Passed
Pull Request — master (#330)
by Brian
05:04
created

WPInv_Reports   F

Complexity

Total Complexity 143

Size/Duplication

Total Lines 1055
Duplicated Lines 0 %

Importance

Changes 3
Bugs 0 Features 0
Metric Value
eloc 628
c 3
b 0
f 0
dl 0
loc 1055
rs 1.972
wmc 143

35 Methods

Rating   Name   Duplication   Size   Complexity  
A includes() 0 2 1
A init() 0 17 2
A __construct() 0 4 1
A attach_export_data() 0 11 3
A set_invoices_export() 0 4 4
A get_export_status() 0 3 1
A get_invoice_items() 0 13 3
A set_export_params() 0 8 3
A actions() 0 20 2
A process_export_step() 0 12 3
B get_time_format() 0 30 11
A tax_report() 0 21 3
B ajax_export() 0 56 11
B check_export_location() 0 30 11
A export_location() 0 6 2
B get_invoices_data() 0 70 9
A gateways_report() 0 6 1
A print_columns() 0 14 3
D fill_nulls() 0 121 22
B discount_use_export() 0 52 6
A get_export_file() 0 10 2
A get_sql_clauses() 0 81 2
B invoices_export_status() 0 35 7
A get_report_results() 0 20 1
A get_columns() 0 4 1
A get_invoices_columns() 0 33 1
A print_rows() 0 24 6
A get_stats() 0 15 2
A get_export_data() 0 7 1
A export() 0 59 1
A add_submenu() 0 3 1
A reports() 0 31 4
B reports_page() 0 27 6
A earnings_report() 0 21 1
A period_filter() 0 37 5

How to fix   Complexity   

Complex Class

Complex classes like WPInv_Reports often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.

Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.

While breaking up the class, it is a good idea to analyze how other classes use WPInv_Reports, and based on these observations, apply Extract Interface, too.

1
<?php
2
if ( ! defined( 'ABSPATH' ) ) {
3
    exit; // Exit if accessed directly
4
}
5
6
class WPInv_Reports {
7
    private $section = 'wpinv_reports';
0 ignored issues
show
introduced by
The private property $section is not used, and could be removed.
Loading history...
8
    private $wp_filesystem;
9
    private $export_dir;
10
    private $export_url;
11
    private $export;
12
    public $filetype;
13
    public $per_page;
14
    
15
    public function __construct() {
16
        $this->init();
17
        $this->includes();
18
        $this->actions();
19
    }
20
    
21
    public function init() {
22
        global $wp_filesystem;
23
24
        if ( empty( $wp_filesystem ) ) {
25
            require_once( ABSPATH . '/wp-admin/includes/file.php' );
26
            WP_Filesystem();
27
            global $wp_filesystem;
28
        }
29
        $this->wp_filesystem    = $wp_filesystem;
30
        
31
        $this->export_dir       = $this->export_location();
32
        $this->export_url       = $this->export_location( true );
33
        $this->export           = 'invoicing';
34
        $this->filetype         = 'csv';
35
        $this->per_page         = 20;
36
        
37
        do_action( 'wpinv_class_reports_init', $this );
38
    }
39
    
40
    public function includes() {
41
        do_action( 'wpinv_class_reports_includes', $this );
42
    }
43
    
44
    public function actions() {
45
        if ( is_admin() ) {
46
            add_action( 'admin_menu', array( $this, 'add_submenu' ), 20 );
47
            add_action( 'wpinv_reports_tab_reports', array( $this, 'reports' ) );
48
            add_action( 'wpinv_reports_tab_export', array( $this, 'export' ) );
49
            add_action( 'wp_ajax_wpinv_ajax_export', array( $this, 'ajax_export' ) );
50
            add_action( 'wp_ajax_wpinv_ajax_discount_use_export', array( $this, 'discount_use_export' ) );
51
52
            // Export Invoices.
53
            add_action( 'wpinv_export_set_params_invoices', array( $this, 'set_invoices_export' ) );
54
            add_filter( 'wpinv_export_get_columns_invoices', array( $this, 'get_invoices_columns' ) );
55
            add_filter( 'wpinv_export_get_data_invoices', array( $this, 'get_invoices_data' ) );
56
            add_filter( 'wpinv_get_export_status_invoices', array( $this, 'invoices_export_status' ) );
57
58
            // Reports.
59
            add_action( 'wpinv_reports_view_earnings', array( $this, 'earnings_report' ) );
60
            add_action( 'wpinv_reports_view_gateways', array( $this, 'gateways_report' ) );
61
            add_action( 'wpinv_reports_view_taxes', array( $this, 'tax_report' ) );
62
        }
63
        do_action( 'wpinv_class_reports_actions', $this );
64
    }
65
    
66
    public function add_submenu() {
67
        global $wpi_reports_page;
68
        $wpi_reports_page = add_submenu_page( 'wpinv', __( 'Reports', 'invoicing' ), __( 'Reports', 'invoicing' ), wpinv_get_capability(), 'wpinv-reports', array( $this, 'reports_page' ) );
69
    }
70
    
71
    public function reports_page() {
72
73
        if ( !wp_script_is( 'postbox', 'enqueued' ) ) {
74
            wp_enqueue_script( 'postbox' );
75
        }
76
77
        if ( !wp_script_is( 'jquery-ui-datepicker', 'enqueued' ) ) {
78
            wp_enqueue_script( 'jquery-ui-datepicker' );
79
        }
80
        
81
        $current_page = admin_url( 'admin.php?page=wpinv-reports' );
82
        $active_tab = isset( $_GET['tab'] ) ? sanitize_text_field( $_GET['tab'] ) : 'reports';
83
        ?>
84
        <div class="wrap wpi-reports-wrap">
85
            <h1><?php echo esc_html( __( 'Reports', 'invoicing' ) ); ?></h1>
86
            <h2 class="nav-tab-wrapper wp-clearfix">
87
                <a href="<?php echo add_query_arg( array( 'tab' => 'reports', 'settings-updated' => false ), $current_page ); ?>" class="nav-tab <?php echo $active_tab == 'reports' ? 'nav-tab-active' : ''; ?>"><?php _e( 'Reports', 'invoicing' ); ?></a>
0 ignored issues
show
Security Cross-Site Scripting introduced by
add_query_arg(array('tab... false), $current_page) can contain request data and is used in html attribute with double-quotes context(s) leading to a potential security vulnerability.

