The Events Calendar Community Events plugin is required but not active.
You must be logged in to edit events.
'; - } - - // Check capabilities - if (!current_user_can('hvac_trainer')) { - return 'You do not have permission to edit events.
Editing Event ID: - Full control over all fields including excerpt.
-The Events Calendar Community Events plugin is required but not active.
No event specified. Please select an event to edit.
-You must be logged in to access event management.
You do not have permission to manage events.
Event Management Unavailable
+The event management system requires The Events Calendar Community Events plugin to be active.
+You must be logged in to edit events.
You do not have permission to edit events.
Event Editing Unavailable
+The event editing system requires The Events Calendar Community Events plugin to be active.
+You do not have permission to edit this event.
Editing Event ID: ' . esc_html($event_id) . '
No event specified. Please select an event to edit.
+ +Event Submission Form Unavailable
-The event submission form is currently unavailable. Please ensure:
-You must be a trainer to view this page.
'; } @@ -105,7 +106,7 @@ class HVAC_Organizers { $current_user_id = get_current_user_id(); // Get pagination parameters - $page = isset($_GET['paged']) ? max(1, intval($_GET['paged'])) : 1; + $page = max(1, HVAC_Security_Helpers::get_input('GET', 'paged', 'absint', 1)); $per_page = 20; $offset = ($page - 1) * $per_page; @@ -120,13 +121,15 @@ class HVAC_Organizers { ); // Master trainers can see all organizers, regular trainers only see their own - if (!current_user_can('hvac_master_trainer') && !current_user_can('manage_options')) { + $user = wp_get_current_user(); + if (!in_array('hvac_master_trainer', $user->roles) && !current_user_can('manage_options')) { $query_args['author'] = $current_user_id; } // Filter handling - if (!empty($_GET['search'])) { - $query_args['s'] = sanitize_text_field($_GET['search']); + $search = HVAC_Security_Helpers::get_input('GET', 'search', 'sanitize_text_field', ''); + if (!empty($search)) { + $query_args['s'] = $search; } // Get organizers @@ -142,7 +145,7 @@ class HVAC_Organizers {You must be a trainer to view this page.
'; } - $organizer_id = isset($_GET['organizer_id']) ? intval($_GET['organizer_id']) : 0; + $organizer_id = HVAC_Security_Helpers::get_input('GET', 'organizer_id', 'absint', 0); $organizer = null; if ($organizer_id) { @@ -279,7 +283,7 @@ class HVAC_Organizers { ?>Recommended size: 300x300px. Maximum file size: 2MB.
' . esc_html($errors['transient']) . '
'; - // Nonce errors should ideally be caught in admin-post, but display if somehow set - if (!empty($errors['nonce'])) echo '' . esc_html($errors['nonce']) . '
'; -// error_log('[HVAC REG DEBUG] render_registration_form: Errors before display_form_html: ' . print_r($errors, true)); - if (!empty($errors['account'])) echo '' . esc_html($errors['account']) . '
'; - echo 'By submitting this form, you will be creating an account in the Upskill HVAC online event system. Once approved, you will be able to login to the trainer portal to manage your profile and event listings.
- - - -Please log in to edit your profile.
'; - } - - // We don't need to do anything here since the template file already handles the form rendering - // Just set up the shortcode to point to the template - ob_start(); - include HVAC_PLUGIN_DIR . 'templates/template-edit-profile.php'; - return ob_get_clean(); - } - - /** - * Process profile update submission from the edit profile form - */ - public function process_profile_update() { - // Only logged-in users can update profiles - if (!is_user_logged_in()) { - wp_redirect(home_url('/community-login/')); - exit; - } - - $user_id = get_current_user_id(); - $user = get_userdata($user_id); - $errors = []; - $submitted_data = $_POST; - $profile_page_url = home_url('/edit-profile/'); - - // Verify nonce - if (!isset($_POST['hvac_profile_nonce']) || !wp_verify_nonce($_POST['hvac_profile_nonce'], 'hvac_update_profile')) { - $errors['nonce'] = 'Security check failed. Please try submitting the form again.'; - - $this->redirect_with_profile_errors($errors, $profile_page_url); - // No need for return/exit here, redirect_with_errors exits. - } - - // File Upload Handling - $profile_image_data = null; - if (isset($_FILES['profile_image']) && $_FILES['profile_image']['error'] !== UPLOAD_ERR_NO_FILE) { - if ($_FILES['profile_image']['error'] === UPLOAD_ERR_OK) { - // Check if it's actually an uploaded file - if (!is_uploaded_file($_FILES['profile_image']['tmp_name'])) { - $errors['profile_image'] = 'File upload error (invalid temp file).'; - - } else { - $allowed_types = ['image/jpeg', 'image/png', 'image/gif']; - $finfo = finfo_open(FILEINFO_MIME_TYPE); - $mime_type = finfo_file($finfo, $_FILES['profile_image']['tmp_name']); - finfo_close($finfo); - - if (!in_array($mime_type, $allowed_types)) { - $errors['profile_image'] = 'Invalid file type detected (' . esc_html($mime_type) . '). Please upload a JPG, PNG, or GIF.'; - - } else { - $profile_image_data = $_FILES['profile_image']; // Store the whole $_FILES entry - - } - } - } else { - $errors['profile_image'] = 'There was an error uploading the profile image. Code: ' . $_FILES['profile_image']['error']; - - } - } - - // Validate form data - $validation_errors = $this->validate_profile_update($submitted_data, $user); - $errors = array_merge($errors, $validation_errors); - - // Process if no errors - if (empty($errors)) { - - $update_success = $this->update_user_profile($user_id, $submitted_data, $profile_image_data); - - if (is_wp_error($update_success)) { - $errors['account'] = $update_success->get_error_message(); -// error_log('[HVAC PROFILE DEBUG] Profile update WP_Error: ' . $update_success->get_error_message()); - $this->redirect_with_profile_errors($errors, $profile_page_url); - } elseif ($update_success) { - - // Redirect to the profile page with success message - wp_safe_redirect(add_query_arg('updated', '1', $profile_page_url)); - exit; - } else { - $errors['account'] = 'An unknown error occurred during profile update. Please try again.'; - - $this->redirect_with_profile_errors($errors, $profile_page_url); - } - } else { -// error_log('[HVAC PROFILE DEBUG] Validation