Security

Security considerations for WPZylos Requirements.

Overview

The Requirements package is security-focused by design:

Read-only operations — Only checks environment, never modifies system
No user input — All config comes from trusted PHP files
WordPress escaping — All output uses WordPress sanitization

Output Sanitization

All error messages are sanitized before display:

// In RequirementsErrorHandler
echo esc_html($pluginName);           // Plain text
echo wp_kses_post($error);            // Limited HTML (strong, em, etc.)
echo esc_url(admin_url('plugins.php')); // URL sanitization

Config File Security

File Location

Keep requirements.php in your plugin's config/ directory:

your-plugin/
+-- config/
|   +-- requirements.php   ← Protected by WordPress

This file is automatically protected from direct access by WordPress's ABSPATH check.

Config Content

The config file should only return static data:

<?php
// Good: Good - static configuration
return [
    'min_php_version' => '8.1',
    'min_wp_version'  => '6.0',
];

<?php
// Bad: Bad - executing arbitrary code
return [
    'min_php_version' => $_GET['version'], // Never use user input!
];

Plugin Slug Validation

The PluginRequirement class validates plugin slugs safely:

// Internal validation
$pluginPath = WP_PLUGIN_DIR . '/' . $this->pluginSlug;

// Only checks if file exists, doesn't execute anything
if (!file_exists($pluginPath)) {
    // ...
}

Deactivation Security

Plugin deactivation requires proper permissions:

// WordPress handles permission checks internally
deactivate_plugins(plugin_basename($pluginFile));

Only users with activate_plugins capability can trigger activation/deactivation.

Error Page Security

The wp_die() error page uses safe output:

wp_die(
    $this->renderErrorPage(),           // Sanitized HTML
    __('Plugin Requirements Not Met', $this->textDomain),
    ['back_link' => true]               // WordPress handles back link
);

Best Practices

1. Version Config as Code

Commit your requirements.php to version control:

git add config/requirements.php
git commit -m "Add plugin requirements"

2. Don't Use Environment Variables for Security

// Bad: Avoid for security-critical requirements
'min_php_version' => getenv('MIN_PHP'),

3. Validate Plugin Slugs

Always use the correct format:

// Good: Correct format
'plugin_slug' => 'woocommerce/woocommerce.php',

// Bad: Wrong formats
'plugin_slug' => 'woocommerce',           // Missing file
'plugin_slug' => '/woocommerce/woo.php',  // Leading slash

Reporting Vulnerabilities

If you discover a security vulnerability:

Do NOT open a public GitHub issue
Email: [email protected]
Include steps to reproduce
Wait for acknowledgment (48h)

See security.md for full disclosure policy.

Testing

Troubleshooting