2 paths for user data to reach this point

  1. Path: Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri in wordpress/wp-includes/functions.php on line 1091
  1. Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri
    in wordpress/wp-includes/functions.php on line 1091
  2. $uri . '?' is assigned to $base
    in wordpress/wp-includes/functions.php on line 1118
  3. $protocol . $base . $ret . $frag is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1144
  4. Data is passed through rtrim(), and rtrim($ret, '?') is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1145
  5. $ret is returned
    in wordpress/wp-includes/functions.php on line 1146
  2. Path: Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri in wordpress/wp-includes/functions.php on line 1085
  1. Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri
    in wordpress/wp-includes/functions.php on line 1085
  2. $uri . '?' is assigned to $base
    in wordpress/wp-includes/functions.php on line 1118
  3. $protocol . $base . $ret . $frag is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1144
  4. Data is passed through rtrim(), and rtrim($ret, '?') is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1145
  5. $ret is returned
    in wordpress/wp-includes/functions.php on line 1146

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
88
                <a href="<?php echo add_query_arg( array( 'tab' => 'export', 'settings-updated' => false ), $current_page ); ?>" class="nav-tab <?php echo $active_tab == 'export' ? 'nav-tab-active' : ''; ?>"><?php _e( 'Export', 'invoicing' ); ?></a>
0 ignored issues
show
Security Cross-Site Scripting introduced by
add_query_arg(array('tab... false), $current_page) can contain request data and is used in html attribute with double-quotes context(s) leading to a potential security vulnerability.

2 paths for user data to reach this point

  1. Path: Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri in wordpress/wp-includes/functions.php on line 1091
  1. Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri
    in wordpress/wp-includes/functions.php on line 1091
  2. $uri . '?' is assigned to $base
    in wordpress/wp-includes/functions.php on line 1118
  3. $protocol . $base . $ret . $frag is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1144
  4. Data is passed through rtrim(), and rtrim($ret, '?') is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1145
  5. $ret is returned
    in wordpress/wp-includes/functions.php on line 1146
  2. Path: Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri in wordpress/wp-includes/functions.php on line 1085
  1. Read tainted data from array, and $_SERVER['REQUEST_URI'] is assigned to $uri
    in wordpress/wp-includes/functions.php on line 1085
  2. $uri . '?' is assigned to $base
    in wordpress/wp-includes/functions.php on line 1118
  3. $protocol . $base . $ret . $frag is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1144
  4. Data is passed through rtrim(), and rtrim($ret, '?') is assigned to $ret
    in wordpress/wp-includes/functions.php on line 1145
  5. $ret is returned
    in wordpress/wp-includes/functions.php on line 1146

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
89
                <?php do_action( 'wpinv_reports_page_tabs' ); ;?>
90
            </h2>
91
            <div class="wpi-reports-content wpi-reports-<?php echo esc_attr( $active_tab ); ?>">
92
            <?php
93
                do_action( 'wpinv_reports_page_top' );
94
                do_action( 'wpinv_reports_tab_' . $active_tab );
95
                do_action( 'wpinv_reports_page_bottom' );
96
            ?>
97
        </div>
98
        <?php
99
    }
100
101
    /**
102
     * Displays the reports graphs.
103
     */
104
    public function reports() {
105
106
        $views = array(
107
            'earnings'   => __( 'Earnings', 'invoicing' ),
108
            'gateways'   => __( 'Payment Methods', 'invoicing' ),
109
            'taxes'      => __( 'Taxes', 'invoicing' ),
110
        );
111
    
112
        $views   = apply_filters( 'wpinv_report_views', $views );
113
        $current = 'earnings';
114
115
        if ( isset( $_GET['view'] ) && array_key_exists( $_GET['view'], $views ) )
116
		$current = $_GET['view'];
117
118
        ?>
119
	        <form id="wpinv-reports-filter" method="get" class="tablenav">
120
		        <select id="wpinv-reports-view" name="view">
121
			        <option value="-1" disabled><?php _e( 'Report Type', 'invoicing' ); ?></option>
122
			            <?php foreach ( $views as $view_id => $label ) : ?>
123
				            <option value="<?php echo esc_attr( $view_id ); ?>" <?php selected( $view_id, $current ); ?>><?php echo $label; ?></option>
124
			            <?php endforeach; ?>
125
		        </select>
126
127
		        <?php do_action( 'wpinv_report_view_actions' ); ?>
128
129
		        <input type="hidden" name="page" value="wpinv-reports"/>
130
		        <?php submit_button( __( 'Show', 'invoicing' ), 'secondary', 'submit', false ); ?>
131
	        </form>
132
        <?php
133
134
	    do_action( 'wpinv_reports_view_' . $current );
135
136
    }
137
    
138
    public function export() {
139
        $statuses = wpinv_get_invoice_statuses( true );
140
        $statuses = array_merge( array( 'any' => __( 'All Statuses', 'invoicing' ) ), $statuses );
141
        ?>
142
        <div class="metabox-holder">
143
            <div id="post-body">
144
                <div id="post-body-content">
145
                    <?php do_action( 'wpinv_reports_tab_export_content_top' ); ?>
146
                    
147
                    <div class="postbox wpi-export-invoices">
148
                        <h2 class="hndle ui-sortabled-handle"><span><?php _e( 'Invoices','invoicing' ); ?></span></h2>
149
                        <div class="inside">
150
                            <p><?php _e( 'Download a CSV of all payment invoices.', 'invoicing' ); ?></p>
151
                            <form id="wpi-export-invoices" class="wpi-export-form" method="post">
152
                                <?php echo wpinv_html_date_field( array( 
153
                                    'id' => 'wpi_export_from_date', 
154
                                    'name' => 'from_date',
155
                                    'data' => array(
156
                                        'dateFormat' => 'yy-mm-dd'
157
                                    ),
158
                                    'placeholder' => __( 'From date', 'invoicing' ) )
159
                                ); ?>
160
                                <?php echo wpinv_html_date_field( array( 
161
                                    'id' => 'wpi_export_to_date',
162
                                    'name' => 'to_date',
163
                                    'data' => array(
164
                                        'dateFormat' => 'yy-mm-dd'
165
                                    ),
166
                                    'placeholder' => __( 'To date', 'invoicing' ) )
167
                                ); ?>
168
                                <span id="wpinv-status-wrap">
169
                                <?php echo wpinv_html_select( array(
170
                                    'options'          => $statuses,
171
                                    'name'             => 'status',
172
                                    'id'               => 'wpi_export_status',
173
                                    'show_option_all'  => false,
174
                                    'show_option_none' => false,
175
                                    'class'            => 'wpi_select2',
176
                                ) ); ?>
177
                                <?php wp_nonce_field( 'wpi_ajax_export', 'wpi_ajax_export' ); ?>
178
                                </span>
179
                                <span id="wpinv-submit-wrap">
180
                                    <input type="hidden" value="invoices" name="export" />
181
                                    <input type="submit" value="<?php _e( 'Generate CSV', 'invoicing' ); ?>" class="button-primary" />
182
                                </span>
183
                            </form>
184
                        </div>
185
                    </div>
186
187
                    <div class="postbox wpi-export-discount-uses">
188
                        <h2 class="hndle ui-sortabled-handle"><span><?php _e( 'Discount Use','invoicing' ); ?></span></h2>
189
                        <div class="inside">
190
                            <p><?php _e( 'Download a CSV of discount uses.', 'invoicing' ); ?></p>
191
                            <a class="button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-ajax.php?action=wpinv_ajax_discount_use_export' ), 'wpi_discount_ajax_export', 'wpi_discount_ajax_export' ) ); ?>"><?php _e( 'Generate CSV', 'invoicing' ); ?></a>
192
                        </div>
193
                    </div>
194
                    
