 | 744 | // Check if user has required capability |
| 652 | - if (!current_user_can('edit_posts')) { | |
| 745 | + if (!easy_invoice_user_can('ei_view_invoices')) { | |
| 653 | 746 | $this->sendError(__('You do not have permission to download invoices', 'easy-invoice')); |
| 654 | 747 | } |
| 655 | 748 | |
| 656 | 749 | // Get invoice ID |
| @@ -683,9 +776,9 @@ | ||
| 683 | 776 | */ |
| 684 | 777 | public function sendInvoiceEmail() { |
| 685 | 778 | $this->verifyNonce('easy_invoice_nonce'); |
| 686 | 779 | |
| 687 | - if (!current_user_can('manage_options')) { | |
| 780 | + if (!easy_invoice_user_can('ei_send_invoice')) { | |
| 688 | 781 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 689 | 782 | } |
| 690 | 783 | |
| 691 | 784 | // Get invoice ID from POST data |
| @@ -706,8 +799,15 @@ | ||
| 706 | 799 | $email_manager = \EasyInvoice\Services\EmailManager::getInstance(); |
| 707 | 800 | $result = $email_manager->sendInvoiceEmail($invoice, 'new'); |
| 708 | 801 | |
| 709 | 802 | if ($result['success']) { |
| 803 | + // Audit: who sent which invoice to which client, at what time. | |
| 804 | + if (function_exists('easy_invoice_audit_log')) { | |
| 805 | + easy_invoice_audit_log('invoice_sent', 'invoice', $invoice_id, [ | |
| 806 | + 'recipient' => is_callable([$invoice, 'getCustomerEmail']) ? $invoice->getCustomerEmail() : '', | |
| 807 | + 'context' => 'new', | |
| 808 | + ]); | |
| 809 | + } | |
| 710 | 810 | $this->sendSuccess(array( |
| 711 | 811 | 'message' => $result['message'] |
| 712 | 812 | )); |
| 713 | 813 | } else { |
| @@ -722,9 +822,9 @@ | ||
| 722 | 822 | // Verify nonce |
| 723 | 823 | $this->verifyNonce('easy_invoice_nonce'); |
| 724 | 824 | |
| 725 | 825 | // Check if user has required capability |
| 726 | - if (!current_user_can('edit_posts')) { | |
| 826 | + if (!easy_invoice_user_can('ei_view_quotes')) { | |
| 727 | 827 | $this->sendError(__('You do not have permission to download quotes', 'easy-invoice')); |
| 728 | 828 | } |
| 729 | 829 | |
| 730 | 830 | // Get quote ID |
| @@ -749,9 +849,10 @@ | ||
| 749 | 849 | 'quote_data' => $quote->toArray(), |
| 750 | 850 | 'download_url' => add_query_arg(array( |
| 751 | 851 | 'action' => 'easy_invoice_generate_quote_pdf', |
| 752 | 852 | 'quote_id' => $quote_id, |
| 753 | - 'nonce' => wp_create_nonce('generate_quote_pdf') | |
| 853 | + // Bound to this quote — see the invoice equivalent above. | |
| 854 | + 'nonce' => wp_create_nonce('generate_quote_pdf_' . $quote_id) | |
| 754 | 855 | ), admin_url('admin-ajax.php')) |
| 755 | 856 | )); |
| 756 | 857 | } |
| 757 | 858 | |
| @@ -760,9 +861,9 @@ | ||
| 760 | 861 | */ |
| 761 | 862 | public function saveQuote() { |
| 762 | 863 | $this->verifyNonce('easy_invoice_nonce'); |
| 763 | 864 | |
| 764 | - if (!current_user_can('manage_options')) { | |
| 865 | + if (!easy_invoice_user_can('ei_create_quote')) { | |
| 765 | 866 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 766 | 867 | } |
| 767 | 868 | |
| 768 | 869 | // Get the raw quote data from the form |
| @@ -777,9 +878,9 @@ | ||
| 777 | 878 | $quote_data = $quote_form_manager->processFormData($raw_quote_data); |
| 778 | 879 | |
| 779 | 880 | if (!empty($quote_data['errors'])) { |
| 780 | 881 | wp_send_json_error([ |
| 781 | - 'message' => 'Validation failed', | |
| 882 | + 'message' => implode(' ', array_map('strval', $quote_data['errors'])), | |
| 782 | 883 | 'errors' => $quote_data['errors'] |
| 783 | 884 | ]); |
| 784 | 885 | } |
| 785 | 886 | |
| @@ -847,8 +948,13 @@ | ||
| 847 | 948 | if (!$quote) { |
| 848 | 949 | $this->sendError(__('Failed to create quote', 'easy-invoice')); |
| 849 | 950 | } |
| 850 | 951 | |
| 952 | + // Same as invoices: keep the number the repository claimed, not the one | |
| 953 | + // the builder peeked on page load (see saveInvoice()). | |
| 954 | + $quote_data['data']['number'] = $quote->getNumber(); | |
| 955 | + unset($quote_data['data']['quote_number']); | |
| 956 | + | |
| 851 | 957 | // Use FormProcessor to save form data to database |
| 852 | 958 | $form_processor = new \EasyInvoice\Forms\FormProcessor(); |
| 853 | 959 | $all_fields = $quote_form_manager->getAllFields(); |
| 854 | 960 | $form_processor->saveFormDataToDatabase($quote_data['data'], $all_fields, $quote); |
| @@ -913,9 +1019,11 @@ | ||
| 913 | 1019 | */ |
| 914 | 1020 | public function checkEmailExists() { |
| 915 | 1021 | $this->verifyNonce('easy_invoice_nonce'); |