errors found in profile update: ' . print_r($errors, true)); - $this->redirect_with_profile_errors($errors, $profile_page_url); - } - } - - /** - * Helper function to store profile errors in transient and redirect back to the form page. - * - * @param array $errors Array of error messages. - * @param string $redirect_url The URL to redirect back to. - */ - private function redirect_with_profile_errors($errors, $redirect_url) { - $transient_id = uniqid(); // Generate unique ID for transient key - $transient_key = self::PROFILE_TRANSIENT_PREFIX . $transient_id; - $transient_data = [ - 'errors' => $errors, - ]; - // Store for 5 minutes - set_transient($transient_key, $transient_data, MINUTE_IN_SECONDS * 5); - - // Add query arguments to the redirect URL - $redirect_url = add_query_arg([ - 'prof_error' => '1', - 'tid' => $transient_id, - ], $redirect_url); - - wp_safe_redirect($redirect_url); - exit; // Stop execution after redirect - } - - /** - * Validate profile update data - * - * @param array $data Submitted form data ($_POST). - * @param WP_User $user Current user object. - * @return array Array of errors, empty if valid. - */ - public function validate_profile_update($data, $user) { - - $errors = array(); - - // Required field validation - $required_fields = [ - 'first_name' => 'First Name', - 'last_name' => 'Last Name', - 'display_name' => 'Display Name', - 'user_email' => 'Email', - 'description' => 'Biographical Info', - 'business_name' => 'Business Name', - 'business_phone' => 'Business Phone', - 'business_email' => 'Business Email', - 'business_description' => 'Business Description', - 'user_country' => 'Country', - 'user_state' => 'State/Province', - 'user_city' => 'City', - 'user_zip' => 'Zip/Postal Code', - 'business_type' => 'Business Type', - ]; - - foreach ($required_fields as $field => $label) { - // Use trim to catch spaces-only input - if (empty($data[$field]) || trim($data[$field]) === '') { - $errors[$field] = $label . ' is required.'; - } - } - - // Required checkbox groups - $required_checkboxes = [ - 'training_audience' => 'Training Audience', - 'training_formats' => 'Training Formats', - 'training_locations' => 'Training Locations', - 'training_resources' => 'Training Resources', - ]; - foreach ($required_checkboxes as $field => $label) { - // Check if the key exists and is a non-empty array - if (empty($data[$field]) || !is_array($data[$field])) { - $errors[$field] = 'Please select at least one option for ' . $label . '.'; - } - } - - // Email validation - if (!empty($data['user_email']) && !is_email($data['user_email'])) { - $errors['user_email'] = 'Please enter a valid email address.'; - } - if (!empty($data['business_email']) && !is_email($data['business_email'])) { - $errors['business_email'] = 'Please enter a valid business email address.'; - } - - // Email exists validation (only if email is changed and valid) - if (empty($errors['user_email']) && !empty($data['user_email']) && $data['user_email'] !== $user->user_email && email_exists($data['user_email'])) { - $errors['user_email'] = 'This email address is already registered to another account.'; - } - - // URL validation (optional fields) - if (!empty($data['user_url']) && !filter_var($data['user_url'], FILTER_VALIDATE_URL)) { - $errors['user_url'] = 'Please enter a valid URL for your personal website.'; - } - if (!empty($data['user_linkedin']) && !filter_var($data['user_linkedin'], FILTER_VALIDATE_URL)) { - $errors['user_linkedin'] = 'Please enter a valid URL for your LinkedIn profile.'; - } - if (!empty($data['business_website']) && !filter_var($data['business_website'], FILTER_VALIDATE_URL)) { - $errors['business_website'] = 'Please enter a valid URL for your business website.'; - } - - // State/Province 'Other' validation - if (!empty($data['user_country'])) { - if ($data['user_country'] !== 'United States' && $data['user_country'] !== 'Canada') { - // If country is not US/CA, state *must* be 'Other' - if (empty($data['user_state']) || $data['user_state'] !== 'Other') { - $errors['user_state'] = 'Please select "Other" for State/Province if your country is not US or Canada.'; - } elseif (empty($data['user_state_other']) || trim($data['user_state_other']) === '') { - // If state is 'Other', the text input must not be empty - $errors['user_state_other'] = 'Please enter your state/province.'; - } - } elseif (!empty($data['user_state'])) { - // If country is US/CA - if ($data['user_state'] === 'Other') { - // State cannot be 'Other' if country is US/CA - $errors['user_state'] = 'Please select your state/province from the list.'; - } - } - } - - // Password validation (only if user is attempting to change password) - if (!empty($data['current_password']) || !empty($data['new_password']) || !empty($data['confirm_new_password'])) { - // Verify current password - if (empty($data['current_password'])) { - $errors['current_password'] = 'Please enter your current password.'; - } elseif (!wp_check_password($data['current_password'], $user->user_pass, $user->ID)) { - $errors['current_password'] = 'Current password is incorrect.'; - } - - // Validate new password - if (empty($data['new_password'])) { - $errors['new_password'] = 'Please enter a new password.'; - } elseif (strlen($data['new_password']) < 8) { - $errors['new_password'] = 'Password must be at least 8 characters long.'; - } elseif (!preg_match('/[A-Z]/', $data['new_password'])) { - $errors['new_password'] = 'Password must contain at least one uppercase letter.'; - } elseif (!preg_match('/[a-z]/', $data['new_password'])) { - $errors['new_password'] = 'Password must contain at least one lowercase letter.'; - } elseif (!preg_match('/[0-9]/', $data['new_password'])) { - $errors['new_password'] = 'Password must contain at least one number.'; - } - - // Confirm new password - if (empty($data['confirm_new_password'])) { - $errors['confirm_new_password'] = 'Please confirm your new password.'; - } elseif ($data['new_password'] !== $data['confirm_new_password']) { - $errors['confirm_new_password'] = 'New passwords do not match.'; - } - } - -// error_log('[HVAC PROFILE DEBUG] validate_profile_update: Validation result - ' . (empty($errors) ? 