| | |
| | | * @param string $nonceName nonce name to check |
| | | * @param string|null $nonce optional additional nonce to check |
| | | * |
| | | * @return void|WP_Error |
| | | */ |
| | | public function verifyNonce(WP_REST_Request $request, string $nonceName = 'wp_rest', string|null $nonce = null):mixed |
| | | { |
| | | * @return bool|WP_Error |
| | | */ |
| | | public function verifyNonce(WP_REST_Request $request, string $nonceName = 'wp_rest', string|null $nonce = null): bool|WP_Error |
| | | { |
| | | $nonce = (!is_null($nonce)) ? $nonce : $request->get_header('X-WP-Nonce'); |
| | | |
| | | if (!wp_verify_nonce($nonce, $nonceName)) { |
| | |
| | | * |
| | | * @return bool|WP_Error Whether or not we can proceed |
| | | */ |
| | | public function checkPermission(WP_REST_Request $request):bool |
| | | public function checkPermission(WP_REST_Request $request):bool|WP_Error |
| | | { |
| | | // Check rate limits first |
| | | if (!$this->rate_limiter->checkLimit($request)) { |
| | |
| | | return false; |
| | | } |
| | | // Verify nonces |
| | | $this->verifyNonce($request, 'wp_rest'); |
| | | $this->verifyNonce($request); |
| | | if ($this->action!=='') { |
| | | $this->verifyNonce($request, $this->action . $user_id, $request->get_header('action_nonce')); |
| | | } |
| | |
| | | } |
| | | |
| | | // ========== HTTP CACHING METHODS ========== |
| | | |
| | | /** |
| | | * Check HTTP caching headers (ETag and If-Modified-Since) |
| | | * Returns 304 Not Modified if content hasn't changed |
| | | * |
| | | * @param WP_REST_Request $request The REST request |
| | | * @param string|array $content_types Content type(s) to check timestamps for |
| | | * @param array $additional_params Additional params for ETag uniqueness (e.g., user_id, filters) |
| | | * @return WP_REST_Response|null Returns 304 response if not modified, null to continue processing |
| | | * @param WP_REST_Request $request |
| | | * @param int|string|array $key Content type(s) to check timestamps for |
| | | * @param string|array $group Additional params for ETag uniqueness (e.g., user_id, filters) |
| | | * @return WP_REST_Response|false Returns 304 response if not modified, null to continue processing |
| | | */ |
| | | protected function checkHeaders( |
| | | WP_REST_Request $request, |
| | |
| | | $context, |
| | | 'info' |
| | | ); |
| | | } catch (\Exception $e) { |
| | | } catch (Exception $e) { |
| | | // Fallback to error_log if handler fails |
| | | error_log("Security Audit: {$event} - " . json_encode($context)); |
| | | } |