195
                    <?php do_action( 'wpinv_reports_tab_export_content_bottom' ); ?>
196
                </div>
197
            </div>
198
        </div>
199
        <?php
200
    }
201
    
202
    public function export_location( $relative = false ) {
203
        $upload_dir         = wp_upload_dir();
204
        $export_location    = $relative ? trailingslashit( $upload_dir['baseurl'] ) . 'cache' : trailingslashit( $upload_dir['basedir'] ) . 'cache';
205
        $export_location    = apply_filters( 'wpinv_export_location', $export_location, $relative );
206
        
207
        return trailingslashit( $export_location );
208
    }
209
    
210
    public function check_export_location() {
211
        try {
212
            if ( empty( $this->wp_filesystem ) ) {
213
                return __( 'Filesystem ERROR: Could not access filesystem.', 'invoicing' );
214
            }
215
216
            if ( is_wp_error( $this->wp_filesystem ) ) {
217
                return __( 'Filesystem ERROR: ' . $this->wp_filesystem->get_error_message(), 'invoicing' );
218
            }
219
        
220
            $is_dir         = $this->wp_filesystem->is_dir( $this->export_dir );
221
            $is_writeable   = $is_dir && is_writeable( $this->export_dir );
222
            
223
            if ( $is_dir && $is_writeable ) {
224
               return true;
225
            } else if ( $is_dir && !$is_writeable ) {
226
               if ( !$this->wp_filesystem->chmod( $this->export_dir, FS_CHMOD_DIR ) ) {
227
                   return wp_sprintf( __( 'Filesystem ERROR: Export location %s is not writable, check your file permissions.', 'invoicing' ), $this->export_dir );
228
               }
229
               
230
               return true;
231
            } else {
232
                if ( !$this->wp_filesystem->mkdir( $this->export_dir, FS_CHMOD_DIR ) ) {
233
                    return wp_sprintf( __( 'Filesystem ERROR: Could not create directory %s. This is usually due to inconsistent file permissions.', 'invoicing' ), $this->export_dir );
234
                }
235
                
236
                return true;
237
            }
238
        } catch ( Exception $e ) {
239
            return $e->getMessage();
240
        }
241
    }
242
    
243
    public function ajax_export() {
244
        $response               = array();
245
        $response['success']    = false;
246
        $response['msg']        = __( 'Invalid export request found.', 'invoicing' );
247
        
248
        if ( empty( $_POST['data'] ) || ! wpinv_current_user_can_manage_invoicing() ) {
249
            wp_send_json( $response );
250
        }
251
252
        parse_str( $_POST['data'], $data );
0 ignored issues
show
Security Variable Injection introduced by
$_POST['data'] can contain request data and is used in variable name context(s) leading to a potential security vulnerability.

1 path for user data to reach this point

  1. Read from $_POST
    in includes/class-wpinv-reports.php on line 252

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
253
        
254
        $data['step']   = !empty( $_POST['step'] ) ? absint( $_POST['step'] ) : 1;
255
256
        $_REQUEST = (array)$data;
257
        if ( !( !empty( $_REQUEST['wpi_ajax_export'] ) && wp_verify_nonce( $_REQUEST['wpi_ajax_export'], 'wpi_ajax_export' ) ) ) {
258
            $response['msg']    = __( 'Security check failed.', 'invoicing' );
259
            wp_send_json( $response );
260
        }
261
        
262
        if ( ( $error = $this->check_export_location( true ) ) !== true ) {
0 ignored issues
show
Unused Code introduced by
The call to WPInv_Reports::check_export_location() has too many arguments starting with true. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

262
        if ( ( $error = $this->/** @scrutinizer ignore-call */ check_export_location( true ) ) !== true ) {

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
263
            $response['msg'] = __( 'Filesystem ERROR: ' . $error, 'invoicing' );
264
            wp_send_json( $response );
265
        }
266
                        
267
        $this->set_export_params( $_REQUEST );
268
        
269
        $return = $this->process_export_step();
270
        $done   = $this->get_export_status();
271
        
272
        if ( $return ) {
273
            $this->step += 1;
274
            
275
            $response['success']    = true;
276
            $response['msg']        = '';
277
            
278
            if ( $done >= 100 ) {
279
                $this->step     = 'done';
0 ignored issues
show
Bug Best Practice introduced by
The property step does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
280
                $new_filename   = 'wpi-' . $this->export . '-' . date( 'y-m-d-H-i' ) . '.' . $this->filetype;
281
                $new_file       = $this->export_dir . $new_filename;
282
                
283
                if ( file_exists( $this->file ) ) {
284
                    $this->wp_filesystem->move( $this->file, $new_file, true );
285
                }
286
                
287
                if ( file_exists( $new_file ) ) {
288
                    $response['data']['file'] = array( 'u' => $this->export_url . $new_filename, 's' => size_format( filesize( $new_file ), 2 ) );
289
                }
290
            }
291
            
292
            $response['data']['step']   = $this->step;
293
            $response['data']['done']   = $done;
294
        } else {
295
            $response['msg']    = __( 'No data found for export.', 'invoicing' );
296
        }
297
298
        wp_send_json( $response );
299
    }
300
301
    /**
302
     * Handles discount exports.
303
     */
304
    public function discount_use_export() {
305
306
        if ( ! wp_verify_nonce( $_GET['wpi_discount_ajax_export'], 'wpi_discount_ajax_export' ) || ! wpinv_current_user_can_manage_invoicing() ) {
307
            wp_die( -1, 403 );
308
        }
309
310
        $args = array(
311
            'post_type'      => 'wpi_discount',
312
            'fields'         => 'ids',
313
            'posts_per_page' => -1,
314
        );
315
316
        $discounts = get_posts( $args );
317
318
        if ( empty( $discounts ) ) {
319
            die ( __( 'You have not set up any discounts', 'invoicing' ) );
0 ignored issues
show
Best Practice introduced by
Using exit here is not recommended.