| 916 | 1022 | |
| 917 | - if (!current_user_can('manage_options')) { | |
| 1023 | + // Email-lookup is used during client creation; anyone who can manage | |
| 1024 | + // clients can check duplicates. | |
| 1025 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 918 | 1026 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 919 | 1027 | } |
| 920 | 1028 | |
| 921 | 1029 | $email = isset($_POST['email']) ? sanitize_email($_POST['email']) : ''; |
| @@ -938,9 +1046,10 @@ | ||
| 938 | 1046 | */ |
| 939 | 1047 | public function generatePassword() { |
| 940 | 1048 | $this->verifyNonce('easy_invoice_nonce'); |
| 941 | 1049 | |
| 942 | - if (!current_user_can('manage_options')) { | |
| 1050 | + // Used when creating a client (WP user); same gate as client management. | |
| 1051 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 943 | 1052 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 944 | 1053 | } |
| 945 | 1054 | |
| 946 | 1055 | $password = wp_generate_password(16, true, true); |
| @@ -1023,9 +1132,9 @@ | ||
| 1023 | 1132 | public function addClient() { |
| 1024 | 1133 | |
| 1025 | 1134 | $this->verifyNonce('easy_invoice_nonce'); |
| 1026 | 1135 | |
| 1027 | - if (!current_user_can('manage_options')) { | |
| 1136 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 1028 | 1137 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 1029 | 1138 | } |
| 1030 | 1139 | |
| 1031 | 1140 | // Check if required fields are present |
| @@ -1031,23 +1140,27 @@ | ||
| 1031 | 1140 | // Check if required fields are present |
| 1032 | 1141 | $required_fields = ['business_client_name', 'email', 'username']; |
| 1033 | 1142 | foreach ($required_fields as $field) { |
| 1034 | 1143 | if (!isset($_POST[$field]) || empty($_POST[$field])) { |
| 1035 | - $this->sendError(__('Missing required field: ' . $field, 'easy-invoice')); | |
| 1144 | + /* translators: %s: form field name. */ | |
| 1145 | + $this->sendError(sprintf(__('Missing required field: %s', 'easy-invoice'), $field)); | |
| 1036 | 1146 | } |
| 1037 | 1147 | } |
| 1038 | 1148 | |
| 1039 | 1149 | // Prepare client data |
| 1150 | + // Optional fields may be absent from the request entirely. | |
| 1151 | + $post_text = static function ($key) { return isset($_POST[$key]) ? sanitize_text_field(wp_unslash($_POST[$key])) : ''; }; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- checked above. | |
| 1152 | + $post_area = static function ($key) { return isset($_POST[$key]) ? sanitize_textarea_field(wp_unslash($_POST[$key])) : ''; }; // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 1040 | 1153 | $client_data = [ |
| 1041 | - ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field($_POST['business_client_name']), | |
| 1042 | - ClientFields::EMAIL => sanitize_email($_POST['email']), | |
| 1043 | - ClientFields::USERNAME => sanitize_user($_POST['username']), | |
| 1044 | - ClientFields::PASSWORD => $_POST['password'], | |
| 1045 | - ClientFields::ADDRESS => sanitize_textarea_field($_POST['address']), | |
| 1046 | - ClientFields::EXTRA_INFO => sanitize_textarea_field($_POST['extra_info']), | |
| 1047 | - ClientFields::FIRST_NAME => sanitize_text_field($_POST['first_name']), | |
| 1048 | - ClientFields::LAST_NAME => sanitize_text_field($_POST['last_name']), | |
| 1049 | - ClientFields::WEBSITE => esc_url_raw($_POST['website']), | |
| 1154 | + ClientFields::BUSINESS_CLIENT_NAME => $post_text('business_client_name'), | |
| 1155 | + ClientFields::EMAIL => sanitize_email(wp_unslash(($_POST['email'] ?? ''))), | |
| 1156 | + ClientFields::USERNAME => sanitize_user(wp_unslash(($_POST['username'] ?? ''))), | |
| 1157 | + ClientFields::PASSWORD => isset($_POST['password']) ? (string) wp_unslash($_POST['password']) : '', | |
| 1158 | + ClientFields::ADDRESS => $post_area('address'), | |
| 1159 | + ClientFields::EXTRA_INFO => $post_area('extra_info'), | |
| 1160 | + ClientFields::FIRST_NAME => $post_text('first_name'), | |
| 1161 | + ClientFields::LAST_NAME => $post_text('last_name'), | |
| 1162 | + ClientFields::WEBSITE => isset($_POST['website']) ? esc_url_raw(wp_unslash($_POST['website'])) : '', | |
| 1050 | 1163 | ClientFields::PHONE => isset($_POST['phone']) ? sanitize_text_field($_POST['phone']) : '', |
| 1051 | 1164 | ]; |
| 1052 | 1165 | |
| 1053 | 1166 | |
| @@ -1066,16 +1179,27 @@ | ||
| 1066 | 1179 | // Create new client |
