💥 feat: requests that change something carry a nonce (3.0)

[gfazioli]

For 3.0, on v3: requests that change something carry a nonce (audit S4, S5).

💥 Admin pages

Up to 2.x, a WP Bones admin page mapped the HTTP verb to store(), update() and destroy(), and ran its load callbacks for any request. A form posted from another site with an administrator's cookies did both.

Since 3.0, every request to a WP Bones admin page that is not a GET or a HEAD carries the plugin's nonce. That covers menu items, route pages and pages/ classes.

• The form prints it: <?php echo $plugin->csrfField(); ?>, or {!! $plugin->csrfField() !!} in Blade. The field is _wpbones_nonce, not _wpnonce, so a form can keep a wp_nonce_field() of its own beside it.
• The check: Routing\Csrf runs on load-{hook} at PHP_INT_MIN, before any load callback, and again before the page renders.
• A missing or wrong nonce: WordPress's own wp_nonce_ays(), "The link you followed has expired." with a 403.
• Where the nonce can travel: the form field, the query string, or an X-WPBones-Nonce header, for a fetch() with a JSON body.
• WordPress's own forms are let through, because each carries a nonce of its own: Screen Options and the filesystem credentials form.
• Opting out, for a page that checks a nonce of its own: 'csrf' => false in a route or menu item's route, or a public, argument-free csrf() returning false on a pages/ class. It is not a door for requests from other sites: wp-admin requires a logged-in browser first.

💥 Ajax

• No nonce, no action. A logged action of a provider without $nonceHash (or $nonceKey) refuses every request with a 403, and a _doing_it_wrong() names the provider. Up to 2.x its nonce check returned true.
• The nonce is read from $_REQUEST, as check_ajax_referer() does.
• make:ajax sets $nonceHash = '{ClassName}'. It used to write '', which 3.0 refuses.
• trusted and notLogged are public by design and unchanged.
• useHTTPPost() returns unslashed values.
• Request::verifyNonce() reads a missing _wpnonce as a failed check, not an undefined index.

✨ migrate:to-v3

It also lists:

• every view with a POST form that does not print csrfField();
• every direct child of WordPressAjaxServiceProvider, also under the name a use … as gives it, with logged actions and no $nonceHash. A child of the plugin's own base class may inherit one, so it is not listed;
• every stripslashes() or wp_unslash() in a file that calls useHTTPPost(). That value now comes unslashed, and a second pass corrupts quotes and backslashes: Scotty's preferences JSON would decode to null.

Each form is checked on its own, in the views and in pages/ classes. A page that opts out is not listed, and neither is a form printed as an example inside a PHP string.

Results on the real code:

• Options and Packages boilerplates: their 4 forms are listed. They change in the 3.0 cascade.
• Scotty: nothing. Its providers inherit $nonceHash from its own base class.

Tests

• composer test: 321 tests and 851 assertions, against 307 and 824 on v3. New: CsrfTest, AjaxProviderTest, and two MigrateToV3AccessTest cases that fail on v3's bones.
• Live, in WPKirk-Developing, with csrf-live-smoke.sh:
  • Setup: an administrator logged in over HTTPS; a route page with a form, a 'csrf' => false route, the bench's menu page, and a logged Ajax action without $nonceHash.
  • v2.1.3: 7 ✗ of 11. A POST without a nonce, or with a forged one, runs store() on the route and the menu page, and the Ajax action answers.
  • This branch: 12 ✓, including the POST with the nonce the form printed.

Review

• Copilot: the account's quota is exhausted.
• Codex (gpt-6-sol, high), round 1, three findings:
  • a csrf($token) of the page's own was called;
  • the form check ran file by file instead of form by form;
  • pages/ forms were not checked.
• Codex, round 2, two false positives in the report: opted-out pages, and printed examples.
• An independent review, fixed in the last commit:
  • the Ajax alias form;
  • the double unslash;
  • nonces in JSON requests;
  • WordPress's own POSTs;
  • the opt-out's description;
  • the hook-name consistency;
  • two mutations that left the suite green.
• Out of scope: the first-party wpbones/wptables package runs bulk actions on GET, with no nonce. That is its own repository.
• composer test: 329 tests and 863 assertions. csrf-live-smoke.sh: 12 ✓. v3-access-live-smoke.sh: 18 ✓.