In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.

Loading history...
320
        }
321
322
        $output  = fopen( 'php://output', 'w' ) or die( 'Unsupported server' );
0 ignored issues
show
Best Practice introduced by
Using exit here is not recommended.

In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.

Loading history...
323
324
        // Let the browser know what content we're streaming and how it should save the content.
325
		$name = time();
326
		header( "Content-Type:application/csv" );
327
        header( "Content-Disposition:attachment;filename=noptin-subscribers-$name.csv" );
328
329
        // Output the csv column headers.
330
		fputcsv( 
331
            $output, 
0 ignored issues
show
Bug introduced by
It seems like $output can also be of type false; however, parameter $handle of fputcsv() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

331
            /** @scrutinizer ignore-type */ $output, 
Loading history...
332
            array( 
333
                __( 'Discount Id', 'invoicing' ),
334
                __( 'Discount Code', 'invoicing' ),
335
                __( 'Discount Type', 'invoicing' ),
336
                __( 'Discount Amount', 'invoicing' ),
337
                __( 'Uses', 'invoicing' ),
338
            )
339
        );
340
341
        foreach ( $discounts as $discount ) {
342
343
            $discount = (int) $discount;
344
            $row      = array(
345
                $discount,
346
                get_post_meta( $discount, '_wpi_discount_code', true ),
347
                get_post_meta( $discount, '_wpi_discount_type', true ),
348
                get_post_meta( $discount, '_wpi_discount_amount', true ),
349
                (int) get_post_meta( $discount, '_wpi_discount_uses', true )
350
            );
351
            fputcsv( $output, $row );
352
        }
353
354
        fclose( $output );
0 ignored issues
show
Bug introduced by
It seems like $output can also be of type false; however, parameter $handle of fclose() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

354
        fclose( /** @scrutinizer ignore-type */ $output );
Loading history...
355
        exit;
0 ignored issues
show
Best Practice introduced by
Using exit here is not recommended.

In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.

Loading history...
356
357
    }
358
    
359
    public function set_export_params( $request ) {
360
        $this->empty    = false;
0 ignored issues
show
Bug Best Practice introduced by
The property empty does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
361
        $this->step     = !empty( $request['step'] ) ? absint( $request['step'] ) : 1;
0 ignored issues
show
Bug Best Practice introduced by
The property step does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
362
        $this->export   = !empty( $request['export'] ) ? $request['export'] : $this->export;
363
        $this->filename = 'wpi-' . $this->export . '-' . $request['wpi_ajax_export'] . '.' . $this->filetype;
0 ignored issues
show
Bug Best Practice introduced by
The property filename does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
364
        $this->file     = $this->export_dir . $this->filename;
0 ignored issues
show
Bug Best Practice introduced by
The property file does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
365
        
366
        do_action( 'wpinv_export_set_params_' . $this->export, $request );
367
    }
368
    
369
    public function get_columns() {
370
        $columns = array();
371
        
372
        return apply_filters( 'wpinv_export_get_columns_' . $this->export, $columns );
373
    }
374
    
375
    protected function get_export_file() {
376
        $file = '';
377
378
        if ( $this->wp_filesystem->exists( $this->file ) ) {
379
            $file = $this->wp_filesystem->get_contents( $this->file );
380
        } else {
381
            $this->wp_filesystem->put_contents( $this->file, '' );
382
        }
383
384
        return $file;
385
    }
386
    
387
    protected function attach_export_data( $data = '' ) {
388
        $filedata   = $this->get_export_file();
389
        $filedata   .= $data;
390
        
391
        $this->wp_filesystem->put_contents( $this->file, $filedata );
392
393
        $rows       = file( $this->file, FILE_SKIP_EMPTY_LINES );
0 ignored issues
show
Security File Exposure introduced by
$this->file can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability.

1 path for user data to reach this point

  1. Read from $_REQUEST, and WPInv_Reports::set_export_params() is called
    in includes/class-wpinv-reports.php on line 267
  2. Enters via parameter $request
    in includes/class-wpinv-reports.php on line 359
  3. 'wpi-' . $this->export . '-' . $request['wpi_ajax_export'] . '.' . $this->filetype is assigned to property WPInv_Reports::$filename
    in includes/class-wpinv-reports.php on line 363
  4. Read from property WPInv_Reports::$filename, and $this->export_dir . $this->filename is assigned to property WPInv_Reports::$file
    in includes/class-wpinv-reports.php on line 364
  5. Read from property WPInv_Reports::$file
    in includes/class-wpinv-reports.php on line 393

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
394
        $columns    = $this->get_columns();
395
        $columns    = empty( $columns ) ? 0 : 1;
396
397
        $this->empty = count( $rows ) == $columns ? true : false;
0 ignored issues
show
Bug Best Practice introduced by
The property empty does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
Bug introduced by
It seems like $rows can also be of type false; however, parameter $var of count() does only seem to accept Countable|array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

397
        $this->empty = count( /** @scrutinizer ignore-type */ $rows ) == $columns ? true : false;
Loading history...
398
    }
399
    
400
    public function print_columns() {
401
        $column_data    = '';
402
        $columns        = $this->get_columns();
403
        $i              = 1;
404
        foreach( $columns as $key => $column ) {
405
            $column_data .= '"' . addslashes( $column ) . '"';
406
            $column_data .= $i == count( $columns ) ? '' : ',';
407
            $i++;
408
        }
409
        $column_data .= "\r\n";
410
411
        $this->attach_export_data( $column_data );
412
413
        return $column_data;
414
    }
415
    
416
    public function process_export_step() {
417
        if ( $this->step < 2 ) {
418
            /** @scrutinizer ignore-unhandled */ @unlink( $this->file );
0 ignored issues
show
Security File Manipulation introduced by
$this->file can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

