Issues (15)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

auto-load-next-post-template-functions.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Auto Load Next Post Template
4
 *
5
 * Functions for the templating system.
6
 *
7
 * @since    1.6.0
8
 * @author   Sébastien Dumont
9
 * @category Core
10
 * @package  Auto Load Next Post/Functions
11
 * @license  GPL-2.0+
12
 */
13
14
// Exit if accessed directly.
15
if ( ! defined( 'ABSPATH' ) ) {
16
	exit;
17
}
18
19
if ( ! function_exists( 'alnp_template_redirect' ) ) {
20
	/**
21
	 * When the 'alnp' endpoint is used on a singular post it forces
22
	 * the template redirect to retrieve only the post content.
23
	 *
24
	 * @since   1.0.0
25
	 * @version 1.6.0
26
	 * @global  WP_Query $wp_query - The object information defining the current request and determines what type of query it's dealing with. See https://codex.wordpress.org/Class_Reference/WP_Query
27
	 */
28
	function alnp_template_redirect() {
29
		global $wp_query;
30
31
		// If this is not a request for alnp or a singular object then bail.
32
		if ( ! isset( $wp_query->query_vars['alnp'] ) || ! is_singular() ) {
33
			return;
34
		}
35
36
		/**
37
		 * Load the template file from the theme (child or parent) if one exists.
38
		 * If theme does not have a template file for Auto Load Next Post,
39
		 * the plugin will load a default template.
40
		 */
41
		$child_path        = get_stylesheet_directory() . '/' . AUTO_LOAD_NEXT_POST_TEMPLATE_PATH;
42
		$template_path     = get_template_directory() . '/' . AUTO_LOAD_NEXT_POST_TEMPLATE_PATH;
43
		$default_path      = AUTO_LOAD_NEXT_POST_FILE_PATH;
44
		$template_redirect = '';
45
46
		if ( file_exists( $child_path . 'content-alnp.php' ) ) {
47
			$template_redirect = $child_path . 'content-alnp.php';
48
		} else if ( file_exists( $template_path . 'content-alnp.php' ) ) {
49
			$template_redirect = $template_path . 'content-alnp.php';
50
		} else if ( file_exists( $default_path . '/templates/content-alnp.php' ) ) {
51
			$template_redirect = $default_path . '/templates/content-alnp.php';
52
		}
53
54
		$template_redirect = apply_filters( 'alnp_template_redirect', $template_redirect );
55
56
		include( $template_redirect );
57
58
		exit;
59
	} // END alnp_template_redirect()
60
}
61
62
if ( ! function_exists( 'auto_load_next_post_comments' ) ) {
63
	/**
64
	 * Adds the comments template after the post content.
65
	 *
66
	 * @since   1.4.8
67
	 * @version 1.5.4
68
	 */
69
	function auto_load_next_post_comments() {
70
		// If comments are open or we have at least one comment, load up the comment template.
71
		if ( comments_open() || get_comments_number() ) :
72
			comments_template();
73
		endif;
74
	} // END auto_load_next_post_comments()
75
}
76
77
if ( ! function_exists( 'auto_load_next_post_navigation' ) ) {
78
	/**
79
	 * Adds the post navigation for the previous link only after the post content.
80
	 *
81
	 * @since   1.4.8
82
	 * @version 1.5.4
83
	 */
84
	function auto_load_next_post_navigation() {
85
	?>
86
	<nav class="navigation post-navigation" role="navigation">
87
		<span class="nav-previous"><?php previous_post_link( '%link', '<span class="meta-nav">' . _x( '&larr;', 'Previous post link', 'auto-load-next-post' ) . '</span> %title' ); ?></span>
88
	</nav>
89
	<?php
90
	} // END auto_load_next_post_navigation()
91
}
92
93
if ( ! function_exists( 'alnp_get_locations' ) ) {
94
	/**
95
	 * Get list of locations as to where the content for the theme is located.
96
	 * The list is in the order to look for the templates that store the content.
97
	 *
98
	 * @since  1.6.0
99
	 * @return array
100
	 */
101
	function alnp_get_locations() {
102
		return array(
103
			'', // Parent theme folder
104
			'components/',
105
			'components/post/',
106
			'components/page/',
107
			'template-parts/',
108
			'template-parts/content/',
109
			'template-parts/post/',
110
			'template-parts/page/',
111
			'templates/',
112
			'partials/',
113
			'loop-templates/'
114
		);
115
	} // END alnp_get_locations()
116
}
117
118
if ( ! function_exists( 'alnp_get_templates' ) ) {
119
	/**
120
	 * Get list of templates to look for.
121
	 *
122
	 * @since  1.6.0
123
	 * @param  string $post_type
124
	 * @param  string $post_format
125
	 * @return array
126
	 */
127
	function alnp_get_templates( $post_type = 'post', $post_format = '' ) {
128
		$get_standard = array(
129
			'content-single.php',
130
			'content-post.php',
131
			'content-' . $post_type . '.php',
132
			'content.php'
133
		);
134
135
		if ( ! empty( $post_format ) ) {
136
			$get_formats = array(
137
				'format-' . $post_format . '.php',
138
