upskill-event-manager/docs/SECURITY-FIXES.md

🔒 HVAC Plugin Security Fixes Documentation

Executive Summary

A comprehensive security audit revealed 200+ vulnerabilities across 90 of 134 PHP files (67% of codebase). This document details the security fixes implemented and provides guidance for ongoing security maintenance.

🔴 Critical Security Issues Fixed

1. Input Validation & Sanitization (90+ files affected)

Problem: Direct access to superglobals without sanitization

// ❌ VULNERABLE CODE
$page = $_GET['paged'];
$organizer_id = $_POST['organizer_id'];

Solution: Proper sanitization and validation

// ✅ SECURE CODE
$page = isset($_GET['paged']) ? absint($_GET['paged']) : 1;
$organizer_id = isset($_POST['organizer_id']) ? absint($_POST['organizer_id']) : 0;

2. Broken Access Control (50+ instances)

Problem: Incorrect capability checks using custom roles

// ❌ WRONG - Custom roles are NOT capabilities
if (!current_user_can('hvac_trainer')) {
    wp_die('Access denied');
}

Solution: Proper role checking

// ✅ CORRECT - Check user roles properly
$user = wp_get_current_user();
if (!in_array('hvac_trainer', $user->roles)) {
    wp_die('Access denied');
}

3. CSRF Protection (20+ forms)

Problem: Missing nonce verification in AJAX handlers

// ❌ VULNERABLE - No CSRF protection
public function ajax_save_data() {
    $data = $_POST['data'];
    // Process data...
}

Solution: Add nonce verification

// ✅ SECURE - CSRF protection added
public function ajax_save_data() {
    check_ajax_referer('hvac_ajax_nonce', 'nonce');
    $data = sanitize_text_field($_POST['data']);
    // Process data...
}

4. XSS Prevention (30+ templates)

Problem: Unescaped output

// ❌ VULNERABLE
echo $user_input;
echo $_GET['search'];

Solution: Proper output escaping

// ✅ SECURE
echo esc_html($user_input);
echo esc_attr($_GET['search']);

5. File Upload Security

Problem: Insufficient validation

// ❌ VULNERABLE
if ($_FILES['file']) {
    move_uploaded_file($_FILES['file']['tmp_name'], $destination);
}

Solution: Comprehensive validation

// ✅ SECURE
if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
    // Validate file type
    $allowed_types = array('image/jpeg', 'image/png');
    $file_type = wp_check_filetype($_FILES['file']['name']);
    
    if (!in_array($file_type['type'], $allowed_types)) {
        wp_die('Invalid file type');
    }
    
    // Validate file size (5MB max)
    if ($_FILES['file']['size'] > 5242880) {
        wp_die('File too large');
    }
    
    // Security check
    if (!is_uploaded_file($_FILES['file']['tmp_name'])) {
        wp_die('Security error');
    }
    
    // Use WordPress media handler
    $attachment_id = media_handle_upload('file', 0);
}

6. Deployment Security

Problem: Plaintext passwords in deployment scripts

# ❌ INSECURE
sshpass -p "$SSH_PASS" ssh user@server

Solution: SSH key authentication

# ✅ SECURE
ssh user@server  # Uses SSH keys

📋 Security Helper Class

Created class-hvac-security-helpers.php with centralized security functions:

// Check user roles properly
if (HVAC_Security_Helpers::is_hvac_trainer()) {
    // User has trainer role
}

// Get sanitized input
$page = HVAC_Security_Helpers::get_input('GET', 'page', 'absint', 1);
$email = HVAC_Security_Helpers::get_input('POST', 'email', 'sanitize_email');

// Validate file uploads
$validation = HVAC_Security_Helpers::validate_file_upload(
    $_FILES['logo'],
    array('image/jpeg', 'image/png'),
    5242880 // 5MB
);

// Rate limiting
if (!HVAC_Security_Helpers::check_rate_limit('contact_form', 5, 60)) {
    wp_die('Too many requests. Please try again later.');
}

// Escape output
echo HVAC_Security_Helpers::escape($data, 'html');

🛠️ Implementation Guide

Phase 1: Critical Fixes (Immediate)

1. ✅ Fix AJAX handlers in class-hvac-organizers.php
2. ✅ Fix AJAX handlers in class-hvac-training-leads.php
3. ✅ Create security helper class
4. ✅ Create secure deployment script

Phase 2: High Priority (Within 24 hours)

