| | |
| | | * @param string $nonceName nonce name to check |
| | | * @param string|null $nonce optional additional nonce to check |
| | | * |
| | | * @return void|WP_Error |
| | | */ |
| | | public function verifyNonce(WP_REST_Request $request, string $nonceName = 'wp_rest', string|null $nonce = null):mixed |
| | | { |
| | | * @return bool|WP_Error |
| | | */ |
| | | public function verifyNonce(WP_REST_Request $request, string $nonceName = 'wp_rest', string|null $nonce = null): bool|WP_Error |
| | | { |
| | | $nonce = (!is_null($nonce)) ? $nonce : $request->get_header('X-WP-Nonce'); |
| | | |
| | | if (!wp_verify_nonce($nonce, $nonceName)) { |
| | |
| | | return false; |
| | | } |
| | | // Verify nonces |
| | | $this->verifyNonce($request, 'wp_rest'); |
| | | $this->verifyNonce($request); |
| | | if ($this->action!=='') { |
| | | $this->verifyNonce($request, $this->action . $user_id, $request->get_header('action_nonce')); |
| | | } |
| | |
| | | $context, |
| | | 'info' |
| | | ); |
| | | } catch (\Exception $e) { |
| | | } catch (Exception $e) { |
| | | // Fallback to error_log if handler fails |
| | | error_log("Security Audit: {$event} - " . json_encode($context)); |
| | | } |