| 1067 | 1180 | $client = $repository->create($client_data); |
| 1068 | 1181 | |
| 1069 | 1182 | if (!$client) { |
| 1070 | - $this->sendError(__('Failed to create client', 'easy-invoice')); | |
| 1183 | + $reason = method_exists($repository, 'getLastError') ? $repository->getLastError() : ''; | |
| 1184 | + $this->sendError($reason !== '' ? $reason : __('Failed to create client', 'easy-invoice')); | |
| 1071 | 1185 | } |
| 1072 | 1186 | |
| 1073 | 1187 | $client_id = $client->getId(); |
| 1074 | 1188 | |
| 1189 | + // Pull the WP role assigned during user creation. The | |
| 1190 | + // Clients-page row template needs this so the new-row badge | |
| 1191 | + // matches the role that will be re-rendered server-side on the | |
| 1192 | + // next page load. Without this, the JS template would have to | |
| 1193 | + // hardcode a role label and could drift from PHP's value. | |
| 1194 | + $user = get_user_by('id', $client_id); | |
| 1195 | + $role = ($user && !empty($user->roles)) ? (string) $user->roles[0] : 'customer'; | |
| 1196 | + | |
| 1075 | 1197 | $response_data = array( |
| 1076 | 1198 | 'message' => __('Client added successfully', 'easy-invoice'), |
| 1077 | 1199 | 'client_id' => $client_id, |
| 1200 | + 'role' => $role, | |
| 1201 | + 'role_label' => ucfirst($role), | |
| 1078 | 1202 | 'client' => $client->toArray(), |
| 1079 | 1203 | ); |
| 1080 | 1204 | |
| 1081 | 1205 | $this->sendSuccess($response_data); |
| @@ -1086,9 +1210,9 @@ | ||
| 1086 | 1210 | */ |
| 1087 | 1211 | public function updateClient() { |
| 1088 | 1212 | $this->verifyNonce('easy_invoice_nonce'); |
| 1089 | 1213 | |
| 1090 | - if (!current_user_can('manage_options')) { | |
| 1214 | + if (!easy_invoice_user_can('ei_manage_clients')) { | |
| 1091 | 1215 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 1092 | 1216 | } |
| 1093 | 1217 | |
| 1094 | 1218 | $client_id = isset($_POST['client_id']) ? intval($_POST['client_id']) : 0; |
| @@ -1098,18 +1222,18 @@ | ||
| 1098 | 1222 | } |
| 1099 | 1223 | |
| 1100 | 1224 | // Prepare client data |
| 1101 | 1225 | $client_data = [ |
| 1102 | - ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field($_POST['business_client_name']), | |
| 1103 | - ClientFields::EMAIL => sanitize_email($_POST['email']), | |
| 1104 | - ClientFields::USERNAME => sanitize_user($_POST['username']), | |
| 1105 | - ClientFields::PASSWORD => $_POST['password'], // Keep password as is, don't sanitize | |
| 1106 | - ClientFields::ADDRESS => sanitize_textarea_field($_POST['address']), | |
| 1226 | + ClientFields::BUSINESS_CLIENT_NAME => sanitize_text_field(($_POST['business_client_name'] ?? '')), | |
| 1227 | + ClientFields::EMAIL => sanitize_email(($_POST['email'] ?? '')), | |
| 1228 | + ClientFields::USERNAME => sanitize_user(($_POST['username'] ?? '')), | |
| 1229 | + ClientFields::PASSWORD => ($_POST['password'] ?? ''), // Keep password as is, don't sanitize | |
| 1230 | + ClientFields::ADDRESS => sanitize_textarea_field(($_POST['address'] ?? '')), | |
| 1107 | 1231 | ClientFields::PHONE => isset($_POST['phone']) ? sanitize_text_field($_POST['phone']) : '', |
| 1108 | - ClientFields::EXTRA_INFO => sanitize_textarea_field($_POST['extra_info']), | |
| 1109 | - ClientFields::FIRST_NAME => sanitize_text_field($_POST['first_name']), | |
| 1110 | - ClientFields::LAST_NAME => sanitize_text_field($_POST['last_name']), | |
| 1111 | - ClientFields::WEBSITE => esc_url_raw($_POST['website']) | |
| 1232 | + ClientFields::EXTRA_INFO => sanitize_textarea_field(($_POST['extra_info'] ?? '')), | |
| 1233 | + ClientFields::FIRST_NAME => sanitize_text_field(($_POST['first_name'] ?? '')), | |
| 1234 | + ClientFields::LAST_NAME => sanitize_text_field(($_POST['last_name'] ?? '')), | |
| 1235 | + ClientFields::WEBSITE => esc_url_raw(($_POST['website'] ?? '')) | |
| 1112 | 1236 | ]; |
| 1113 | 1237 | |
| 1114 | 1238 | // Remove empty values except password (password can be empty for updates) |
| 1115 | 1239 | $client_data = array_filter($client_data, function($value, $key) { |
| @@ -1144,8 +1268,9 @@ | ||
| 1144 | 1268 | */ |
| 1145 | 1269 | public function updateInvoicesData() { |
| 1146 | 1270 | $this->verifyNonce('easy_invoice_admin_nonce'); |
| 1147 | 1271 | |
| 1272 | + // Bulk migration / repair of invoice records — admin-only. | |
| 1148 | 1273 | if (!current_user_can('manage_options')) { |
| 1149 | 1274 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 1150 | 1275 | } |