'VALID' : 'INVALID')); - return $errors; - } - - /** - * Update the user profile with submitted data - * - * @param int $user_id The user ID to update. - * @param array $data The submitted form data. - * @param array|null $profile_image_data The profile image file data, if any. - * @return bool|WP_Error True on success, WP_Error on failure. - */ - private function update_user_profile($user_id, $data, $profile_image_data = null) { - // Sanitize and prepare user data for update - $userdata = array( - 'ID' => $user_id, - 'first_name' => sanitize_text_field($data['first_name']), - 'last_name' => sanitize_text_field($data['last_name']), - 'display_name' => sanitize_text_field($data['display_name']), - 'user_email' => sanitize_email($data['user_email']), - 'user_url' => !empty($data['user_url']) ? esc_url_raw($data['user_url']) : '', - 'description' => wp_kses_post($data['description']), - ); - - // Handle password update if provided - if (!empty($data['new_password']) && !empty($data['current_password']) && !empty($data['confirm_new_password'])) { - $userdata['user_pass'] = $data['new_password']; // wp_update_user will hash the password - } - - // Update user data - $update_result = wp_update_user($userdata); - - if (is_wp_error($update_result)) { -// error_log('[HVAC PROFILE DEBUG] wp_update_user failed: ' . $update_result->get_error_message()); - return $update_result; - } - - // Update user meta - $meta_fields = [ - 'user_linkedin' => !empty($data['user_linkedin']) ? esc_url_raw($data['user_linkedin']) : '', - 'personal_accreditation' => !empty($data['personal_accreditation']) ? sanitize_text_field($data['personal_accreditation']) : '', - 'business_name' => sanitize_text_field($data['business_name']), - 'business_phone' => sanitize_text_field($data['business_phone']), - 'business_email' => sanitize_email($data['business_email']), - 'business_website' => !empty($data['business_website']) ? esc_url_raw($data['business_website']) : '', - 'business_description' => wp_kses_post($data['business_description']), - 'user_country' => sanitize_text_field($data['user_country']), - 'user_state' => ($data['user_state'] === 'Other' && isset($data['user_state_other'])) ? sanitize_text_field($data['user_state_other']) : sanitize_text_field($data['user_state']), - 'user_city' => sanitize_text_field($data['user_city']), - 'user_zip' => sanitize_text_field($data['user_zip']), - 'business_type' => sanitize_text_field($data['business_type']), - 'training_audience' => (!empty($data['training_audience']) && is_array($data['training_audience'])) ? array_map('sanitize_text_field', $data['training_audience']) : [], - 'training_formats' => (!empty($data['training_formats']) && is_array($data['training_formats'])) ? array_map('sanitize_text_field', $data['training_formats']) : [], - 'training_locations' => (!empty($data['training_locations']) && is_array($data['training_locations'])) ? array_map('sanitize_text_field', $data['training_locations']) : [], - 'training_resources' => (!empty($data['training_resources']) && is_array($data['training_resources'])) ? array_map('sanitize_text_field', $data['training_resources']) : [], - 'annual_revenue_target' => !empty($data['annual_revenue_target']) ? intval($data['annual_revenue_target']) : '', - ]; - - foreach ($meta_fields as $key => $value) { - update_user_meta($user_id, $key, $value); - } - - // Handle profile image upload if provided - if ($profile_image_data) { - - // We don't need the return value here unless we want to report specific upload errors - $this->handle_profile_image_upload($user_id, $profile_image_data); - } - - // Update organizer profile if it exists - $organizer_id = get_user_meta($user_id, 'hvac_organizer_id', true); - if ($organizer_id && get_post_type($organizer_id) === Tribe__Events__Main::ORGANIZER_POST_TYPE) { - - $this->create_organizer_profile($user_id, $meta_fields); - } - - // Update venue profile if it exists - $venue_id = get_user_meta($user_id, 'hvac_venue_id', true); - if ($venue_id && get_post_type($venue_id) === Tribe__Events__Main::VENUE_POST_TYPE) { - - $this->create_training_venue($user_id, $meta_fields); - } - - return true; - } - - /** - * Get list of countries (simplified) - */ - private function get_country_list() { - // In a real application, use a more comprehensive list or library - return array( - 'US' => 'United States', - 'CA' => 'Canada', - // Add more countries as needed - 'GB' => 'United Kingdom', - 'AU' => 'Australia', - // ... - ); - } - /** - * Get list of US states - */ - private function get_us_states() { - // Use state abbreviations as keys if preferred by JS/validation - return array( - 'AL' => 'Alabama', 'AK' => 'Alaska', 'AZ' => 'Arizona', 'AR' => 'Arkansas', 'CA' => 'California', - 'CO' => 'Colorado', 'CT' => 'Connecticut', 'DE' => 'Delaware', 'DC' => 'District of Columbia', 'FL' => 'Florida', - 'GA' => 'Georgia', 'HI' => 'Hawaii', 'ID' => 'Idaho', 'IL' => 'Illinois', 'IN' => 'Indiana', - 'IA' => 'Iowa', 'KS' => 'Kansas', 'KY' => 'Kentucky', 'LA' => 'Louisiana', 'ME' => 'Maine', - 'MD' => 'Maryland', 'MA' => 'Massachusetts', 'MI' => 'Michigan', 'MN' => 'Minnesota', 'MS' => 'Mississippi', - 'MO' => 'Missouri', 'MT' => 'Montana', 'NE' => 'Nebraska', 'NV' => 'Nevada', 'NH' => 'New Hampshire', - 'NJ' => 'New Jersey', 'NM' => 'New Mexico', 'NY' => 'New York', 'NC' => 'North Carolina', 'ND' => 'North Dakota', - 'OH' => 'Ohio', 'OK' => 'Oklahoma', 'OR' => 'Oregon', 'PA' => 'Pennsylvania', 'RI' => 'Rhode Island', - 'SC' => 'South Carolina', 'SD' => 'South Dakota', 'TN' => 'Tennessee', 'TX' => 'Texas', 'UT' => 'Utah', - 'VT' => 'Vermont', 'VA' => 'Virginia', 'WA' => 'Washington', 'WV' => 'West Virginia', 'WI' => 'Wisconsin', - 'WY' => 'Wyoming' - ); - } - - /** - * Get list of Canadian provinces - */ - private function get_canadian_provinces() { - // Use province abbreviations as keys if preferred by JS/validation - return array( - 'AB' => 'Alberta', 'BC' => 'British Columbia', 'MB' => 'Manitoba', 'NB' => 'New Brunswick', - 'NL' => 'Newfoundland and Labrador', 'NS' => 'Nova Scotia', 'ON' => 'Ontario', 'PE' => 'Prince Edward Island', - 'QC' => 'Quebec', 'SK' => 'Saskatchewan', 'NT' => 'Northwest Territories', 'NU' => 'Nunavut', 'YT' => 'Yukon' - ); - } - -} // End class HVAC_Registration \ No newline at end of file diff --git a/includes/class-hvac-registration.php