				'content' . $post_format . '.php'
139
			);
140
141
			return array_merge( $get_standard, $get_formats );
142
		}
143
144
		return $get_standard;
145
	} // END alnp_get_templates()
146
}
147
148
if ( ! function_exists( 'alnp_scan_directories' ) ) {
149
	/**
150
	 * Scans for the theme template directory depending on the post type requested and saves it.
151
	 *
152
	 * @since 1.6.0
153
	 * @param string $post_type
154
	 * @param string $post_format
155
	 */
156
	function alnp_scan_directories( $post_type = 'post', $post_format = '' ) {
157
		// Possible locations where the content files are found.
158
		$locations = alnp_get_locations();
159
160
		// Templates to look for based on the post that is loaded.
161
		$templates = alnp_get_templates( $post_type, $post_format );
162
163
		$content_found = false;
164
165
		// Scanning all possible locations.
166
		foreach( $locations as $location ) {
167
			// Scanning all possible templates within the locations.
168
			foreach( $templates as $template ) {
169
				// Remove forwardslash if location is the parent theme folder.
170
				if ( empty( $location ) ) {
171
					$location = str_replace('/', '', $location);
172
				}
173
174
				// If a template has been found then save it.
175
				if ( locate_template( $location . $template ) != '' && $content_found !== true ) {
176
					// Save template found.
177
					if ( ! empty( $post_format ) ) {
178
						update_option( 'auto_load_next_post_directory_post_' . $post_format, $location );
179
					} else {
180
						update_option( 'auto_load_next_post_directory_' . $post_type, $location );
181
					}
182
183
					$content_found = true;
184
				}
185
			}
186
		}
187
	} // END alnp_scan_directories()
188
}
189
190 View Code Duplication
if ( ! function_exists( 'alnp_get_template_directory' ) ) {
191
	/**
192
	 * Returns the template directory saved.
193
	 *
194
	 * @since  1.6.0
195
	 * @param  string $post_type
196
	 * @param  string $post_format
197
	 * @return string $template
198
	 */
199
	function alnp_get_template_directory( $post_type = 'post', $post_format = '' ) {
200
		if ( ! empty( $post_format ) ) {
201
			$template = get_option( 'auto_load_next_post_directory_post_' . $post_format );
202
		} else {
203
			$template = get_option( 'auto_load_next_post_directory_' . $post_type );
204
		}
205
206
		if ( !$template ) {
207
			return '';
208
		}
209
210
		return $template;
211
	} // END alnp_get_template_directory()
212
}
213
214 View Code Duplication
if ( ! function_exists( 'alnp_get_template' ) ) {
215
	/**
216
	 * Returns the template file saved.
217
	 *
218
	 * @since  1.6.0
219
	 * @param  string $post_type
220
	 * @param  string $post_format
221
	 * @return string $template
222
	*/
223
	function alnp_get_template( $post_type = 'post', $post_format = '' ) {
224
		if ( ! empty( $post_format ) ) {
225
			$template = get_option( 'auto_load_next_post_template_post_' . strtolower( $post_format ) );
226
		} else {
227
			$template = get_option( 'auto_load_next_post_template_' . strtolower( $post_type ) );
228
		}
229
230
		if ( !$template ) {
231
			return '';
232
		}
233
234
		return $template;
235
	} // END alnp_get_template()
236
}
237
238
if ( ! function_exists( 'alnp_find_template' ) ) {
239
	/**
240
	 * Scans through the active theme to look for the content to load.
241
	 * If the content is not found then the fallback will be used.
242
	 *
243
	 * @since  1.6.0
244
	 * @param  string $location
245
	 * @param  string $post_type
246
	 * @param  string $post_format
247
	 * @return array
248
	*/
249
	function alnp_find_template( $location = '', $post_type, $post_format ) {
250
		// Templates to look for based on the post that is loaded.
251
		$templates = alnp_get_templates( $post_type, $post_format );
252
253
		$found = false;
254
255
		// Scanning all possible templates within the set location.
256
		foreach( $templates as $template ) {
257
			// Remove forwardslash if location is the parent theme folder.
258
			if ( empty( $location ) ) {
259
				$location = str_replace('/', '', $location);
260
			}
261
262
			// If a template has been found then return it.
263
			if ( locate_template( $location . $template ) != '' && $found != true ) {
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison !== instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
264
				$file = $location . $template;
265
266
				if ( ! empty( $post_format ) ) {
267
					update_option( 'auto_load_next_post_template_post_' . strtolower( $post_format ), $file );
268
				} else {
269
					update_option( 'auto_load_next_post_template_' . strtolower( $post_type ), $file );
270
				}
271
		
