More fixes

Author: aristath

classes/class-suggested-tasks.php

@@ -188,6 +188,9 @@ public function was_task_completed( $task_id ): bool {
 	 * Primarly this is used for deeplinking, ie user is testing if the emails are working
 	 * He gets an email with a link which automatically completes the task.
 	 *
+	 * SECURITY FIX: Added token verification to prevent CSRF attacks.
+	 * Tokens are one-time use and expire after 24 hours.
+	 *
 	 * @return void
 	 */
 	public function maybe_complete_task() {
@@ -200,6 +203,19 @@ public function maybe_complete_task() {
 			return;
 		}
 
+		// SECURITY FIX: Verify token to prevent CSRF attacks.
+		if ( ! isset( $_GET['token'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+			return;
+		}
+
+		$provided_token = \sanitize_text_field( \wp_unslash( $_GET['token'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		$user_id        = \get_current_user_id();
+
+		// Verify the token.
+		if ( ! $this->verify_task_completion_token( $task_id, $user_id, $provided_token ) ) {
+			return;
+		}
+
 		if ( ! $this->was_task_completed( $task_id ) ) {
 			$task = \progress_planner()->get_suggested_tasks_db()->get_post( $task_id );
 
@@ -208,10 +224,71 @@ public function maybe_complete_task() {
 
 				// Insert an activity.
 				$this->insert_activity( $task_id );
+
+				// Delete the token after successful use (one-time use).
+				$this->delete_task_completion_token( $task_id, $user_id );
 			}
 		}
 	}
 
+	/**
+	 * Generate a secure token for task completion via email link.
+	 *
+	 * This token prevents CSRF attacks by ensuring only legitimate email
+	 * links can mark tasks as complete.
+	 *
+	 * @param string $task_id The task ID.
+	 * @param int    $user_id The user ID.
+	 *
+	 * @return string The generated token.
+	 */
+	public function generate_task_completion_token( $task_id, $user_id ) {
+		// Generate a cryptographically secure random token.
+		$random = \wp_generate_password( 32, false );
+		$token  = \wp_hash( $task_id . $user_id . $random . \wp_salt( 'auth' ) );
+
+		// Store the token in a transient (expires after 24 hours).
+		\set_transient(
+			'prpl_complete_' . $task_id . '_' . $user_id,
+			$token,
+			DAY_IN_SECONDS
+		);
+
+		return $token;
+	}
+
+	/**
+	 * Verify a task completion token.
+	 *
+	 * @param string $task_id        The task ID.
+	 * @param int    $user_id        The user ID.
+	 * @param string $provided_token The token to verify.
+	 *
+	 * @return bool True if token is valid, false otherwise.
+	 */
+	protected function verify_task_completion_token( $task_id, $user_id, $provided_token ) {
+		$stored_token = \get_transient( 'prpl_complete_' . $task_id . '_' . $user_id );
+
+		if ( ! $stored_token ) {
+			return false; // Token expired or doesn't exist.
+		}
+
+		// Use hash_equals to prevent timing attacks.
+		return \hash_equals( $stored_token, $provided_token );
+	}
+
+	/**
+	 * Delete a task completion token after use.
+	 *
+	 * @param string $task_id The task ID.
+	 * @param int    $user_id The user ID.
+	 *
+	 * @return bool True if deleted, false otherwise.
+	 */
+	protected function delete_task_completion_token( $task_id, $user_id ) {
+		return \delete_transient( 'prpl_complete_' . $task_id . '_' . $user_id );
+	}
+
 	/**
 	 * Handle the suggested task action.
 	 *

classes/suggested-tasks/providers/class-email-sending.php

@@ -116,10 +116,15 @@ public function init() {
 		\add_action( 'init', [ $this, 'check_if_wp_mail_has_override' ], PHP_INT_MAX );
 
 		$this->email_subject = \esc_html__( 'Your Progress Planner test message!', 'progress-planner' );
+
+		// SECURITY FIX: Generate a secure token for the completion link to prevent CSRF.
+		$user_id = \get_current_user_id();
+		$token   = \progress_planner()->get_suggested_tasks()->generate_task_completion_token( $this->get_task_id(), $user_id );
+
 		$this->email_content = \sprintf(
 			// translators: %1$s the admin URL.
 			\__( 'You just used Progress Planner to verify if sending email works on your website. <br><br> The good news; it does! <a href="%1$s" target="_self">Click here to mark %2$s\'s Recommendation as completed</a>.', 'progress-planner' ),
-			\admin_url( 'admin.php?page=progress-planner&prpl_complete_task=' . $this->get_task_id() ),
+			\admin_url( 'admin.php?page=progress-planner&prpl_complete_task=' . $this->get_task_id() . '&token=' . $token ),
 			\esc_html( \progress_planner()->get_ui__branding()->get_ravi_name() )
 		);
 	}
@@ -255,6 +260,8 @@ protected function is_there_sending_email_override() {
 	/**
 	 * Test email sending.
 	 *
+	 * SECURITY FIX: Changed to use check_ajax_referer and get email from $_POST.
+	 *
 	 * @return void
 	 */
 	public function ajax_test_email_sending() {
@@ -263,18 +270,32 @@ public function ajax_test_email_sending() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
 		}
 
-		// Check the nonce.
-		\check_admin_referer( 'progress_planner' );
+		// SECURITY FIX: Use check_ajax_referer for AJAX handlers.
+		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );
+		}
 
-		$email_address = isset( $_GET['email_address'] ) ? \sanitize_email( \wp_unslash( $_GET['email_address'] ) ) : '';
+		// SECURITY FIX: Get email from POST data (AJAX request).
+		$email_address = isset( $_POST['email_address'] ) ? \sanitize_email( \wp_unslash( $_POST['email_address'] ) ) : '';
 
 		if ( ! $email_address ) {
 			\wp_send_json_error( \esc_html__( 'Invalid email address.', 'progress-planner' ) );
 		}
 
+		// Regenerate email content with fresh token for current user.
+		$user_id = \get_current_user_id();
+		$token   = \progress_planner()->get_suggested_tasks()->generate_task_completion_token( $this->get_task_id(), $user_id );
+
+		$email_content = \sprintf(
+			// translators: %1$s the admin URL.
+			\__( 'You just used Progress Planner to verify if sending email works on your website. <br><br> The good news; it does! <a href="%1$s" target="_self">Click here to mark %2$s\'s Recommendation as completed</a>.', 'progress-planner' ),
+			\admin_url( 'admin.php?page=progress-planner&prpl_complete_task=' . $this->get_task_id() . '&token=' . $token ),
+			\esc_html( \progress_planner()->get_ui__branding()->get_ravi_name() )
+		);
+
 		$headers = [ 'Content-Type: text/html; charset=UTF-8' ];
 
-		$result = \wp_mail( $email_address, $this->email_subject, $this->email_content, $headers );
+		$result = \wp_mail( $email_address, $this->email_subject, $email_content, $headers );
 
 		if ( $result ) {
 			\wp_send_json_success( \esc_html__( 'Email sent successfully.', 'progress-planner' ) );