b/includes/class-hvac-registration.php index 789431c4..4543a575 100644 --- a/includes/class-hvac-registration.php +++ b/includes/class-hvac-registration.php @@ -44,9 +44,12 @@ class HVAC_Registration { $transient_key = null; // Check if redirected back with errors - if (isset($_GET['reg_error']) && $_GET['reg_error'] === '1' && isset($_GET['tid'])) { + $reg_error = HVAC_Security_Helpers::get_input('GET', 'reg_error', 'sanitize_text_field', ''); + $tid = HVAC_Security_Helpers::get_input('GET', 'tid', 'sanitize_key', ''); + + if ($reg_error === '1' && !empty($tid)) { - $transient_key = self::TRANSIENT_PREFIX . sanitize_key($_GET['tid']); + $transient_key = self::TRANSIENT_PREFIX . $tid; $transient_data = get_transient($transient_key); if ($transient_data && is_array($transient_data)) { @@ -93,10 +96,11 @@ class HVAC_Registration { $errors = []; $submitted_data = $_POST; // Capture submitted data early for potential repopulation + // TODO: Replace with HVAC_Security_Helpers::get_input() for individual fields $registration_page_url = home_url('/trainer/registration/'); // Updated to hierarchical URL // --- Verify Nonce --- - if (!isset($_POST['hvac_registration_nonce']) || !wp_verify_nonce($_POST['hvac_registration_nonce'], 'hvac_trainer_registration')) { + if (!HVAC_Security_Helpers::verify_nonce('hvac_trainer_registration', 'hvac_registration_nonce', 'POST')) { $errors['nonce'] = 'Security check failed. Please try submitting the form again.'; $this->redirect_with_errors($errors, $submitted_data, $registration_page_url); @@ -106,73 +110,30 @@ class HVAC_Registration { // --- File Upload Handling --- $profile_image_data = null; if (isset($_FILES['profile_image']) && $_FILES['profile_image']['error'] !== UPLOAD_ERR_NO_FILE) { - if ($_FILES['profile_image']['error'] === UPLOAD_ERR_OK) { - // Check if it's actually an uploaded file - if (!is_uploaded_file($_FILES['profile_image']['tmp_name'])) { - $errors['profile_image'] = 'File upload error (invalid temp file).'; - } else { - // Security: Check file size (max 5MB for profile images) - $max_file_size = 5 * 1024 * 1024; // 5MB - if ($_FILES['profile_image']['size'] > $max_file_size) { - $errors['profile_image'] = 'Profile image is too large. Maximum size is 5MB.'; - } else { - $allowed_types = ['image/jpeg', 'image/png', 'image/gif']; - // Use wp_check_filetype on the actual file name for extension check - // Use finfo_file or getimagesize on tmp_name for actual MIME type check for better security - $finfo = finfo_open(FILEINFO_MIME_TYPE); - $mime_type = finfo_file($finfo, $_FILES['profile_image']['tmp_name']); - finfo_close($finfo); - - if (!in_array($mime_type, $allowed_types)) { - $errors['profile_image'] = 'Invalid file type detected (' . esc_html($mime_type) . '). Please upload a JPG, PNG, or GIF.'; - } else { - // Additional security: Verify image dimensions using getimagesize - $image_info = getimagesize($_FILES['profile_image']['tmp_name']); - if ($image_info === false) { - $errors['profile_image'] = 'Invalid image file detected.'; - } else { - $profile_image_data = $_FILES['profile_image']; // Store the whole $_FILES entry - } - } - } - } + $allowed_types = ['image/jpeg', 'image/png', 'image/gif']; + $max_size = 5 * 1024 * 1024; // 5MB + + $validation_result = HVAC_Security_Helpers::validate_file_upload($_FILES['profile_image'], $allowed_types, $max_size); + + if (is_wp_error($validation_result)) { + $errors['profile_image'] = $validation_result->get_error_message(); } else { - $errors['profile_image'] = 'There was an error uploading the profile image. Code: ' . $_FILES['profile_image']['error']; + $profile_image_data = $_FILES['profile_image']; } } // Handle Organization Logo Upload $org_logo_data = null; if (isset($_FILES['org_logo']) && $_FILES['org_logo']['error'] !== UPLOAD_ERR_NO_FILE) { - if ($_FILES['org_logo']['error'] === UPLOAD_ERR_OK) { - if (!is_uploaded_file($_FILES['org_logo']['tmp_name'])) { - $errors['org_logo'] = 'File upload error (invalid temp file).'; - } else { - // Security: Check file size (max 2MB for logos) - $max_file_size = 2 * 1024 * 1024; // 2MB - if ($_FILES['org_logo']['size'] > $max_file_size) { - $errors['org_logo'] = 'Organization logo is too large. Maximum size is 2MB.'; - } else { - $allowed_types = ['image/jpeg', 'image/png', 'image/gif']; - $finfo = finfo_open(FILEINFO_MIME_TYPE); - $mime_type = finfo_file($finfo, $_FILES['org_logo']['tmp_name']); - finfo_close($finfo); - - if (!in_array($mime_type, $allowed_types)) { - $errors['org_logo'] = 'Invalid file type detected (' . esc_html($mime_type) . '). Please upload a JPG, PNG, or GIF.'; - } else { - // Additional security: Verify image dimensions using getimagesize - $image_info = getimagesize($_FILES['org_logo']['tmp_name']); - if ($image_info === false) { - $errors['org_logo'] = 'Invalid image file detected.'; - } else { - $org_logo_data = $_FILES['org_logo']; - } - } - } - } + $allowed_types = ['image/jpeg', 'image/png', 'image/gif']; + $max_size = 2 * 1024 * 1024; // 2MB + + $validation_result = HVAC_Security_Helpers::validate_file_upload($_FILES['org_logo'], $allowed_types, $max_size); + + if (is_wp_error($validation_result)) { + $errors['org_logo'] = $validation_result->get_error_message(); } else { - $errors['org_logo'] = 'There was an error uploading the organization logo. Code: ' . $_FILES['org_logo']['error']; + $org_logo_data = $_FILES['org_logo']; } } // --- End File Upload Handling --- @@ -1339,7 +1300,7 @@ class HVAC_Registration { $profile_page_url = home_url('/trainer/profile/edit/'); // Verify nonce - if (!isset($_POST['hvac_profile_nonce']) || !wp_verify_nonce($_POST['hvac_profile_nonce'], 'hvac_update_profile')) { + if (!HVAC_Security_Helpers::verify_nonce('hvac_update_profile', 'hvac_profile_nonce', 'POST')) { $errors['nonce'] = 'Security check failed. Please try submitting the form again.'; $this->redirect_with_profile_errors($errors, $profile_page_url); diff --git a/includes/class-hvac-scripts-styles.php b/includes/class-hvac-scripts-styles.php index 6951ddda..8aaa5006 100644 --- a/includes/class-hvac-scripts-styles.php +++ b/includes/class-hvac-scripts-styles.php @@ -96,15 +96,10 @@ class HVAC_Scripts_Styles { * @return void */ private function init_hooks() { - // Safari-specific