| 1151 | 1276 | |
| @@ -1222,8 +1347,9 @@ | ||
| 1222 | 1347 | } |
| 1223 | 1348 | } |
| 1224 | 1349 | |
| 1225 | 1350 | $this->sendSuccess(array( |
| 1351 | + /* translators: %d: number updated. */ | |
| 1226 | 1352 | 'message' => sprintf(__('Updated %d invoices with missing data', 'easy-invoice'), $updated_count), |
| 1227 | 1353 | 'updated_count' => $updated_count |
| 1228 | 1354 | )); |
| 1229 | 1355 | } |
| @@ -1241,21 +1367,30 @@ | ||
| 1241 | 1367 | if (!$invoice_id) { |
| 1242 | 1368 | $this->sendError(__('Invalid invoice ID', 'easy-invoice')); |
| 1243 | 1369 | } |
| 1244 | 1370 | |
| 1245 | - // Get invoice from repository (only published invoices for public access) | |
| 1246 | 1371 | $repository = InvoiceServiceProvider::getInvoiceRepository(); |
| 1372 | + $invoice = $repository->find($invoice_id); | |
| 1247 | 1373 | |
| 1248 | - // For admins, allow access to any invoice status | |
| 1249 | - if (current_user_can('manage_options')) { | |
| 1250 | - $invoice = $repository->find($invoice_id); | |
| 1251 | - } else { | |
| 1252 | - // For non-admins, only allow access to published invoices | |
| 1253 | - $invoice = $repository->findPublished($invoice_id); | |
| 1374 | + if (!$invoice) { | |
| 1375 | + $this->sendError(__('Invoice not found', 'easy-invoice')); | |
| 1254 | 1376 | } |
| 1255 | 1377 | |
| 1256 | - if (!$invoice) { | |
| 1257 | - $this->sendError(__('Invoice not found', 'easy-invoice')); | |
| 1378 | + // Authorisation. | |
| 1379 | + // | |
| 1380 | + // This used to read: admins get find(), everyone else gets findPublished(). | |
| 1381 | + // That was not a check at all — Models\Invoice::save() writes every invoice | |
| 1382 | + // with post_status 'publish' regardless of its workflow status, so | |
| 1383 | + // findPublished() returned the same record find() would have, for anyone. | |
| 1384 | + // This endpoint is registered for wp_ajax_nopriv, so the effective gate was | |
| 1385 | + // the nonce alone and any caller holding one could pull the PDF data for an | |
| 1386 | + // arbitrary invoice id, including drafts. | |
| 1387 | + // | |
| 1388 | + // Uses the same helper as the rest of the plugin so there is a single | |
| 1389 | + // definition of who may see a document: valid ?ik= token, administrator, or | |
| 1390 | + // the logged-in client the invoice is bound to. | |
| 1391 | + if (!\EasyInvoice\Controllers\InvoiceController::canSubmitPaymentForInvoice($invoice_id, $invoice)) { | |
| 1392 | + $this->sendError(__('You do not have permission to access this invoice', 'easy-invoice')); | |
| 1258 | 1393 | } |
| 1259 | 1394 | |
| 1260 | 1395 | // Get invoice data for PDF generation |
| 1261 | 1396 | $invoice_data = \EasyInvoice\Includes\Helpers\PdfHelper::getInvoiceDataForPdf($invoice); |
| @@ -1267,9 +1402,12 @@ | ||
| 1267 | 1402 | 'invoice_data' => $invoice_data, |
| 1268 | 1403 | 'download_url' => add_query_arg(array( |
| 1269 | 1404 | 'action' => 'easy_invoice_generate_pdf', |
| 1270 | 1405 | 'invoice_id' => $invoice_id, |
| 1271 | - 'nonce' => wp_create_nonce('generate_pdf') | |
| 1406 | + // Bound to this invoice: an unscoped 'generate_pdf' nonce could be | |
| 1407 | + // taken from a document the caller may legitimately see and replayed | |
| 1408 | + // against any other invoice id. | |
| 1409 | + 'nonce' => wp_create_nonce('generate_pdf_' . $invoice_id) | |
| 1272 | 1410 | ), admin_url('admin-ajax.php')) |
| 1273 | 1411 | )); |
| 1274 | 1412 | } |
| 1275 | 1413 | |
| @@ -1287,19 +1425,21 @@ | ||
| 1287 | 1425 | } |
| 1288 | 1426 | |
| 1289 | 1427 | // Get invoice from repository (only published invoices for public access) |
| 1290 | 1428 | $repository = InvoiceServiceProvider::getInvoiceRepository(); |
| 1429 | + $invoice = $repository->find($invoice_id); | |
| 1291 | 1430 | |
| 1292 | - // For admins, allow access to any invoice status | |
| 1293 | - if (current_user_can('manage_options')) { | |
| 1294 | - $invoice = $repository->find($invoice_id); | |
| 1295 | - } else { | |
| 1296 | - // For non-admins, only allow access to published invoices | |
| 1297 | - $invoice = $repository->findPublished($invoice_id); | |
| 1431 | + if (!$invoice) { | |
| 1432 | + $this->sendError(__('Invoice not found', 'easy-invoice')); | |
| 1298 | 1433 | } |
| 1299 | 1434 | |
| 1300 | - if (!$invoice) { | |
| 1301 | - $this->sendError(__('Invoice not found', 'easy-invoice')); | |