272
				$found = true;
273
			}
274
		}
275
276
		return array(
277
			'template' => $file,
0 ignored issues
show
The variable $file does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
278
			'found'    => $found
279
		);
280
	} // END alnp_find_template()
281
}
282
283
if ( ! function_exists( 'alnp_load_content' ) ) {
284
	/**
285
	 * Loads theme template set either by theme support or setup wizard.
286
	 * If the content is not found then a fallback template will be used.
287
	 *
288
	 * @since 1.6.0
289
	 * @param string $post_type
290
	 * @param string $post_format
291
	 */
292
	function alnp_load_content( $post_type, $post_format ) {
293
		// Returns template location for supported themes.
294
		$template_location = alnp_template_location();
295
296
		$content_found = false;
297
298
		// Check and return directory and template if already found.
299
		if ( empty( $template_location ) ) {
300
			$directory = alnp_get_template_directory( $post_type, $post_format );
301
		} else {
302
			$directory = $template_location;
303
		}
304
305
		$template = alnp_get_template( $post_type, $post_format );
306
307
		if ( ! empty( $directory ) && ! empty( $template ) ) {
308
			$template      = $directory . $template;
309
			$content_found = true;
310
		} else {
311
			// Possible locations where the content files are found.
312
			$locations = alnp_get_locations();
313
314
			// Scanning all possible locations.
315
			foreach( $locations as $location ) {
316
				$template      = alnp_find_template( $directory, $post_type, $post_format );
0 ignored issues
show
It seems like $directory defined by $template_location on line 302 can also be of type boolean; however, alnp_find_template() does only seem to accept string, maybe add an additional type check?

If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:

/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.

Loading history...
317
				$content_found = $template['found'];
318
			}
319
		}
320
321
		// Can be overridden.
322
		$content_found = apply_filters( 'alnp_content_found', $content_found );
323
324
		// Check if the user has forced the use of the fallback template.
325
		$use_fallback = get_option( 'auto_load_next_post_use_fallback' );
326
327
		// If content is found then load the template part.
328
		if ( $content_found && empty( $use_fallback ) ) {
329
			locate_template( $template, true, false );
330
		}
331
		else {
332
			do_action( 'alnp_load_content', $post_type );
333
		}
334
	} // END alnp_load_content()
335
}
336
337
if ( ! function_exists( 'alnp_load_fallback_content' ) ) {
338
	/**
339
	 * Load fallback template should no content file be found.
340
	 *
341
	 * @since 1.6.0
342
	 * @param string $post_type
343
	 */
344
	function alnp_load_fallback_content( $post_type ) {
345
		get_template_part( AUTO_LOAD_NEXT_POST_FILE_PATH . '/templates/content/content', $post_type );
346
	} // END alnp_load_fallback_content()
347
}
348