Security

When a plugin executes custom code, security is not optional. It is the foundation. This document explains every protection layer in Tofido Code Manager and how to use it effectively.

Safe Mode for PHP

Safe Mode is the most important security feature. It creates an isolated execution environment where you can test PHP snippets without risking your live site.

How it works

  1. The snippet runs in a separate PHP process with limited scope.
  2. Output is captured and displayed for review.
  3. Fatal errors are caught and the snippet is auto-disabled.
  4. No database or filesystem changes occur during testing.
  5. Execution timeout is capped to prevent infinite loops.
Critical

Never publish a PHP snippet without testing in Safe Mode first. Even experienced developers make mistakes. Safe Mode is your safety net.

Dangerous Function Scanning

The plugin scans PHP snippets for functions that could compromise security or stability.

Scanned categories

  • File System: eval(), exec(), system(), passthru(), shell_exec(), proc_open()
  • Database: Raw SQL execution without preparation
  • Network: Unrestricted external requests
  • Code Injection: create_function(), assert()

Warning levels

  • Block: Snippet cannot be published until resolved.
  • Warning: Can publish, but a prominent warning is shown.
  • Info: Informational notice about potential risks.

If a warning is a false positive, add an inline comment:

PHP
// tofido-allow: shell_exec
// Required for server-side image optimization
$output = shell_exec('optipng -o2 image.png');

Capability Checks

Every management action requires manage_options, granted only to administrators by default.

Protected actions

  • Create, edit, or delete snippets
  • Change snippet status
  • Import or export
  • Modify settings
  • Restore revisions

Developers can customize the required capability:

PHP
add_filter('tofido_code_manager_capability', function($cap) {
    return 'custom_snippet_capability';
});

Nonce Protection

All AJAX requests and form submissions include WordPress nonce verification. CSRF attacks are impossible by design. Nonces are per-user, per-action, and time-limited.

AJAX Security

Every AJAX endpoint implements:

  1. Nonce verification on every request
  2. Capability checking before processing
  3. Input sanitization for all user data
  4. Output escaping for all responses
  5. Rate limiting on execution endpoints

Automatic Error Recovery

If a published PHP snippet causes a fatal error:

  1. The error is caught by a custom handler.
  2. The snippet is automatically disabled.
  3. An admin notification is sent with details.
  4. The site continues functioning normally.

Syntax Validation

Before saving, syntax is validated for each type:

  • CSS: Malformed rules, missing braces, invalid selectors
  • JavaScript: Syntax errors via parser
  • PHP: Linting equivalent to php -l
  • HTML: Unclosed tags and malformed attributes

Import Safety

When importing JSON:

  1. All snippets start as Draft.
  2. JSON structure is validated against the schema.
  3. Syntax validation runs on each snippet.
  4. Dangerous function scanning applies to PHP.
  5. Import source is logged for audit.
Best Practice

Always review imported snippets before publishing. Test PHP snippets in Safe Mode, even from trusted sources.

PHP Execution Model

PHP snippets execute entirely in memory:

  • No cache files written to the filesystem
  • No eval() - code runs through proper WordPress hooks
  • No persistent storage of executable code outside the database
  • Scoped execution prevents variable leakage

Disabling a snippet immediately stops its execution.

Security Checklist

Before publishing any snippet:

  • PHP snippets tested in Safe Mode
  • No dangerous function warnings ignored without justification
  • Display conditions correctly configured
  • Snippet is necessary and optimized
  • Imported snippets reviewed and tested
  • Only trusted administrators have management access