| 1435 | + // Authorisation. The previous admin / findPublished() split was not a check: | |
| 1436 | + // every invoice is saved with post_status 'publish', so findPublished() | |
| 1437 | + // returned exactly what find() would, for any caller. This endpoint is | |
| 1438 | + // registered nopriv, so without this an unauthorised caller could make the | |
| 1439 | + // site email an arbitrary invoice out to its client. See downloadInvoicePdf(). | |
| 1440 | + if (!\EasyInvoice\Controllers\InvoiceController::canSubmitPaymentForInvoice($invoice_id, $invoice)) { | |
| 1441 | + $this->sendError(__('You do not have permission to access this invoice', 'easy-invoice')); | |
| 1302 | 1442 | } |
| 1303 | 1443 | |
| 1304 | 1444 | // Use EmailManager to send the email |
| 1305 | 1445 | $email_manager = \EasyInvoice\Services\EmailManager::getInstance(); |
| @@ -1326,17 +1466,18 @@ | ||
| 1326 | 1466 | $this->sendError(__('Invalid quote ID', 'easy-invoice')); |
| 1327 | 1467 | } |
| 1328 | 1468 | |
| 1329 | 1469 | $repository = \EasyInvoice\Providers\QuoteServiceProvider::getQuoteRepository(); |
| 1470 | + $quote = $repository->find($quote_id); | |
| 1330 | 1471 | |
| 1331 | - if (current_user_can('manage_options')) { | |
| 1332 | - $quote = $repository->find($quote_id); | |
| 1333 | - } else { | |
| 1334 | - $quote = $repository->findPublished($quote_id); | |
| 1472 | + if (!$quote) { | |
| 1473 | + $this->sendError(__('Quote not found', 'easy-invoice')); | |
| 1335 | 1474 | } |
| 1336 | 1475 | |
| 1337 | - if (!$quote) { | |
| 1338 | - $this->sendError(__('Quote not found', 'easy-invoice')); | |
| 1476 | + // Authorisation — same reasoning as the invoice path above. Quotes are also | |
| 1477 | + // always stored with post_status 'publish', so findPublished() gated nothing. | |
| 1478 | + if (!\EasyInvoice\Controllers\QuoteController::canActOnQuote($quote_id, $quote)) { | |
| 1479 | + $this->sendError(__('You do not have permission to access this quote', 'easy-invoice')); | |
| 1339 | 1480 | } |
| 1340 | 1481 | |
| 1341 | 1482 | $email_manager = \EasyInvoice\Services\EmailManager::getInstance(); |
| 1342 | 1483 | $result = $email_manager->sendQuoteEmail($quote, 'new'); |
| @@ -1356,10 +1497,18 @@ | ||
| 1356 | 1497 | /** |
| 1357 | 1498 | * Generate invoice PDF |
| 1358 | 1499 | */ |
| 1359 | 1500 | public function generateInvoicePdf() { |
| 1360 | - // Verify nonce | |
| 1361 | - $this->verifyNonce('generate_pdf'); | |
| 1501 | + // Explicitly bust intermediate caching on this admin-ajax URL. Some | |
| 1502 | + // page-caching stacks (WP Rocket, LiteSpeed, Cloudflare full-page | |
| 1503 | + // cache, some CDNs) will cache a 302 Location header keyed by URL — | |
| 1504 | + // the URL always looks the same to the cache because both the nonce | |
| 1505 | + // AND the target invoice-permalink change per user, so a first-hit | |
| 1506 | + // response can be replayed to other users, breaking the redirect or | |
| 1507 | + // returning a blank body. | |
| 1508 | + nocache_headers(); | |
| 1509 | + header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0'); | |
| 1510 | + header('Pragma: no-cache'); | |
| 1362 | 1511 | |
| 1363 | 1512 | // Get invoice ID |
| 1364 | 1513 | $invoice_id = isset($_REQUEST['invoice_id']) ? intval($_REQUEST['invoice_id']) : 0; |
| 1365 | 1514 | |
| @@ -1366,8 +1515,57 @@ | ||
| 1366 | 1515 | if (!$invoice_id) { |
| 1367 | 1516 | $this->sendError(__('Invalid invoice ID', 'easy-invoice')); |
| 1368 | 1517 | } |
| 1369 | 1518 | |
| 1519 | + // Authorisation with graceful fallback. | |
| 1520 | + // | |
| 1521 | + // The original design gated this endpoint on a per-request WP | |
| 1522 | + // nonce, which is fragile in real deployments: page-caching | |
| 1523 | + // layers (WP Rocket, LiteSpeed, Cloudflare full-page cache) | |
| 1524 | + // cache the intermediate JSON response that mints the URL, | |
| 1525 | + // browser SameSite / ITP behaviour, and admin_url() | |
| 1526 | + // scheme-mismatch after login can all cause wp_verify_nonce() | |
| 1527 | + // to return false on the intended recipient's tab — leaving | |
| 1528 | + // the user stranded on this admin-ajax URL with no download. | |
| 1529 | + // | |
| 1530 | + // Accept ANY of: | |
| 1531 | + // 1. A valid `generate_pdf` nonce (fast path — most users, | |
| 1532 | + // most of the time, when the session cookie survives). | |