1. ⏳ Fix all incorrect capability checks
2. ⏳ Add nonce verification to all forms
3. ⏳ Sanitize all superglobal access
4. ⏳ Add output escaping to templates

Phase 3: Medium Priority (Within 1 week)

1. ⏳ Implement rate limiting
2. ⏳ Add security headers
3. ⏳ Enhance logging
4. ⏳ Security audit automation

🔧 Using the Security Helper Class

Include the helper class:

require_once HVAC_PLUGIN_DIR . 'includes/class-hvac-security-helpers.php';

Examples:

Role Checking

// Instead of this:
if (!current_user_can('hvac_trainer')) { }

// Use this:
if (!HVAC_Security_Helpers::is_hvac_trainer()) { }

Input Sanitization

// Instead of this:
$id = $_GET['id'];

// Use this:
$id = HVAC_Security_Helpers::get_input('GET', 'id', 'absint', 0);

AJAX Security

public function ajax_handler() {
    // Check nonce
    if (!HVAC_Security_Helpers::check_ajax_nonce('hvac_ajax_nonce')) {
        return;
    }
    
    // Check rate limit
    if (!HVAC_Security_Helpers::check_rate_limit('ajax_action', 10, 60)) {
        wp_send_json_error('Rate limit exceeded');
    }
    
    // Get sanitized input
    $data = HVAC_Security_Helpers::get_input('POST', 'data', 'sanitize_text_field');
    
    // Process...
}

🚀 Deployment Security

Setting up SSH Key Authentication

1. Generate SSH key (if you don't have one):

ssh-keygen -t ed25519 -C "your_email@example.com"

2. Copy public key to server:

ssh-copy-id user@staging-server.com
ssh-copy-id user@production-server.com

3. Test connection:

ssh user@staging-server.com

4. Use secure deployment script:

./scripts/deploy-secure.sh staging
./scripts/deploy-secure.sh production  # Requires double confirmation

📊 Security Checklist

For Every New Feature:

• Sanitize all input ($_GET, $_POST, $_REQUEST, $_COOKIE)
• Add nonce verification to forms and AJAX
• Check user permissions properly (roles, not capabilities)
• Escape all output (esc_html, esc_attr, esc_url)
• Validate file uploads (type, size, source)
• Implement rate limiting for sensitive operations
• Log security events
• Test for SQL injection
• Test for XSS vulnerabilities
• Review error messages (don't leak sensitive info)

Code Review Questions:

1. Is user input sanitized?
2. Is output escaped?
3. Are nonces verified?
4. Are permissions checked correctly?
5. Are file uploads validated?
6. Is sensitive data encrypted?
7. Are errors handled securely?
8. Is rate limiting implemented?

🔍 Testing Security Fixes

Manual Testing:

1. Try SQL injection in forms
2. Try XSS in input fields
3. Try CSRF attacks
4. Try unauthorized access
5. Try large file uploads
6. Try rapid form submissions

Automated Testing:

# Run security scanner
wp plugin install wordfence --activate
wp wordfence scan

# Check for vulnerabilities
wp plugin install sucuri-scanner --activate
wp sucuri scan

📈 Monitoring & Maintenance

Security Headers

Add to .htaccess:

# Security Headers
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin-when-cross-origin"

Regular Audits

1. Weekly: Review error logs
2. Monthly: Run security scans
3. Quarterly: Full security audit
4. Annually: Penetration testing

🚨 Incident Response

If a security issue is discovered:

1. Assess the vulnerability
2. Contain the issue (disable feature if needed)
3. Fix the vulnerability
4. Test the fix thoroughly
5. Deploy using secure deployment script
6. Monitor for exploitation attempts
7. Document lessons learned

📚 Resources

• WordPress Security Best Practices
• OWASP Top 10
• WordPress Coding Standards
• WordPress Security White Paper

🏆 Security Achievements

Completed:

• ✅ Created security helper class
• ✅ Fixed critical AJAX handlers
• ✅ Implemented secure deployment
• ✅ Added file upload validation
• ✅ Fixed role checking in 3 files

In Progress:

• 🔄 Fixing remaining capability checks
• 🔄 Adding nonce verification site-wide
• 🔄 Implementing rate limiting
• 🔄 Adding security headers

Pending:

• ⏳ Complete input sanitization (87 files remaining)
• ⏳ Complete output escaping (27 files remaining)
• ⏳ Security logging implementation
• ⏳ Automated security testing

---

Last Updated: December 2024 Security Lead: HVAC Development Team Next Review: January 2025