1 path for user data to reach this point

  1. Read from $_REQUEST, and WPInv_Reports::set_export_params() is called
    in includes/class-wpinv-reports.php on line 267
  2. Enters via parameter $request
    in includes/class-wpinv-reports.php on line 359
  3. 'wpi-' . $this->export . '-' . $request['wpi_ajax_export'] . '.' . $this->filetype is assigned to property WPInv_Reports::$filename
    in includes/class-wpinv-reports.php on line 363
  4. Read from property WPInv_Reports::$filename, and $this->export_dir . $this->filename is assigned to property WPInv_Reports::$file
    in includes/class-wpinv-reports.php on line 364
  5. Read from property WPInv_Reports::$file
    in includes/class-wpinv-reports.php on line 418

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
419
            $this->print_columns();
420
        }
421
        
422
        $return = $this->print_rows();
423
        
424
        if ( $return ) {
425
            return true;
426
        } else {
427
            return false;
428
        }
429
    }
430
    
431
    public function get_export_status() {
432
        $status = 100;
433
        return apply_filters( 'wpinv_get_export_status_' . $this->export, $status );
434
    }
435
    
436
    public function get_export_data() {
437
        $data = array();
438
439
        $data = apply_filters( 'wpinv_export_get_data', $data );
440
        $data = apply_filters( 'wpinv_export_get_data_' . $this->export, $data );
441
442
        return $data;
443
    }
444
    
445
    public function print_rows() {
446
        $row_data   = '';
447
        $data       = $this->get_export_data();
448
        $columns    = $this->get_columns();
449
450
        if ( $data ) {
451
            foreach ( $data as $row ) {
452
                $i = 1;
453
                foreach ( $row as $key => $column ) {
454
                    if ( array_key_exists( $key, $columns ) ) {
455
                        $row_data .= '"' . addslashes( preg_replace( "/\"/","'", $column ) ) . '"';
456
                        $row_data .= $i == count( $columns ) ? '' : ',';
457
                        $i++;
458
                    }
459
                }
460
                $row_data .= "\r\n";
461
            }
462
463
            $this->attach_export_data( $row_data );
464
465
            return $row_data;
466
        }
467
468
        return false;
469
    }
470
    
471
    // Export Invoices.
472
    public function set_invoices_export( $request ) {
473
        $this->from_date    = isset( $request['from_date'] ) ? sanitize_text_field( $request['from_date'] ) : '';
0 ignored issues
show
Bug Best Practice introduced by
The property from_date does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
474
        $this->to_date      = isset( $request['to_date'] ) ? sanitize_text_field( $request['to_date'] ) : '';
0 ignored issues
show
Bug Best Practice introduced by
The property to_date does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
475
        $this->status       = isset( $request['status'] ) ? sanitize_text_field( $request['status'] ) : 'publish';
0 ignored issues
show
Bug Best Practice introduced by
The property status does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
476
    }
477
    
478
    public function get_invoices_columns( $columns = array() ) {
479
        $columns = array(
480
            'id'            => __( 'ID',   'invoicing' ),
481
            'number'        => __( 'Number',   'invoicing' ),
482
            'date'          => __( 'Date', 'invoicing' ),
483
            'due_date'      => __( 'Due Date', 'invoicing' ),
484
            'completed_date'=> __( 'Payment Done Date', 'invoicing' ),
485
            'amount'        => __( 'Amount', 'invoicing' ),
486
            'currency'      => __( 'Currency', 'invoicing' ),
487
            'items'        => __( 'Items', 'invoicing' ),
488
            'status_nicename'  => __( 'Status Nicename', 'invoicing' ),
489
            'status'        => __( 'Status', 'invoicing' ),
490
            'tax'           => __( 'Tax', 'invoicing' ),
491
            'discount'      => __( 'Discount', 'invoicing' ),
492
            'user_id'       => __( 'User ID', 'invoicing' ),
493
            'email'         => __( 'Email', 'invoicing' ),
494
            'first_name'    => __( 'First Name', 'invoicing' ),
495
            'last_name'     => __( 'Last Name', 'invoicing' ),
496
            'address'       => __( 'Address', 'invoicing' ),
497
            'city'          => __( 'City', 'invoicing' ),
498
            'state'         => __( 'State', 'invoicing' ),
499
            'country'       => __( 'Country', 'invoicing' ),
500
            'zip'           => __( 'Zipcode', 'invoicing' ),
501
            'phone'         => __( 'Phone', 'invoicing' ),
502
            'company'       => __( 'Company', 'invoicing' ),
503
            'vat_number'    => __( 'Vat Number', 'invoicing' ),
504
            'ip'            => __( 'IP', 'invoicing' ),
505
            'gateway'       => __( 'Gateway', 'invoicing' ),
506
            'gateway_nicename'       => __( 'Gateway Nicename', 'invoicing' ),
507
            'transaction_id'=> __( 'Transaction ID', 'invoicing' ),
508
        );
509
510
        return $columns;
511
    }
512
        
513
    public function get_invoices_data( $response = array() ) {
514
        $args = array(
515
            'limit'    => $this->per_page,
516
            'page'     => $this->step,
517
            'order'    => 'DESC',
518
            'orderby'  => 'date',
519
        );
520
        
521
        if ( $this->status != 'any' ) {
522
            $args['status'] = $this->status;
523
        } else {
524
            $args['status'] = array_keys( wpinv_get_invoice_statuses( true ) );
525
        }
526
527
        if ( !empty( $this->from_date ) || !empty( $this->to_date ) ) {
528
            $args['date_query'] = array(
529
                array(
530
                    'after'     => date( 'Y-n-d 00:00:00', strtotime( $this->from_date ) ),
531
                    'before'    => date( 'Y-n-d 23:59:59', strtotime( $this->to_date ) ),
532
                    'inclusive' => true
533
                )
534
            );
535
        }
536
537
        $invoices = wpinv_get_invoices( $args );
538
        