resource loading bypass - if ($this->is_safari_browser()) { - add_action('wp_enqueue_scripts', array($this, 'enqueue_safari_minimal_assets'), 5); - // Prevent other components from loading excessive resources - add_action('wp_enqueue_scripts', array($this, 'disable_non_critical_assets'), 999); - } else { - // Frontend scripts and styles for non-Safari browsers - add_action('wp_enqueue_scripts', array($this, 'enqueue_frontend_assets')); - } + // Use consolidated CSS for all browsers now that foreign files are removed + add_action('wp_enqueue_scripts', array($this, 'enqueue_frontend_assets')); + + // No longer need Safari-specific bypass since we're using consolidated CSS // Admin scripts and styles add_action('admin_enqueue_scripts', array($this, 'enqueue_admin_assets')); @@ -125,24 +120,26 @@ class HVAC_Scripts_Styles { } if (defined('WP_DEBUG') && WP_DEBUG) { - error_log('[HVAC Scripts Styles] Loading Safari minimal assets bypass'); + error_log('[HVAC Scripts Styles] Loading Safari optimized consolidated assets'); } - // Load only ONE consolidated CSS file to prevent cascade + // Load consolidated core CSS - single file instead of 15+ wp_enqueue_style( - 'hvac-safari-minimal', - HVAC_PLUGIN_URL . 'assets/css/hvac-community-events.css', + 'hvac-consolidated-core', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-core.css', array(), $this->version ); - // Add mobile navigation fix - wp_enqueue_style( - 'hvac-mobile-nav-fix', - HVAC_PLUGIN_URL . 'assets/css/hvac-mobile-navigation-fix.css', - array('hvac-safari-minimal'), - $this->version - ); + // Load page-specific consolidated bundle based on context + if ($this->is_dashboard_page() || $this->is_event_manage_page()) { + wp_enqueue_style( + 'hvac-consolidated-dashboard', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-dashboard.css', + array('hvac-consolidated-core'), + $this->version + ); + } // Load minimal JavaScript wp_enqueue_script( @@ -281,15 +278,157 @@ class HVAC_Scripts_Styles { * @return void */ private function enqueue_consolidated_css() { + // Always load core bundle wp_enqueue_style( - 'hvac-consolidated', - HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated.css', + 'hvac-consolidated-core', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-core.css', array(), $this->version ); - // Still load page-specific CSS for special cases - $this->enqueue_page_specific_css(); + // Load dashboard bundle for dashboard/management pages + if ($this->is_dashboard_page() || $this->is_event_manage_page()) { + wp_enqueue_style( + 'hvac-consolidated-dashboard', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-dashboard.css', + array('hvac-consolidated-core'), + $this->version + ); + } + + // Load forms bundle for registration/profile pages + if ($this->is_registration_page() || $this->is_trainer_profile_page() || + $this->is_organizers_page() || $this->is_venues_page()) { + wp_enqueue_style( + 'hvac-consolidated-forms', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-forms.css', + array('hvac-consolidated-core'), + $this->version + ); + } + + // Load certificates bundle for certificate pages + if ($this->is_certificate_page()) { + wp_enqueue_style( + 'hvac-consolidated-certificates', + HVAC_PLUGIN_URL . 'assets/css/hvac-consolidated-certificates.css', + array('hvac-consolidated-core'), + $this->version + ); + } + + // Note: page-specific JavaScript is still enqueued separately + $this->enqueue_page_specific_scripts(); + } + + /** + * Enqueue page-specific JavaScript + * + * @return void + */ + private function enqueue_page_specific_scripts() { + // Main plugin scripts + wp_enqueue_script( + 'hvac-community-events', + HVAC_PLUGIN_URL . 'assets/js/hvac-community-events.js', + array('jquery'), + $this->version, + true + ); + + // Mobile responsive functionality + wp_enqueue_script( + 'hvac-mobile-responsive', + HVAC_PLUGIN_URL . 'assets/js/hvac-mobile-responsive.js', + array('jquery', 'hvac-community-events'), + $this->version, + true + ); + + // Dashboard scripts + if ($this->is_dashboard_page()) { + wp_enqueue_script( + 'hvac-dashboard', + HVAC_PLUGIN_URL . 'assets/js/hvac-dashboard.js', + array('jquery', 'hvac-community-events'), + $this->version, + true + ); + + wp_enqueue_script( + 'hvac-dashboard-enhanced', + HVAC_PLUGIN_URL . 'assets/js/hvac-dashboard-enhanced.js', + array('hvac-dashboard'), + $this->version, + true + ); + } + + // Registration scripts + if ($this->is_registration_page()) { + wp_enqueue_script( + 'hvac-registration', + $this->get_compatible_script_path('hvac-registration'), + array('jquery', 'hvac-community-events'), + $this->version, + true + ); + } + + // Trainer profile scripts + if ($this->is_trainer_profile_page()) { + wp_enqueue_script( + 'hvac-profile-sharing', + HVAC_PLUGIN_URL . 'assets/js/hvac-profile-sharing.js', + array('jquery', 'hvac-community-events'), + $this->version, + true + ); + } + + // Help system scripts + wp_enqueue_script( + 'hvac-help-system', + HVAC_PLUGIN_URL . 'assets/js/hvac-help-system.js', + array('jquery'), + $this->version, + true + ); + + // Localize scripts + wp_localize_script('hvac-community-events', 'hvac_ajax', array( + 'ajax_url' => admin_url('admin-ajax.php'), + 'nonce' => wp_create_nonce('hvac_ajax_nonce'), + 'is_logged_in' => is_user_logged_in(), + 'plugin_url' => HVAC_PLUGIN_URL, + )); + + // Localize dashboard script + if ($this->is_dashboard_page()) { + wp_localize_script('hvac-dashboard', 'hvac_dashboard', array( + 'ajax_url' => admin_url('admin-ajax.php'), + 'nonce' => wp_create_nonce('hvac_dashboard_nonce'), + 'strings' => array( + 'loading' => __('Loading...', 'hvac-community-events'), + 'error' => __('An error occurred. Please try again.', 'hvac-community-events'), + ), + )); + } + + // Localize profile sharing script + if ($this->is_trainer_profile_page()) { + wp_localize_script('hvac-profile-sharing', 'hvac_sharing', array( + 'ajax_url' => admin_url('admin-ajax.php'), + 'nonce' => wp_create_nonce('hvac_profile_sharing'), + 'strings' => array( + 'loading' => __('Loading...', 'hvac-community-events'), + 'error' => __('An error occurred. Please try again.', 'hvac-community-events'), + 'copied' => __('Copied to clipboard!', 'hvac-community-events'), + 'copy_error' => __('Unable to copy. Please select and copy manually.', 'hvac-community-events'), + 'loading_error' => __('Unable to load profile card. Please try again.', 'hvac-community-events') + ), + )); + } } /** diff --git a/includes/class-hvac-security-helpers.php b/includes/class-hvac-security-helpers.php new file mode 100644 index 00000000..3db06234 --- /dev/null +++ b/includes/class-hvac-security-helpers.php @@ -0,0 +1,336 @@ +roles) || + in_array('hvac_master_trainer', $user->roles) || + user_can($user, 'manage_options'); + } + + /** + * Check if user has HVAC master trainer role + * + * @param int|null $user_id User ID (null for current user) + * @return bool + */ + public static function is_hvac_master_trainer($user_id = null) { + $user = $user_id ? get_user_by('id', $user_id) : wp_get_current_user(); + if (!