Issues (15)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/admin/class-alnp-setup-wizard.php (2 issues)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Auto Load Next Post Setup Wizard class
4
 *
5
 * Scans the active theme for theme selectors and single post template.
6
 *
7
 * @since    1.6.0
8
 * @author   Sébastien Dumont
9
 * @category Classes
10
 * @package  Auto Load Next Post/Classes/Setup Wizard
11
 * @license  GPL-2.0+
12
 */
13
14
// Exit if accessed directly.
15
if ( ! defined( 'ABSPATH' ) ) {
16
	exit;
17
}
18
19
if ( ! class_exists( 'ALNP_Setup_Wizard' ) ) {
20
21
	class ALNP_Setup_Wizard {
22
23
		/**
24
		 * Initialize Setup Wizard.
25
		 *
26
		 * @access public
27
		 */
28
		public function __construct() {
29
			$this->id    = 'setup-wizard';
0 ignored issues
show
The property id does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
30
			$this->label = esc_html__( 'Setup Wizard', 'auto-load-next-post' );
0 ignored issues
show
The property label does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
31
32
			add_action( 'auto_load_next_post_settings_end', array( $this, 'output' ), 10, 2 );
33
		} // END __construct()
34
35
		/**
36
		 * Output the setup wizard.
37
		 * 
38
		 * @access public
39
		 * @param  string $current_view
40
		 */
41
		public function output( $current_view ) {
42
			if ( $current_view !== 'setup-wizard' ) {
43
				return;
44
			}
45
46
			// Get active theme
47
			$active_theme = wp_get_theme();
48
			?>
49
			<div class="auto-load-next-post setup-wizard">
50
51
				<div class="container">
52
53
					<div class="content">
54
						<div class="logo">
55
							<a href="https://autoloadnextpost.com/" target="_blank">
56
								<img src="<?php echo AUTO_LOAD_NEXT_POST_URL_PATH . '/assets/images/logo.png'; ?>" alt="<?php esc_html_e( 'Auto Load Next Post', 'auto-load-next-post' ); ?>" />
57
							</a>
58
						</div><!-- .logo -->
59
60
						<h1><?php echo esc_html__( 'Welcome to the Setup Wizard', 'auto-load-next-post' ); ?></h1>
61
62
						<?php
63
						// Stop users from using the Setup Wizard if theme already supports Auto Load Next Post.
64
						if ( ! isset( $_GET['force-setup'] ) && is_alnp_supported() ) {
65
							echo '<p>' . sprintf( __( 'Running the Setup Wizard is not required for your active theme %1$s as it already supports %2$s.', 'auto-load-next-post' ), '<strong>' . $active_theme->name . '</strong>', esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ) . '</p>';
66
67
							echo '<p style="text-align: center;"><a href="' . add_query_arg( array( 'page' => 'auto-load-next-post' ), admin_url( 'options-general.php' ) ) . '" class="button button-primary button-large" aria-label="' . sprintf( esc_attr__( 'View %s settings', 'auto-load-next-post' ), esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ) . '">' . esc_html__( 'View Settings', 'auto-load-next-post' ) . '</a></p>';
68
						} else {
69
						?>
70
						<div class="box enter show-box">
71
							<p><?php _e( 'The setup wizard will scan a random post on your site and identify your theme\'s selectors matching those that are known and used in many different themes. It will also look for the directory within the theme for where the theme content loops are stored.', 'auto-load-next-post' ); ?></p>
72
73
							<p><?php _e( 'Once found, they will be set for you once the scan is complete.', 'auto-load-next-post' ); ?></p>
74
75
							<p><?php _e( 'So let\'s get started.', 'auto-load-next-post' ); ?></p>
76
77
							<p class="small red"><i><?php echo sprintf( esc_html__( 'Please note that the setup wizard is not full proof and some manual work maybe required depending on the results. If you have %1$sWP_DEBUG%2$s enabled then results on what was found will be displayed to you.', 'auto-load-next-post' ), '<strong>', '</strong>' ); ?></i></p>
78
79
							<p style="text-align: center;">
80
								<a class="button button-primary button-large scan-button" href="#" data-step="template-location"><?php _e( 'Start', 'auto-load-next-post' ); ?></a>
81
							</p>
82
83
							<div class="meter blue animate" style="display:none;">
84
								<span style="width: 100%"><span></span></span>
85
							</div>
86
						</div><!-- .box.enter -->
87
88
						<div class="box template-location-results">
89
							<h2><?php _e( 'Setup Wizard: Template Location', 'auto-load-next-post' ); ?></h2>
90
91
							<p class="template-found"><?php printf( __( '%s has detected the template location and has set it for you. Please continue the wizard to scan for theme selectors next.', 'auto-load-next-post' ), esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ); ?></p>
92
93
							<p class="no-template-found"><?php printf( __( 'Setup Wizard was not able to locate your template location for this theme. This is likely because the theme is using either a directory or filename that %s does not recognise.', 'auto-load-next-post' ), esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ); ?></p>
94
95
							<p class="no-template-found"><?php printf( __( 'A fallback template will be used instead. To fully support %s with this theme, view the repeater template override guide in the documentation.', 'auto-load-next-post' ), esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ); ?></p>
96
97
							<?php
98
							/**
99
							 * Displays the theme template location if WP_DEBUG is enabled.