| 1533 | + // 2. An admin session (manage_options) — bypasses the nonce | |
| 1534 | + // because the invoice-listing button that creates this | |
| 1535 | + // URL is admin-only and the admin owns the request. | |
| 1536 | + // 3. A valid per-invoice access token (?ik=<token>) — the | |
| 1537 | + // same model canSubmitPaymentForInvoice uses, so emailed | |
| 1538 | + // invoice links can also drive a session-less download. | |
| 1539 | + // Only when all three paths fail do we refuse. | |
| 1540 | + $authorized = false; | |
| 1541 | + | |
| 1542 | + // Match the same dual-key nonce lookup the removed verifyNonce() | |
| 1543 | + // helper did — `nonce` (client-form format used by our JS) AND | |
| 1544 | + // `_nonce` (standard WP form field name) — so any external | |
| 1545 | + // caller of this endpoint that used _nonce still works. | |
| 1546 | + $submitted_nonce = ''; | |
| 1547 | + if (isset($_REQUEST['nonce'])) { | |
| 1548 | + $submitted_nonce = (string) $_REQUEST['nonce']; | |
| 1549 | + } elseif (isset($_REQUEST['_nonce'])) { | |
| 1550 | + $submitted_nonce = (string) $_REQUEST['_nonce']; | |
| 1551 | + } | |
| 1552 | + if ($submitted_nonce !== '' && wp_verify_nonce($submitted_nonce, 'generate_pdf_' . $invoice_id)) { | |
| 1553 | + $authorized = true; | |
| 1554 | + } elseif (current_user_can('manage_options')) { | |
| 1555 | + $authorized = true; | |
| 1556 | + } elseif (isset($_REQUEST['ik']) && is_string($_REQUEST['ik'])) { | |
| 1557 | + $presented = sanitize_text_field(wp_unslash($_REQUEST['ik'])); | |
| 1558 | + $stored = (string) get_post_meta($invoice_id, '_easy_invoice_invoice_access_token', true); | |
| 1559 | + if ($stored !== '' && $presented !== '' && hash_equals($stored, $presented)) { | |
| 1560 | + $authorized = true; | |
| 1561 | + } | |
| 1562 | + } | |
| 1563 | + | |
| 1564 | + if (!$authorized) { | |
| 1565 | + $this->sendError(__('Security check failed', 'easy-invoice')); | |
| 1566 | + } | |
| 1567 | + | |
| 1370 | 1568 | // Get invoice from repository |
| 1371 | 1569 | $repository = InvoiceServiceProvider::getInvoiceRepository(); |
| 1372 | 1570 | |
| 1373 | 1571 | // For admins, allow access to any invoice status |
| @@ -1381,16 +1579,24 @@ | ||
| 1381 | 1579 | if (!$invoice) { |
| 1382 | 1580 | $this->sendError(__('Invoice not found', 'easy-invoice')); |
| 1383 | 1581 | } |
| 1384 | 1582 | |
| 1385 | - // Redirect to the invoice single page with PDF generation | |
| 1583 | + // Redirect to the invoice single page with PDF generation. | |
| 1584 | + // Forward the ?ik= access token onwards so the single-page | |
| 1585 | + // template can also authorise the recipient (the same token | |
| 1586 | + // that got us through Path 3 above). | |
| 1386 | 1587 | $invoice_url = get_permalink($invoice_id); |
| 1387 | - if ($invoice_url) { | |
| 1388 | - wp_redirect(add_query_arg('auto_download_pdf', '1', $invoice_url)); | |
| 1389 | - exit; | |
| 1390 | - } else { | |
| 1588 | + if (!$invoice_url) { | |
| 1391 | 1589 | $this->sendError(__('Could not generate invoice URL', 'easy-invoice')); |
| 1392 | 1590 | } |
| 1591 | + | |
| 1592 | + $target_args = ['auto_download_pdf' => '1']; | |
| 1593 | + if (isset($_REQUEST['ik']) && is_string($_REQUEST['ik']) && $_REQUEST['ik'] !== '') { | |
| 1594 | + $target_args['ik'] = sanitize_text_field(wp_unslash($_REQUEST['ik'])); | |
| 1595 | + } | |
| 1596 | + $target_url = add_query_arg($target_args, $invoice_url); | |
| 1597 | + | |
| 1598 | + $this->redirectWithFallback($target_url); | |
| 1393 | 1599 | } |
| 1394 | 1600 | |
| 1395 | 1601 | /** |
| 1396 | 1602 | * Generate quote PDF |
| @@ -1395,10 +1601,12 @@ | ||
| 1395 | 1601 | /** |
| 1396 | 1602 | * Generate quote PDF |
| 1397 | 1603 | */ |
| 1398 | 1604 | public function generateQuotePdf() { |
| 1399 | - // Verify nonce | |
| 1400 | - $this->verifyNonce('generate_quote_pdf'); | |
| 1605 | + // Same cache-busting as generateInvoicePdf — see comment there. | |
| 1606 | + nocache_headers(); | |
| 1607 | + header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0'); | |
| 1608 | + header('Pragma: no-cache'); | |
| 1401 | 1609 | |
| 1402 | 1610 | // Get quote ID |
| 1403 | 1611 | $quote_id = isset($_REQUEST['quote_id']) ? intval($_REQUEST['quote_id']) : 0; |
| 1404 | 1612 | |
| @@ -1405,8 +1613,45 @@ | ||
| 1405 | 1613 | if (!$quote_id) { |
| 1406 | 1614 | $this->sendError(__('Invalid quote ID', 'easy-invoice')); |