$user) { + return false; + } + + return in_array('hvac_master_trainer', $user->roles) || + user_can($user, 'manage_options'); + } + + /** + * Sanitize and validate superglobal input + * + * @param string $type 'GET', 'POST', 'REQUEST', 'COOKIE', 'SERVER' + * @param string $key The key to retrieve + * @param string $sanitize Sanitization function to use + * @param mixed $default Default value if not set + * @return mixed Sanitized value + */ + public static function get_input($type, $key, $sanitize = 'sanitize_text_field', $default = '') { + $superglobal = null; + + switch (strtoupper($type)) { + case 'GET': + $superglobal = $_GET; + break; + case 'POST': + $superglobal = $_POST; + break; + case 'REQUEST': + $superglobal = $_REQUEST; + break; + case 'COOKIE': + $superglobal = $_COOKIE; + break; + case 'SERVER': + $superglobal = $_SERVER; + break; + default: + return $default; + } + + if (!isset($superglobal[$key])) { + return $default; + } + + $value = $superglobal[$key]; + + // Handle arrays + if (is_array($value)) { + return array_map($sanitize, $value); + } + + // Apply sanitization + switch ($sanitize) { + case 'absint': + return absint($value); + case 'intval': + return intval($value); + case 'sanitize_email': + return sanitize_email($value); + case 'sanitize_url': + case 'esc_url_raw': + return esc_url_raw($value); + case 'sanitize_text_field': + return sanitize_text_field($value); + case 'sanitize_textarea_field': + return sanitize_textarea_field($value); + case 'wp_kses_post': + return wp_kses_post($value); + case 'none': + return $value; // Use with extreme caution + default: + return sanitize_text_field($value); + } + } + + /** + * Validate file upload + * + * @param array $file $_FILES array element + * @param array $allowed_types Allowed MIME types + * @param int $max_size Maximum file size in bytes + * @return bool|WP_Error True if valid, WP_Error on failure + */ + public static function validate_file_upload($file, $allowed_types = array(), $max_size = 5242880) { + // Check if file was uploaded + if (!isset($file) || $file['error'] !== UPLOAD_ERR_OK) { + return new WP_Error('upload_error', 'File upload failed'); + } + + // Security check + if (!is_uploaded_file($file['tmp_name'])) { + return new WP_Error('security_error', 'Invalid file upload'); + } + + // Check file size + if ($file['size'] > $max_size) { + return new WP_Error('size_error', sprintf('File too large. Maximum size is %s', size_format($max_size))); + } + + // Check file type + if (!empty($allowed_types)) { + $file_type = wp_check_filetype($file['name']); + if (!in_array($file_type['type'], $allowed_types)) { + return new WP_Error('type_error', 'Invalid file type'); + } + } + + return true; + } + + /** + * Generate secure nonce field + * + * @param string $action Nonce action + * @param string $name Nonce field name + * @return string HTML nonce field + */ + public static function nonce_field($action, $name = '_wpnonce') { + return wp_nonce_field($action, $name, true, false); + } + + /** + * Verify nonce from request + * + * @param string $action Nonce action + * @param string $name Nonce field name + * @param string $type Request type (GET, POST) + * @return bool + */ + public static function verify_nonce($action, $name = '_wpnonce', $type = 'POST') { + $nonce = self::get_input($type, $name, 'sanitize_text_field', ''); + return wp_verify_nonce($nonce, $action); + } + + /** + * Check AJAX referer with proper error handling + * + * @param string $action Nonce action + * @param string $query_arg Nonce query argument + * @return bool + */ + public static function check_ajax_nonce($action, $query_arg = 'nonce') { + if (!check_ajax_referer($action, $query_arg, false)) { + wp_send_json_error('Security check failed'); + return false; + } + return true; + } + + /** + * Escape output based on context + * + * @param mixed $data Data to escape + * @param string $context Context: 'html', 'attr', 'url', 'js', 'textarea' + * @return string Escaped data + */ + public static function escape($data, $context = 'html') { + if (is_array($data) || is_object($data)) { + return ''; + } + + switch ($context) { + case 'html': + return esc_html($data); + case 'attr': + return esc_attr($data); + case 'url': + return esc_url($data); + case 'js': + return esc_js($data); + case 'textarea': + return esc_textarea($data); + default: + return esc_html($data); + } + } + + /** + * Validate and sanitize email + * + * @param string $email Email address + * @return string|false Sanitized email or false if invalid + */ + public static function validate_email($email) { + $email = sanitize_email($email); + return is_email($email) ? $email : false; + } + + /** + * Add security headers + */ + public static function add_security_headers() { + // Content Security Policy + header("Content-Security-Policy: default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'"); + + // X-Frame-Options + header("X-Frame-Options: SAMEORIGIN"); + + // X-Content-Type-Options + header("X-Content-Type-Options: nosniff"); + + // X-XSS-Protection + header("X-XSS-Protection: 1; mode=block"); + + // Referrer Policy + header("Referrer-Policy: strict-origin-when-cross-origin"); + } + + /** + * Rate limiting check + * + * @param string $action Action identifier + * @param int $max_attempts Maximum attempts allowed + * @param int $window Time window in seconds + * @return bool True if allowed, false if rate limited + */ + public static function