539
        $data = array();
540
        
541
        if ( !empty( $invoices ) ) {
542
            foreach ( $invoices as $invoice ) {
543
                $items = $this->get_invoice_items($invoice);
544
                $row = array(
545
                    'id'            => $invoice->ID,
546
                    'number'        => $invoice->get_number(),
547
                    'date'          => $invoice->get_invoice_date( false ),
548
                    'due_date'      => $invoice->get_due_date( false ),
549
                    'completed_date'=> $invoice->get_completed_date(),
550
                    'amount'        => wpinv_round_amount( $invoice->get_total() ),
551
                    'currency'      => $invoice->get_currency(),
552
                    'items'         => $items,
553
                    'status_nicename' => $invoice->get_status( true ),
554
                    'status'        => $invoice->get_status(),
555
                    'tax'           => $invoice->get_tax() > 0 ? wpinv_round_amount( $invoice->get_tax() ) : '',
556
                    'discount'      => $invoice->get_discount() > 0 ? wpinv_round_amount( $invoice->get_discount() ) : '',
557
                    'user_id'       => $invoice->get_user_id(),
558
                    'email'         => $invoice->get_email(),
559
                    'first_name'    => $invoice->get_first_name(),
560
                    'last_name'     => $invoice->get_last_name(),
561
                    'address'       => $invoice->get_address(),
562
                    'city'          => $invoice->city,
563
                    'state'         => $invoice->state,
564
                    'country'       => $invoice->country,
565
                    'zip'           => $invoice->zip,
566
                    'phone'         => $invoice->phone,
567
                    'company'       => $invoice->company,
568
                    'vat_number'    => $invoice->vat_number,
569
                    'ip'            => $invoice->get_ip(),
570
                    'gateway'       => $invoice->get_gateway(),
571
                    'gateway_nicename' => $invoice->get_gateway_title(),
572
                    'transaction_id'=> $invoice->gateway ? $invoice->get_transaction_id() : '',
573
                );
574
                
575
                $data[] = apply_filters( 'wpinv_export_invoice_row', $row, $invoice );
576
            }
577
578
            return $data;
579
580
        }
581
582
        return false;
583
    }
584
    
585
    public function invoices_export_status() {
586
        $args = array(
587
            'limit'    => -1,
588
            'return'   => 'ids',
589
        );
590
        
591
        if ( $this->status != 'any' ) {
592
            $args['status'] = $this->status;
593
        } else {
594
            $args['status'] = array_keys( wpinv_get_invoice_statuses( true ) );
595
        }
596
597
        if ( !empty( $this->from_date ) || !empty( $this->to_date ) ) {
598
            $args['date_query'] = array(
599
                array(
600
                    'after'     => date( 'Y-n-d 00:00:00', strtotime( $this->from_date ) ),
601
                    'before'    => date( 'Y-n-d 23:59:59', strtotime( $this->to_date ) ),
602
                    'inclusive' => true
603
                )
604
            );
605
        }
606
607
        $invoices   = wpinv_get_invoices( $args );
608
        $total      = !empty( $invoices ) ? count( $invoices ) : 0;
0 ignored issues
show
Bug introduced by
It seems like $invoices can also be of type WP_Query; however, parameter $var of count() does only seem to accept Countable|array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

608
        $total      = !empty( $invoices ) ? count( /** @scrutinizer ignore-type */ $invoices ) : 0;
Loading history...
609
        $status     = 100;
610
611
        if ( $total > 0 ) {
612
            $status = ( ( $this->per_page * $this->step ) / $total ) * 100;
613
        }
614
615
        if ( $status > 100 ) {
616
            $status = 100;
617
        }
618
619
        return $status;
620
    }
621
622
    public function get_invoice_items($invoice){
623
        if(!$invoice){
624
            return '';
625
        }
626
627
        $cart_details = $invoice->get_cart_details();
628
        if(!empty($cart_details)){
629
            $cart_details = maybe_serialize($cart_details);
630
        } else {
631
            $cart_details = '';
632
        }
633
634
        return $cart_details;
635
    }
636
637
    /**
638
     * Returns the periods filter.
639
     */
640
    public function period_filter( $args = array() ) {
641
642
        ob_start();
643
644
        echo '<form id="wpinv-graphs-filter" method="get" style="margin-bottom: 10px;" class="tablenav">';
645
        echo '<input type="hidden" name="page" value="wpinv-reports">';
646
647
        foreach ( $args as $key => $val ) {
648
            $key = esc_attr($key);
649
            $val = esc_attr($val);
650
            echo "<input type='hidden' name='$key' value='$val'>";
651
        }
652
653
        echo '<select id="wpinv-graphs-date-options" name="range" style="min-width: 200px;" onChange="this.form.submit()">';
654
655
        $ranges = array(
656
            'today'        => __( 'Today', 'invoicing' ),
657
            'yesterday'    => __( 'Yesterday', 'invoicing' ),
658
            'this_week'    => __( 'This Week', 'invoicing' ),
659
            'last_week'    => __( 'Last Week', 'invoicing' ),
660
            '7_days_ago'   => __( 'Last 7 Days', 'invoicing' ),
661
            '30_days_ago'  => __( 'Last 30 Days', 'invoicing' ),
662
            'this_month'   => __( 'This Month', 'invoicing' ),
663
            'this_year'    => __( 'This Year', 'invoicing' ),
664
            'last_year'    => __( 'Last Year', 'invoicing' ),
665
        );
666
667
        $range = isset( $_GET['range'] ) && isset( $ranges[ $_GET['range'] ] ) ? $_GET['range'] : '7_days_ago';
668
669
        foreach ( $ranges as $val => $label ) {
670
            $selected = selected( $range, $val, false );
671
            echo "<option value='$val' $selected>$label</option>";
672
        }
673
674
        echo '</select></form>';
675
676
        return ob_get_clean();
677
    }
678
679
    /**
680
     * Returns the the current date range.
681
     */
682
    public function get_sql_clauses( $range ) {
683
684
        $date     = 'CAST(completed.meta_value AS DATE)';
685
        $datetime = 'CAST(completed.meta_value AS DATETIME)';
686
687
        // Prepare durations.
688
        $today                = current_time( 'Y-m-d' );
689
        $yesterday            = date( 'Y-m-d', strtotime( '-1 day', current_time( 'timestamp' ) ) );
690
        $sunday               = date( 'Y-m-d', strtotime( 'sunday this week', current_time( 'timestamp' ) ) );
691
        $monday               = date( 'Y-m-d', strtotime( 'monday this week', current_time( 'timestamp' ) ) );
692
        $last_sunday          = date( 'Y-m-d', strtotime( 'sunday last week', current_time( 'timestamp' ) ) );
693
        $last_monday          = date( 'Y-m-d', strtotime( 'monday last week', current_time( 'timestamp' ) ) );
694
        $seven_days_ago       = date( 'Y-m-d', strtotime( '-7 days', current_time( 'timestamp' ) ) );
695
        $thirty_days_ago      = date( 'Y-m-d', strtotime( '-30 days', current_time( 'timestamp' ) ) );
696
        $first_day_month  	  = date( 'Y-m-1', current_time( 'timestamp' ) );
697
        $last_day_month  	  = date( 'Y-m-t', current_time( 'timestamp' ) );
698
		$first_day_last_month = date( 'Y-m-d', strtotime( 'first day of last month', current_time( 'timestamp' ) ) );
699
        $last_day_last_month  = date( 'Y-m-d', strtotime( 'last day of last month', current_time( 'timestamp' ) ) );
700
        $first_day_year  	  = date( 'Y-1-1', current_time( 'timestamp' ) );
701
        $last_day_year  	  = date( 'Y-12-31', current_time( 'timestamp' ) );
702
		$first_day_last_year  = date( 'Y-m-d', strtotime( 'first day of last year', current_time( 'timestamp' ) ) );
703
		$last_day_last_year   = date( 'Y-m-d', strtotime( 'last day of last year', current_time( 'timestamp' ) ) );
704
705
        $ranges = array(
706
707
            'today'        => array(
708
                "HOUR($datetime)",
709
                "$date='$today'"
710
            ),
711
712
            'yesterday'    => array(
713
                "HOUR($datetime)",
714
                "$date='$yesterday'"
715
            ),
716
717
            'this_week'    => array(
718
                "DAYNAME($date)",
719
                "$date BETWEEN '$monday' AND '$sunday'"
720
            ),
721
722
            'last_week'    => array(
723
                "DAYNAME($date)",
724
                "$date BETWEEN '$last_monday' AND '$last_sunday'"  
725
            ),
726
727
            '7_days_ago'   => array(
728
                "DAY($date)",
729
                "$date BETWEEN '$seven_days_ago' AND '$today'"  
730
            ),
731
732
            '30_days_ago'  => array(
733
                "DAY($date)",
734
                "$date BETWEEN '$thirty_days_ago' AND '$today'"    
735
            ),
736
737
            'this_month'   => array(
738
                "DAY($date)",
739
                "$date BETWEEN '$first_day_month' AND '$last_day_month'"
740
            ),
741
742
            'last_month'   => array(
743
                "DAY($date)",
744
                "$date BETWEEN '$first_day_last_month' AND '$last_day_last_month'"
745
            ),
746
747
            'this_year'    => array(
748
                "MONTH($date)",
749
                "$date BETWEEN '$first_day_year' AND '$last_day_year'"
750
            ),
751
752
            'last_year'    => array(
753
                "MONTH($date)",
754
                "$date BETWEEN '$first_day_last_year' AND '$last_day_last_year'"
755
            ),
756
757
        );
758
759
        if ( ! isset( $ranges[ $range ] ) ) {
760
            return $ranges['7_days_ago'];
761
        }
762
        return $ranges[ $range ];
763
764
    }
765
    