| 1407 | 1615 | } |
| 1408 | 1616 | |
| 1617 | + // Authorisation with graceful fallback. Same three-path model | |
| 1618 | + // as generateInvoicePdf — see that method's comment for the | |
| 1619 | + // full rationale (nonce fragility across caching layers, | |
| 1620 | + // cross-tab session cookie behaviour, etc.). Paths accepted: | |
| 1621 | + // | |
| 1622 | + // 1. Valid `generate_quote_pdf` nonce (fast path). | |
| 1623 | + // 2. Admin session (manage_options) — the quote-listing | |
| 1624 | + // button that mints this URL is admin-only. | |
| 1625 | + // 3. Valid per-quote access token (?qk=<token>) — mirrors | |
| 1626 | + // the CVE-2026-9021 model so emailed quote links can | |
| 1627 | + // drive a session-less PDF download. | |
| 1628 | + $authorized = false; | |
| 1629 | + | |
| 1630 | + // Same dual-key nonce lookup as the invoice handler — see | |
| 1631 | + // generateInvoicePdf for the backward-compat rationale. | |
| 1632 | + $submitted_nonce = ''; | |
| 1633 | + if (isset($_REQUEST['nonce'])) { | |
| 1634 | + $submitted_nonce = (string) $_REQUEST['nonce']; | |
| 1635 | + } elseif (isset($_REQUEST['_nonce'])) { | |
| 1636 | + $submitted_nonce = (string) $_REQUEST['_nonce']; | |
| 1637 | + } | |
| 1638 | + if ($submitted_nonce !== '' && wp_verify_nonce($submitted_nonce, 'generate_quote_pdf_' . $quote_id)) { | |
| 1639 | + $authorized = true; | |
| 1640 | + } elseif (current_user_can('manage_options')) { | |
| 1641 | + $authorized = true; | |
| 1642 | + } elseif (isset($_REQUEST['qk']) && is_string($_REQUEST['qk'])) { | |
| 1643 | + $presented = sanitize_text_field(wp_unslash($_REQUEST['qk'])); | |
| 1644 | + $stored = (string) get_post_meta($quote_id, '_easy_invoice_quote_access_token', true); | |
| 1645 | + if ($stored !== '' && $presented !== '' && hash_equals($stored, $presented)) { | |
| 1646 | + $authorized = true; | |
| 1647 | + } | |
| 1648 | + } | |
| 1649 | + | |
| 1650 | + if (!$authorized) { | |
| 1651 | + $this->sendError(__('Security check failed', 'easy-invoice')); | |
| 1652 | + } | |
| 1653 | + | |
| 1409 | 1654 | // Get quote from repository — mirror invoice PDF: only published quotes for non-admins (incl. nopriv). |
| 1410 | 1655 | $repository = \EasyInvoice\Providers\QuoteServiceProvider::getQuoteRepository(); |
| 1411 | 1656 | if (current_user_can('manage_options')) { |
| 1412 | 1657 | $quote = $repository->find($quote_id); |
| @@ -1417,16 +1662,62 @@ | ||
| 1417 | 1662 | if (!$quote) { |
| 1418 | 1663 | $this->sendError(__('Quote not found', 'easy-invoice')); |
| 1419 | 1664 | } |
| 1420 | 1665 | |
| 1421 | - // Redirect to the quote single page with PDF generation | |
| 1666 | + // Redirect to the quote single page with PDF generation. | |
| 1667 | + // Forward the ?qk= access token so the single-page template | |
| 1668 | + // can also authorise the recipient with the same key that | |
| 1669 | + // got us through Path 3. | |
| 1422 | 1670 | $quote_url = get_permalink($quote_id); |
| 1423 | - if ($quote_url) { | |
| 1424 | - wp_redirect(add_query_arg('auto_download_pdf', '1', $quote_url)); | |
| 1671 | + if (!$quote_url) { | |
| 1672 | + $this->sendError(__('Could not generate quote URL', 'easy-invoice')); | |
| 1673 | + } | |
| 1674 | + | |
| 1675 | + $target_args = ['auto_download_pdf' => '1']; | |
| 1676 | + if (isset($_REQUEST['qk']) && is_string($_REQUEST['qk']) && $_REQUEST['qk'] !== '') { | |
| 1677 | + $target_args['qk'] = sanitize_text_field(wp_unslash($_REQUEST['qk'])); | |
| 1678 | + } | |
| 1679 | + $target_url = add_query_arg($target_args, $quote_url); | |
| 1680 | + | |
| 1681 | + $this->redirectWithFallback($target_url); | |
| 1682 | + } | |
| 1683 | + | |
| 1684 | + /** | |
| 1685 | + * Redirect the current request to $url, with a client-side fallback | |
| 1686 | + * when the server-side redirect can't fire. | |
| 1687 | + * | |
| 1688 | + * `wp_safe_redirect()` silently no-ops if headers have already been sent | |
| 1689 | + * (BOM in a plugin file, plugin echoing during an action, PHP warning | |
| 1690 | + * output, etc.). Because we also `exit;` immediately after, that failure | |
| 1691 | + * mode produces a 200 OK with an empty body — the reported blank-page | |
| 1692 | + * bug on the invoice-listing PDF download. | |
| 1693 | + * | |
| 1694 | + * This helper detects the headers-sent case and emits a minimal HTML | |
