Security Notes
Security considerations for wpzylos-hooks.
AJAX Hooks
Always verify nonces and capabilities in AJAX handlers:
$hooks->wpAction('wp_ajax_myplugin_save', function () use ($nonce, $gate) {
// 1. Verify nonce
if (!$nonce->verify($_POST['_nonce'] ?? '', 'save')) {
wp_send_json_error('Invalid nonce', 403);
}
// 2. Check capability
if (!$gate->can('manage_options')) {
wp_send_json_error('Unauthorized', 403);
}
// 3. Sanitize input
// 4. Process
});
Admin Hooks
Check capabilities before rendering admin content:
$hooks->wpAction('admin_menu', function () use ($context, $gate) {
add_menu_page(
__('Settings', $context->textDomain()),
__('Settings', $context->textDomain()),
'manage_options', // Capability required
$context->slug(),
$renderCallback
);
});
Filter Security
Don't Trust Filter Input
Data from filters may come from untrusted plugins:
$hooks->wpFilter('the_content', function ($content) {
// $content may contain malicious HTML from other plugins
// Escape if displaying in sensitive context
return wp_kses_post($content);
});
Validate Before Modifying
$hooks->wpFilter('save_post_data', function ($data) use ($sanitizer) {
// Validate structure
if (!is_array($data) || !isset($data['post_content'])) {
return $data;
}
// Sanitize before modification
$data['post_content'] = $sanitizer->html($data['post_content']);
return $data;
});