766
    /**
767
     * Returns the the current date ranges results.
768
     */
769
    public function get_report_results( $range, $key='_wpinv_total' ) {
770
        global $wpdb;
771
772
        $clauses = $this->get_sql_clauses( $range );
773
        $key     = $wpdb->prepare( '%s', $key );
774
        $sql     = "SELECT
775
                {$clauses[0]} AS completed_date,
776
                SUM( total.meta_value ) AS amount
777
            FROM $wpdb->posts
778
            LEFT JOIN $wpdb->postmeta as total ON total.post_id = $wpdb->posts.ID AND total.meta_key=$key
779
            LEFT JOIN $wpdb->postmeta as completed ON completed.post_id = $wpdb->posts.ID AND completed.meta_key='_wpinv_completed_date'
780
            WHERE total.meta_key IS NOT NULL
781
                AND completed.meta_key IS NOT NULL
782
                AND $wpdb->posts.post_type = 'wpi_invoice'
783
                AND ( $wpdb->posts.post_status = 'publish' OR $wpdb->posts.post_status = 'renewal' )
784
                AND {$clauses[1]}
785
            GROUP BY {$clauses[0]}
786
        ";
787
788
        return  wp_list_pluck( $wpdb->get_results( $sql ), 'amount', 'completed_date' );
789
    }
790
791
    /**
792
     * Fill nulls.
793
     */
794
    public function fill_nulls( $data, $range ) {
795
796
        $return = array();
797
        $time   = current_time('timestamp');
798
799
        switch ( $range ) {
800
            case 'today' :
801
            case 'yesterday' :
802
                $hour  = 0;
803
804
                while ( $hour < 23 ) {
805
                    $amount = 0;
806
                    if ( isset( $data[$hour] ) ) {
807
                        $amount = floatval( $data[$hour] );
808
                    }
809
810
                    $time = strtotime( "$range $hour:00:00" ) * 1000;
811
                    $return[] = array( $time, $amount );
812
                    $hour++;
813
                }
814
815
                break;
816
817
            case 'this_month' :
818
            case 'last_month' :
819
                $_range = str_replace( '_', ' ', $range );
820
                $month  = date( 'n', strtotime( $_range, $time ) );
821
                $year   = date( 'Y', strtotime( $_range, $time ) );
822
                $days   = cal_days_in_month(
823
                    CAL_GREGORIAN,
824
                    $month,
0 ignored issues
show
Bug introduced by
$month of type string is incompatible with the type integer expected by parameter $month of cal_days_in_month(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

824
                    /** @scrutinizer ignore-type */ $month,
Loading history...
825
                    $year
0 ignored issues
show
Bug introduced by
$year of type string is incompatible with the type integer expected by parameter $year of cal_days_in_month(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