100
							 */
101
							if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
102
							?>
103
							<p class="template-location debug-mode">
104
								<strong class="red"><?php _e( 'Developers:', 'auto-load-next-post' ); ?></strong> <?php echo sprintf( __( 'You can %1$sapply a filter to set the template location%2$s with the found directory for your theme.', 'auto-load-next-post' ), '<a href="https://github.com/autoloadnextpost/alnp-documentation/blob/master/en_US/filter-hooks.md#filter-alnp_template_location" target="_blank">', '</a>' ); ?>
105
							</p>
106
107
							<p><?php _e( 'Copy:', 'auto-load-next-post' ); ?> <i class="bold copy"><span class="location">*</span></i></p>
108
							<?php } ?>
109
110
							<hr>
111
112
							<p style="text-align: center;">
113
								<a class="button button-primary button-large scan-button" href="#" data-step="theme-selectors"><?php _e( 'Continue', 'auto-load-next-post' ); ?></a>
114
								<a class="button button-large button-doc" href="<?php echo esc_url( 'https://github.com/autoloadnextpost/alnp-documentation/blob/master/en_US/repeater-template.md#repeater-template' ); ?>" target="_blank"><?php _e( 'Documentation', 'auto-load-next-post' ); ?></a>
115
							</p>
116
117
							<div class="meter blue animate" style="display:none;">
118
								<span style="width: 100%"><span></span></span>
119
							</div><!-- .meter -->
120
						</div><!-- .box.template-location-results -->
121
122
						<div class="box theme-selector-results">
123
							<h2><?php _e( 'Setup Wizard: Theme Selectors', 'auto-load-next-post' ); ?></h2>
124
125
							<?php
126
							/**
127
							 * Displays the theme selector results if WP_DEBUG is enabled.
128
							 */
129
							if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
130
							?>
131
							<div class="theme-selectors debug-mode">
132
								<p><?php _e( 'If any selector was not found, click on the help icon next to the result for more details.', 'auto-load-next-post' ); ?></p>
133
134
								<p><strong><?php _e( 'Post scanned:', 'auto-load-next-post' ); ?></strong> <i><span class="post-tested">*</span></i></p>
135
136
								<div class="result-container">
137
									<div class="selectors">
138
										<p class="bold"><?php _e( 'Selector', 'auto-load-next-post' ); ?></p>
139
140
										<div class="container pending">
141
											<span class="selector"><?php _e( 'Content Container', 'auto-load-next-post' ); ?></span>
142
										</div>
143
										<div class="title pending">
144
											<span class="selector"><?php _e( 'Post Title', 'auto-load-next-post' ); ?></span>
145
										</div>
146
										<div class="navigation pending">
147
											<span class="selector"><?php _e( 'Post Navigation', 'auto-load-next-post' ); ?></span>
148
										</div>
149
										<div class="comments pending">
150
											<span class="selector"><?php _e( 'Comments Container', 'auto-load-next-post' ); ?></span>
151
										</div>
152
									</div><!-- .selectors -->
153
154
									<div class="results-found">
155
										<p class="bold"><?php _e( 'Result', 'auto-load-next-post' ); ?></p>
156
157
										<div class="container"><span class="result">-</span></div>
158
										<div class="title"><span class="result">-</span></div>
159
										<div class="navigation"><span class="result">-</span></div>
160
										<div class="comments"><span class="result">-</span></div>
161
									</div><!-- .results-found -->
162
								</div><!-- .result-container -->
163
164
								<p><strong class="red"><?php _e( 'Developers:', 'auto-load-next-post' ); ?></strong> <?php echo sprintf( __( 'Checkout the %1$sadd theme support guide%2$s to apply these found theme selectors automatically when another user installs your theme with %3$s.', 'auto-load-next-post' ), '<a href="https://github.com/autoloadnextpost/alnp-documentation/blob/master/en_US/add-theme-support.md#add-theme-support" target="_blank">', '</a>', esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ); ?></p>
165
166
							</div><!-- .debug-mode -->
167
							<?php } ?>
168
169
							<p class="theme-selectors-undetected"><?php printf( esc_html__( 'Setup Wizard was unable to detect some of the theme selectors. You can scan again just to be sure the wizard did not timeout but most likley you will have to manually set them yourself. %1$sFollow the theme selectors guide to find them%2$s.', 'auto-load-next-post' ), '<a href="https://github.com/autoloadnextpost/alnp-documentation/blob/master/en_US/theme-selectors.md#how-to-find-your-theme-selectors" target="_blank">', '</a>' ); ?></p>
170
171
							<p class="no-post-navigation"><?php printf( __( 'No post navigation on the scanned post was detected. If this is incorrect, please %1$scontact me%2$s and let me know your site URL address.', 'auto-load-next-post' ), '<a href="https://autoloadnextpost.com/contact/" target="_blank">', '</a>' ); ?></p>
172
173
							<p class="setup-complete"><?php printf( __( 'Congratulations, %s is now setup and ready. Further optional options are available via the settings page.', 'auto-load-next-post' ), esc_html__( 'Auto Load Next Post', 'auto-load-next-post' ) ); ?></p>
174
175
							<hr>
176
177
							<p style="text-align: center;">
178
								<button class="button button-large rescan"><?php _e( 'Scan Again?', 'auto-load-next-post' ); ?></button>
179
								<a class="button button-primary button-large" href="<?php echo add_query_arg( array( 'page' => 'auto-load-next-post', 'view' => 'misc' ), admin_url( 'options-general.php' ) ); ?>"><?php _e( 'View Settings', 'auto-load-next-post' ); ?></a>
180
							</p>
181
						</div><!-- .box.theme-selector-results -->
182
						<?php } ?>
183
184
					</div><!-- .content -->
185
186
				</div><!-- .container -->
187
188
			</div><!-- .auto-load-next-post -->
189
			<?php
190
		} // END output()
191
192
	} // END class
193
194
} // END if class
195
196
return new ALNP_Setup_Wizard();