| 1695 | + * document that redirects via meta-refresh (works with JS disabled) and | |
| 1696 | + * `window.location.replace()` (JS-enabled, doesn't add a history entry). | |
| 1697 | + * Both point at the same escaped URL so misconfigured stacks still get | |
| 1698 | + * the user to the target page. | |
| 1699 | + */ | |
| 1700 | + private function redirectWithFallback(string $url): void { | |
| 1701 | + // Suppress cache one more time in case some plugin filtered our | |
| 1702 | + // earlier headers away between then and now. | |
| 1703 | + nocache_headers(); | |
| 1704 | + | |
| 1705 | + if (!headers_sent()) { | |
| 1706 | + wp_safe_redirect($url); | |
| 1425 | 1707 | exit; |
| 1426 | - } else { | |
| 1427 | - $this->sendError(__('Could not generate quote URL', 'easy-invoice')); | |
| 1428 | 1708 | } |
| 1709 | + | |
| 1710 | + // Fallback: server-side redirect impossible. Emit a client-side one. | |
| 1711 | + $safe_url = esc_url_raw($url); | |
| 1712 | + echo '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">'; | |
| 1713 | + echo '<meta http-equiv="refresh" content="0; url=' . esc_attr($safe_url) . '">'; | |
| 1714 | + echo '<title>Redirecting…</title>'; | |
| 1715 | + echo '<script>window.location.replace(' . wp_json_encode($safe_url) . ');</script>'; | |
| 1716 | + echo '</head><body>'; | |
| 1717 | + echo '<p>Redirecting to <a href="' . esc_url($safe_url) . '">' . esc_html($safe_url) . '</a>…</p>'; | |
| 1718 | + echo '</body></html>'; | |
| 1719 | + exit; | |
| 1429 | 1720 | } |
| 1430 | 1721 | |
| 1431 | 1722 | /** |
| 1432 | 1723 | * Search clients for the dropdown |
| @@ -1433,9 +1724,9 @@ | ||
| 1433 | 1724 | */ |
| 1434 | 1725 | public function searchClients() { |
| 1435 | 1726 | $this->verifyNonce('easy_invoice_nonce'); |
| 1436 | 1727 | |
| 1437 | - if (!current_user_can('manage_options')) { | |
| 1728 | + if (!easy_invoice_user_can('ei_view_clients')) { | |
| 1438 | 1729 | $this->sendError(__('You do not have permission to perform this action', 'easy-invoice')); |
| 1439 | 1730 | } |
| 1440 | 1731 | |
| 1441 | 1732 | $query = isset($_POST['query']) ? sanitize_text_field($_POST['query']) : ''; |
| @@ -1445,10 +1736,26 @@ | ||
| 1445 | 1736 | |
| 1446 | 1737 | // Search clients |
| 1447 | 1738 | $clients = $client_repository->search($query); |
| 1448 | 1739 | |
| 1740 | + // Row-level security: restrict to assigned clients for Sales reps | |
| 1741 | + // (users with ei_view_clients but no ei_view_all_clients). Null | |
| 1742 | + // return = unrestricted, no-op. | |
| 1743 | + if (function_exists('easy_invoice_visible_client_ids')) { | |
| 1744 | + $visible = easy_invoice_visible_client_ids(); | |
| 1745 | + if (is_array($visible)) { | |
| 1746 | + $allowed = array_flip(array_map('intval', $visible)); | |
| 1747 | + $clients = array_values(array_filter($clients, static function ($c) use ($allowed) { | |
| 1748 | + return isset($allowed[(int) $c->getId()]); | |
| 1749 | + })); | |
| 1750 | + } | |
| 1751 | + } | |
| 1752 | + | |
| 1753 | + // Bypass $this->sendSuccess() — search is a read endpoint and | |
| 1754 | + // shouldn't show "Operation completed successfully" toasts on | |
| 1755 | + // every keystroke. Use wp_send_json_success directly. | |
| 1449 | 1756 | if (empty($clients)) { |
| 1450 | - $this->sendSuccess(array()); | |
| 1757 | + wp_send_json_success(array()); | |
| 1451 | 1758 | } |
| 1452 | 1759 | |
| 1453 | 1760 | // Format clients for dropdown |
| 1454 | 1761 | $formatted_clients = array(); |
| @@ -1485,9 +1792,9 @@ | ||
| 1485 | 1792 | 'display_name' => $client_name . ' (' . $email . ')' |
| 1486 | 1793 | ); |
| 1487 | 1794 | } |
| 1488 | 1795 | |
| 1489 | - $this->sendSuccess($formatted_clients); | |
| 1796 | + wp_send_json_success($formatted_clients); | |
| 1490 | 1797 | } |
| 1491 | 1798 | |
| 1492 | 1799 | /** |
| 1493 | 1800 | * Save additional CSS for invoice/quote |
| @@ -1493,9 +1800,9 @@ | ||
| 1493 | 1800 | * Save additional CSS for invoice/quote |
| 1494 | 1801 | */ |
| 1495 | 1802 | public function saveAdditionalCSS() { |
| 1496 | 1803 | // Verify nonce |
| 1497 | - if (!wp_verify_nonce($_POST['nonce'], 'save_additional_css_nonce')) { | |
| 1804 | + if (!wp_verify_nonce(($_POST['nonce'] ?? ''), 'save_additional_css_nonce')) { | |
| 1498 | 1805 | $this->sendError('Security check failed'); |
| 1499 | 1806 | return; |
| 1500 | 1807 | } |
| 1501 | 1808 | |
