Harden support access: notify on login, restrict log downloads

- Email the token creator (or site admin) when a token is used, with time, IP, user agent, and a one-click revocation link
- Restrict download_realtime_log to the export/import-YYYYMMDD-HHMMSS.php filename pattern, matching delete_run_log
- Document support token hygiene in the README

Author: developeritsme

README.md

@@ -64,6 +64,16 @@ Override AI1WM filters for debugging without code changes:
 
 One-click report generation aggregating all diagnostic data. Available as JSON download or copyable text format. Includes environment, filesystem, database, plugins, ecosystem, conflicts, and operations data.
 
+## Support Access Best Practices
+
+The token-based support access feature grants a third party temporary login to your site. Treat each token as a live credential.
+
+- **Revoke immediately after the session ends.** Don't wait for the 72-hour expiry. Go to **ServMask Debug > Support** and click Revoke on the active token.
+- **Share the login URL over a secure channel only.** Anyone with the URL can log in until it expires or is revoked. Avoid sending it via plain email or public chat; prefer your support ticket portal or an encrypted message.
+- **Watch the email notification.** When a token is used, the admin who generated it receives an email with the time, IP, and user agent of the session. If you did not expect a session, revoke the token immediately.
+- **Use Debug Only when possible.** Full Administrator access is rarely needed. Debug Only grants access to the debug page and AI1WM operations without exposing the rest of the site.
+- **Review the Audit Log** after every support session to see what was accessed and changed.
+
 ## Architecture
 
 ```

lib/controller/class-ai1wm-debug-ajax-controller.php

@@ -140,6 +140,11 @@ public static function download_realtime_log() {
 			$filename = basename( $current );
 		}
 
+		if ( ! preg_match( '/^(export|import)-\d{8}-\d{6}\.php$/', $filename ) ) {
+			echo 'Invalid log file.';
+			exit;
+		}
+
 		$filepath = AI1WM_DEBUG_LOGS_PATH . DIRECTORY_SEPARATOR . $filename;
 		if ( ! file_exists( $filepath ) ) {
 			echo 'Log file not found.';

lib/model/class-ai1wm-debug-access.php

@@ -282,14 +282,13 @@ public static function handle_login() {
 		// Set support session flag in user meta
 		update_user_meta( $user_id, '_ai1wm_debug_support_session', '1' );
 
-		// Log the login
 		$token_prefix = substr( $token, 0, 8 );
-		Ai1wm_Debug_Audit::log_action( $token_prefix, 'login', 'Support user logged in via token' );
+		$token_hash   = hash( 'sha256', $token );
+		$tokens       = Ai1wm_Debug_Config::get( AI1WM_DEBUG_ACCESS_TOKENS_OPTION, array() );
+		$level        = isset( $tokens[ $token_hash ]['level'] ) ? $tokens[ $token_hash ]['level'] : 'debug_only';
 
-		// Determine redirect based on access level
-		$token_hash = hash( 'sha256', $token );
-		$tokens     = Ai1wm_Debug_Config::get( AI1WM_DEBUG_ACCESS_TOKENS_OPTION, array() );
-		$level      = isset( $tokens[ $token_hash ]['level'] ) ? $tokens[ $token_hash ]['level'] : 'debug_only';
+		Ai1wm_Debug_Audit::log_action( $token_prefix, 'login', 'Support user logged in via token' );
+		self::notify_login( $token_hash, $ip );
 
 		// Prevent token leaking via Referer header
 		header( 'Referrer-Policy: no-referrer' );
@@ -303,6 +302,58 @@ public static function handle_login() {
 		exit;
 	}
 
+	/**
+	 * Email the token creator (or site admin) that a support session has started
+	 *
+	 * @param string $token_hash
+	 * @param string $ip
+	 */
+	private static function notify_login( $token_hash, $ip ) {
+		$tokens = Ai1wm_Debug_Config::get( AI1WM_DEBUG_ACCESS_TOKENS_OPTION, array() );
+		if ( ! isset( $tokens[ $token_hash ] ) ) {
+			return;
+		}
+
+		$data = $tokens[ $token_hash ];
+
+		$recipient = '';
+		if ( ! empty( $data['created_by'] ) ) {
+			$creator = get_user_by( 'id', $data['created_by'] );
+			if ( $creator && ! empty( $creator->user_email ) ) {
+				$recipient = $creator->user_email;
+			}
+		}
+
+		if ( empty( $recipient ) ) {
+			$recipient = get_option( 'admin_email' );
+		}
+
+		if ( empty( $recipient ) ) {
+			return;
+		}
+
+		$site_name = get_bloginfo( 'name' );
+		$level     = isset( $data['level'] ) ? $data['level'] : 'debug_only';
+		$username  = isset( $data['username'] ) ? $data['username'] : '';
+		$ua        = isset( $_SERVER['HTTP_USER_AGENT'] ) ? substr( $_SERVER['HTTP_USER_AGENT'], 0, 255 ) : '';
+		$time      = current_time( 'mysql' );
+		$page_url  = admin_url( 'admin.php?page=servmask-debug' );
+
+		$subject = sprintf( '[%s] ServMask Debug support session started', $site_name );
+
+		$message  = "A ServMask Debug support session just started on your site.\n\n";
+		$message .= "Site:         " . site_url() . "\n";
+		$message .= "Time:         " . $time . "\n";
+		$message .= "Access level: " . $level . "\n";
+		$message .= "Support user: " . $username . "\n";
+		$message .= "IP address:   " . $ip . "\n";
+		$message .= "User agent:   " . $ua . "\n\n";
+		$message .= "If you did not expect this session, revoke the token now:\n";
+		$message .= $page_url . "\n";
+
+		wp_mail( $recipient, $subject, $message );
+	}
+
 	/**
 	 * Delete a support user and destroy their sessions
 	 *