Audit & fixes

[aristath]

No description provided.

[github-actions]

Test on Playground
Test this pull request on the Playground
or download the zip

[Copilot]

Pull Request Overview

This PR implements comprehensive security fixes to address multiple vulnerabilities in the Progress Planner plugin, focusing on CSRF protection and privilege escalation prevention.

• Adds robust security controls including nonce validation, option whitelisting, and CSRF token protection for task completion
• Implements proper AJAX nonce checking throughout the codebase
• Introduces comprehensive security test coverage to validate the fixes and prevent regressions

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/phpunit/test-class-security.php	Comprehensive security test suite covering nonce validation, permission checks, and option whitelisting
classes/suggested-tasks/providers/class-tasks-interactive.php	Implements option whitelist to prevent arbitrary WordPress option updates
classes/suggested-tasks/providers/class-email-sending.php	Fixes AJAX nonce validation and adds CSRF token protection for email links
classes/class-suggested-tasks.php	Adds secure token generation/validation system for task completion links
classes/admin/class-page-settings.php	Updates AJAX handlers to use proper nonce validation functions

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[ilicfilip]

PR changed "Check send email" request from GET to POST on the server side, but not on the client side. I pushed a commit which fixes that (it makes more sense to be POST).

Do we need to keep SECURITY FIX comments, like "SECURITY FIX: Changed to use check_ajax_referer and get email from $_POST." ?

[aristath]

@ilicfilip I pushed the tweaks discussed above. I think this is OK now, could you please do another review? 🙏