825
                    /** @scrutinizer ignore-type */ $year
Loading history...
826
                );
827
828
                $day = 1;
829
                while ( $days != $day ) {
830
                    $amount = 0;
831
                    if ( isset( $data[$day] ) ) {
832
                        $amount = floatval( $data[$day] );
833
                    }
834
835
                    $time = strtotime( "$year-$month-$day" ) * 1000;
836
                    $return[] = array( $time, $amount );
837
                    $day++;
838
                }
839
840
                break;
841
842
            case 'this_week' :
843
            case 'last_week' :
844
                $_range = str_replace( '_', ' ', $range );
845
                $days   = array( 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday', 'sunday' );
846
847
                foreach ( $days as $day ) {
848
849
                    $amount = 0;
850
                    if ( isset( $data[ ucfirst( $day ) ] ) ) {
851
                        $amount = floatval( $data[ ucfirst( $day ) ] );
852
                    }
853
854
                    $time = strtotime( "$_range $day" ) * 1000;
855
                    $return[] = array( $time, $amount );
856
                }
857
858
                break;
859
860
            case 'this_year' :
861
            case 'last_year' :
862
                $_range = str_replace( '_', ' ', $range );
863
                $year   = date( 'Y', strtotime( $_range, $time ) );
864
                $months = array( '1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12' );
865
866
                foreach ( $months as $month ) {
867
868
                    $amount = 0;
869
                    if ( isset( $data[$month] ) ) {
870
                        $amount = floatval( $data[$month] );
871
                    }
872
873
                    $_time     = strtotime("$year-$month-01") * 1000;
874
                    $return[] = array( $_time, $amount );
875
                }
876
877
                break;
878
            case '30_days_ago' :
879
                $days = 30;
880
881
                while ( $days > 1 ) {
882
                    $amount = 0;
883
                    $date   = date( 'j', strtotime( "-$days days", $time ) );
884
                    if ( isset( $data[$date] ) ) {
885
                        $amount = floatval( $data[$date] );
886
                    }
887
888
                    $_time = strtotime( "-$days days", $time ) * 1000;
889
                    $return[] = array( $_time, $amount );
890
                    $days--;
891
                }
892
893
                break;
894
895
            default:
896
                $days = 7;
897
898
                while ( $days > 1 ) {
899
                    $amount = 0;
900
                    $date   = date( 'j', strtotime( "-$days days", $time ) );
901
                    if ( isset( $data[$date] ) ) {
902
                        $amount = floatval( $data[$date] );
903
                    }
904
905
                    $_time = strtotime( "-$days days", $time ) * 1000;
906
                    $return[] = array( $_time, $amount );
907
                    $days--;
908
                }
909
910
                break;
911
912
        }
913
914
        return $return;
915
    }
916
917
    /**
918
     * Retrieves the stats.
919
     */
920
    public function get_stats() {
921
        $range    = isset( $_GET['range'] ) ? $_GET['range'] : '7_days_ago';
922
        $earnings = $this->get_report_results( $range );
923
        $taxes    = $this->get_report_results( $range, '_wpinv_tax' );
924
925
        return array(
926
927
            array(
928
                'label' => __( 'Earnings', 'invoicing' ),
929
                'data'  => $this->fill_nulls( $earnings, $range ),
930
            ),
931
932
            array(
933
                'label' => __( 'Taxes', 'invoicing' ),
934
                'data'  => $this->fill_nulls( $taxes, $range ),
935
            )
936
        );
937
938
    }
939
940
    /**
941
     * Retrieves the time format for stats.
942
     */
943
    public function get_time_format() {
944
        $range    = isset( $_GET['range'] ) ? $_GET['range'] : '7_days_ago';
945
946
        switch ( $range ) {
947
            case 'today' :
948
            case 'yesterday' :
949
                return array( 'hour', '%h %p' );
950
                break;
0 ignored issues
show
Unused Code introduced by
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
951
952
            case 'this_month' :
953
            case 'last_month' :
954
                return array( 'day', '%b %d' );
955
                break;
956
957
            case 'this_week' :
958
            case 'last_week' :
959
                return array( 'day', '%b %d' );
960
                break;
961
962
            case 'this_year' :
963
            case 'last_year' :
964
                return array( 'month', '%b' );
965
                break;
966
            case '30_days_ago' :
967
                return array( 'day', '%b %d' );
968
                break;
969
970
            default:
971
                return array( 'day', '%b %d' );
972
                break;
973
974
        }
975
    }
976
977
    /**
978
     * Displays the earnings report.
979
     */
980
    public function earnings_report() {
981
982
        $data        = wp_json_encode( $this->get_stats() );
983
        $time_format = $this->get_time_format();
984
        echo '
985
            <div class="wpinv-report-container">
986
                <h3><span>' . __( 'Earnings Over Time', 'invoicing' ) .'</span></h3>
987
                ' . $this->period_filter() . '
988
                <div id="wpinv_report_graph" style="height: 450px;"></div>
989
            </div>
990
991
            <script>
992
                jQuery(document).ready( function() {
993
                    jQuery.plot(
994
                        jQuery("#wpinv_report_graph"),
995
                        ' . $data .',
0 ignored issues
show
Bug introduced by
Are you sure $data of type false|string can be used in concatenation? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

995
                        ' . /** @scrutinizer ignore-type */ $data .',
Loading history...
996
                        {
997
                            xaxis:{
998
                                mode: "time",
999
                                timeformat: "' . $time_format[1] .'",
1000
                                minTickSize: [0.5, "' . $time_format[0] .'"]
1001
                            },
1002
1003
                            yaxis: {
1004
                                min: 0
1005
                            },
1006
1007
                            tooltip: true,
1008
1009
                            series: {
1010
                                lines: { show: true },
1011
                                points: { show: true }
1012
                            },
1013
1014
                            grid: {
1015
                                backgroundColor: { colors: [ "#fff", "#eee" ] },
1016
                            }
1017
                        }
1018
                    );
1019
                })
1020
            </script>
1021
        ';
1022
    }
1023
1024
    /**
1025
     * Displays the gateways report.
1026
     */
1027
    public function gateways_report() {
1028
        require_once( WPINV_PLUGIN_DIR . 'includes/admin/class-wpinv-gateways-report-table.php' );
1029
1030
        $table = new WPInv_Gateways_Report_Table();
1031
        $table->prepare_items();
1032
        $table->display();
1033
    }
1034
1035
    /**
1036
     * Renders the Tax Reports
1037
     *
1038
     * @return void
1039
     */
1040
    public function tax_report() {
1041
1042
        $year = isset( $_GET['year'] ) ? absint( $_GET['year'] ) : date( 'Y' );
1043
        ?>
1044
1045
        <div class="metabox-holder" style="padding-top: 0;">
1046
            <div class="postbox">
1047
                <h3><span><?php _e('Tax Report','invoicing' ); ?></span></h3>
1048
                <div class="inside">
1049
                    <p><?php _e( 'This report shows the total amount collected in sales tax for the given year.', 'invoicing' ); ?></p>
1050
                    <form method="get">
1051
                        <span><?php echo $year; ?></span>: <strong><?php echo wpinv_sales_tax_for_year( $year ); ?></strong>&nbsp;&mdash;&nbsp;
1052
                        <select name="year">
1053
                            <?php for ( $i = 2014; $i <= date( 'Y' ); $i++ ) : ?>
1054
                            <option value="<?php echo $i; ?>"<?php selected( $year, $i ); ?>><?php echo $i; ?></option>
1055
                            <?php endfor; ?>
1056
                        </select>
1057
                        <input type="hidden" name="view" value="taxes" />
1058
                        <input type="hidden" name="page" value="wpinv-reports"/>
1059
                        <?php submit_button( __( 'Submit', 'invoicing' ), 'secondary', 'submit', false ); ?>
1060
                    </form>
1061
                </div><!-- .inside -->
1062
            </div><!-- .postbox -->
1063
        </div><!-- .metabox-holder -->
1064
        <?php
1065
    }
1066
1067
}
1068