check_rate_limit($action, $max_attempts = 5, $window = 60) { + $user_id = get_current_user_id(); + $ip = self::get_client_ip(); + $key = 'hvac_rate_limit_' . md5($action . '_' . $user_id . '_' . $ip); + + $attempts = get_transient($key); + + if ($attempts === false) { + set_transient($key, 1, $window); + return true; + } + + if ($attempts >= $max_attempts) { + return false; + } + + set_transient($key, $attempts + 1, $window); + return true; + } + + /** + * Get client IP address + * + * @return string + */ + public static function get_client_ip() { + $ip_keys = array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR'); + + foreach ($ip_keys as $key) { + if (array_key_exists($key, $_SERVER) === true) { + $ips = explode(',', $_SERVER[$key]); + foreach ($ips as $ip) { + $ip = trim($ip); + if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) { + return $ip; + } + } + } + } + + return isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '0.0.0.0'; + } + + /** + * Log security events + * + * @param string $event Event type + * @param array $data Event data + */ + public static function log_security_event($event, $data = array()) { + $log_data = array( + 'event' => $event, + 'timestamp' => current_time('mysql'), + 'user_id' => get_current_user_id(), + 'ip' => self::get_client_ip(), + 'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '', + 'data' => $data + ); + + // Log to database or file + error_log('[HVAC Security] ' . json_encode($log_data)); + + // You can also save to database if needed + if (defined('HVAC_SECURITY_LOG_TO_DB') && HVAC_SECURITY_LOG_TO_DB) { + global $wpdb; + $table = $wpdb->prefix . 'hvac_security_log'; + $wpdb->insert($table, array( + 'event_type' => $event, + 'event_data' => json_encode($data), + 'user_id' => get_current_user_id(), + 'ip_address' => self::get_client_ip(), + 'created_at' => current_time('mysql') + )); + } + } +} \ No newline at end of file diff --git a/includes/class-hvac-settings-refactored.php b/includes/class-hvac-settings-refactored.php deleted file mode 100644 index 5e0526fb..00000000 --- a/includes/class-hvac-settings-refactored.php +++ /dev/null @@ -1,411 +0,0 @@ -set_defaults(); - add_action( 'admin_menu', array( $this, 'add_settings_page' ) ); - add_action( 'admin_init', array( $this, 'register_settings' ) ); - } - - /** - * Set default settings - */ - private function set_defaults() { - $this->defaults = array( - 'general' => array( - 'debug_mode' => false, - 'cache_duration' => 300, - 'enable_notifications' => true, - ), - 'registration' => array( - 'auto_approve' => false, - 'require_venue' => false, - 'email_verification' => true, - 'terms_url' => '', - ), - 'dashboard' => array( - 'items_per_page' => 20, - 'show_revenue' => true, - 'show_capacity' => true, - 'date_format' => 'Y-m-d', - ), - 'notifications' => array( - 'admin_email' => get_option( 'admin_email' ), - 'from_email' => get_option( 'admin_email' ), - 'from_name' => get_option( 'blogname' ), - ), - 'advanced' => array( - 'uninstall_data' => false, - 'legacy_support' => false, - ), - ); - } - - /** - * Get all settings - * - * @return array - */ - public function get_settings() { - if ( null === $this->settings ) { - $this->settings = get_option( $this->option_name, array() ); - $this->settings = wp_parse_args( $this->settings, $this->defaults ); - } - return $this->settings; - } - - /** - * Get a specific setting - * - * @param string $section Setting section - * @param string $key Setting key - * @param mixed $default Default value if not set - * @return mixed - */ - public function get( $section, $key, $default = null ) { - $settings = $this->get_settings(); - - if ( isset( $settings[ $section ][ $key ] ) ) { - return $settings[ $section ][ $key ]; - } - - if ( null !== $default ) { - return $default; - } - - return isset( $this->defaults[ $section ][ $key ] ) - ? $this->defaults[ $section ][ $key ] - : null; - } - - /** - * Update a setting - * - * @param string $section Setting section - * @param string $key Setting key - * @param mixed $value New value - * @return bool - */ - public function update( $section, $key, $value ) { - $settings = $this->get_settings(); - - if ( ! isset( $settings[ $section ] ) ) { - $settings[ $section ] = array(); - } - - $settings[ $section ][ $key ] = $value; - $this->settings = $settings; - - return update_option( $this->option_name, $settings ); - } - - /** - * Add settings page to admin menu - */ - public function add_settings_page() { - add_options_page( - __( 'HVAC Community Events Settings', 'hvac-community-events' ), - __( 'HVAC Events', 'hvac-community-events' ), - 'manage_options', - $this->page_slug, - array( $this, 'render_settings_page' ) - ); - } - - /** - * Register settings - */ - public function register_settings() { - register_setting( - $this->settings_group, - $this->option_name, - array( $this, 'sanitize_settings' ) - ); - - // General Settings Section - add_settings_section( - 'hvac_ce_general', - __( 'General Settings', 'hvac-community-events' ), - array( $this, 'render_section_general' ), - $this->page_slug - ); - - add_settings_field( - 'debug_mode', - __( 'Debug Mode', 'hvac-community-events' ), - array( $this, 'render_field_checkbox' ), - $this->page_slug, - 'hvac_ce_general', - array( - 'label_for' => 'debug_mode', - 'section' => 'general', - 'key' => 'debug_mode', - 'description' => __( 'Enable debug logging', 'hvac-community-events' ), - ) - ); - - add_settings_field( - 'cache_duration', - __( 'Cache Duration', 'hvac-community-events' ), - array( $this, 'render_field_number' ), - $this->page_slug, - 'hvac_ce_general', - array( - 'label_for' => 'cache_duration', - 'section' => 'general', - 'key' => 'cache_duration', - 'description' => __( 'Cache duration in seconds', 'hvac-community-events' ), - 'min' => 60, - 'max' => 3600, - ) - ); - - // Registration Settings Section - add_settings_section( - 'hvac_ce_registration', - __( 'Registration Settings', 'hvac-community-events' ), - array( $this, 'render_section_registration' ), - $this->page_slug - ); - - add_settings_field( - 'auto_approve', - __( 'Auto Approve', 'hvac-community-events' ), - array( $this, 'render_field_checkbox' ), - $this->page_slug, - 'hvac_ce_registration', - array( - 'label_for' => 'auto_approve', - 'section' => 'registration', - 'key' => 'auto_approve', - 'description' => __( 'Automatically approve new trainer registrations', 'hvac-community-events' ), - ) - ); - - // Add more sections and fields as needed - } - - /** - * Render settings page - */ - public function render_settings_page() { - if ( ! current_user_can( 'manage_options' ) ) { - return; - } - - // Show success message if settings were saved - if ( isset( $_GET['settings-updated'] ) ) { - add_settings_error( - 'hvac_ce_settings', - 'hvac_ce_settings_message', - __( 'Settings saved.', 'hvac-community-events' ), - 'updated' - ); - } - - settings_errors( 'hvac_ce_settings' ); - ?> -' . __( 'Configure trainer registration settings.', 'hvac-community-events' ) . '
'; - } - - /** - * Render checkbox field - * - * @param array $args Field arguments - */ - public function render_field_checkbox( $args ) { - $value = $this->get( $args['section'], $args['key'] ); - ?> - - /> - - - get( $args['section'], $args['key'] ); - ?> - - - - get( $args['section'], $args['key'] ); - ?> - - - - ! empty( $input['general']['debug_mode'] ), - 'cache_duration' => absint( $input['general']['cache_duration'] ?? 300 ), - 'enable_notifications' => ! empty( $input['general']['enable_notifications'] ), - ); - - // Update debug mode in logger - HVAC_Logger::set_enabled( $sanitized['general']['debug_mode'] ); - } - - // Registration settings - if ( isset( $input['registration'] ) ) { - $sanitized['registration'] = array( - 'auto_approve' => ! empty( $input['registration']['auto_approve'] ), - 'require_venue' => ! empty( $input['registration']['require_venue'] ), - 'email_verification' => ! empty( $input['registration']['email_verification'] ), - 'terms_url' => esc_url_raw( $input['registration']['terms_url'] ?? '' ), - ); - } - - // Dashboard settings - if ( isset( $input['dashboard'] ) ) { - $sanitized['dashboard'] = array( - 'items_per_page' => absint( $input['dashboard']['items_per_page'] ?? 20 ), - 'show_revenue' => ! empty( $input['dashboard']['show_revenue'] ), - 'show_capacity' => ! empty( $input['dashboard']['show_capacity'] ), - 'date_format' => sanitize_text_field( $input['dashboard']['date_format'] ?? 'Y-m-d' ), - ); - } - - // Merge with existing settings to preserve sections not being updated - $existing = $this->get_settings(); - $sanitized = wp_parse_args( $sanitized, $existing ); - - return $sanitized; - } - - /** - * Get instance of settings class (singleton) - * - * @return self - */ - public static function get_instance() { - static $instance = null; - - if ( null === $instance ) { - $instance = new self(); - } - - return $instance; - } -} \ No newline at end of file diff --git a/includes/class-hvac-training-leads.php b/includes/class-hvac-training-leads.php index acbc4667..7306e767 100644 --- a/includes/class-hvac-training-leads.php +++ b/includes/class-hvac-training-leads.php @@ -62,7 +62,8 @@ class HVAC_Training_Leads { } // Check user capabilities - if (!current_user_can('hvac_trainer') && !current_user_can('hvac_master_trainer') && !current_user_can('manage_options')) { + $user = wp_get_current_user(); + if (!in_array('hvac_trainer', $user->roles) && !in_array('hvac_master_trainer', $user->roles) && !current_user_can('manage_options')) { return 'You do not have permission to view this page.
'; } @@ -654,12 +655,13 @@ class HVAC_Training_Leads { public function ajax_update_lead_status() { check_ajax_referer('hvac_ajax_nonce', 'nonce'); - if (!is_user_logged_in() || !current_user_can('hvac_trainer')) { + $user = wp_get_current_user(); + if (!is_user_logged_in() || (!in_array('hvac_trainer', $user->roles) && !in_array('hvac_master_trainer', $user->roles) && !current_user_can('manage_options'))) { wp_send_json_error(['message' => 'Unauthorized']); } - $lead_id = intval($_POST['lead_id'] ?? 0); - $status = sanitize_text_field($_POST['status'] ?? ''); + $lead_id = isset($_POST['lead_id']) ? absint($_POST['lead_id']) : 0; + $status = isset($_POST['status']) ? sanitize_text_field($_POST['status']) : ''; if (!$lead_id || !$status) { wp_send_json_error(['message' => 'Invalid parameters']); @@ -689,11 +691,12 @@ class HVAC_Training_Leads { public function ajax_mark_lead_replied() { check_ajax_referer('hvac_ajax_nonce', 'nonce'); - if (!is_user_logged_in() || !current_user_can('hvac_trainer')) { + $user = wp_get_current_user(); + if (!is_user_logged_in() || (!in_array('hvac_trainer', $user->roles) && !in_array('hvac_master_trainer', $user->roles) && !current_user_can('manage_options'))) { wp_send_json_error(['message' => 'Unauthorized']); } - $lead_id = intval($_POST['lead_id'] ?? 0); + $lead_id = isset($_POST['lead_id']) ? absint($_POST['lead_id']) : 0; if (!$lead_id) { wp_send_json_error(['message' => 'Invalid lead ID']); diff --git a/includes/class-hvac-venues.php b/includes/class-hvac-venues.php index b69984db..9f480655 100644 --- a/includes/class-hvac-venues.php +++ b/includes/class-hvac-venues.php @@ -68,7 +68,7 @@ class HVAC_Venues { } // Allow trainers, master trainers, or WordPress admins - if (!current_user_can('hvac_trainer') && !current_user_can('hvac_master_trainer') && !current_user_can('manage_options')) { + if (!HVAC_Security_Helpers::is_hvac_trainer() && !current_user_can('manage_options')) { return 'You must be a trainer to view this page.
'; } @@ -102,7 +102,7 @@ class HVAC_Venues { $current_user_id = get_current_user_id(); // Get pagination parameters - $page = isset($_GET['paged']) ? max(1, intval($_GET['paged'])) : 1; + $page = max(1, HVAC_Security_Helpers::get_input('GET', 'paged', 'absint', 1)); $per_page = 20; $offset = ($page - 1) * $per_page; @@ -117,15 +117,17 @@ class HVAC_Venues { ); // Filter handling - if (!empty($_GET['search'])) { - $query_args['s'] = sanitize_text_field($_GET['search']); + $search = HVAC_Security_Helpers::get_input('GET', 'search', 'sanitize_text_field', ''); + if (!empty($search)) { + $query_args['s'] = $search; } - if (!empty($_GET['state'])) { + $state = HVAC_Security_Helpers::get_input('GET', 'state', 'sanitize_text_field', ''); + if (!empty($state)) { $query_args['meta_query'] = array( array( 'key' => '_VenueState', - 'value' => sanitize_text_field($_GET['state']), + 'value' => $state, 'compare' => '=' ) ); @@ -144,7 +146,7 @@ class HVAC_Venues {