This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||||
2 | /** |
||||||
3 | * Setup menus in WP admin. |
||||||
4 | */ |
||||||
5 | |||||||
6 | defined( 'ABSPATH' ) || exit; |
||||||
7 | |||||||
8 | /** |
||||||
9 | * WC_Admin_Menus Class. |
||||||
10 | */ |
||||||
11 | class WPInv_Admin_Menus { |
||||||
12 | /** |
||||||
13 | * Hook in tabs. |
||||||
14 | */ |
||||||
15 | public function __construct() { |
||||||
16 | add_action( 'admin_head', array( $this, 'set_admin_menu_class' ) ); |
||||||
17 | add_action( 'admin_menu', array( $this, 'admin_menu' ), 10 ); |
||||||
18 | add_action( 'admin_menu', array( $this, 'add_customers_menu' ), 18 ); |
||||||
19 | add_action( 'admin_menu', array( $this, 'add_subscriptions_menu' ), 40 ); |
||||||
20 | add_action( 'admin_menu', array( $this, 'add_addons_menu' ), 100 ); |
||||||
21 | add_action( 'admin_menu', array( $this, 'add_settings_menu' ), 60 ); |
||||||
22 | add_action( 'admin_menu', array( $this, 'add_anonymization_logs_menu' ), 40 ); |
||||||
23 | add_action( 'admin_menu', array( $this, 'remove_admin_submenus' ), 10 ); |
||||||
24 | add_action( 'admin_head-nav-menus.php', array( $this, 'add_nav_menu_meta_boxes' ) ); |
||||||
25 | } |
||||||
26 | |||||||
27 | /** |
||||||
28 | * Highlights sub menus. |
||||||
29 | */ |
||||||
30 | public function set_admin_menu_class() { |
||||||
31 | global $current_screen, $parent_file, $submenu_file; |
||||||
32 | |||||||
33 | if ( ! empty( $current_screen->id ) && in_array( $current_screen->id, array( 'wpi_discount', 'wpi_payment_form', 'wpi_invoice' ) ) ) { |
||||||
34 | $parent_file = 'wpinv'; |
||||||
35 | $submenu_file = 'edit.php?post_type=' . $current_screen->id; |
||||||
36 | } |
||||||
37 | |||||||
38 | } |
||||||
39 | |||||||
40 | public function admin_menu() { |
||||||
41 | |||||||
42 | $capability = apply_filters( 'invoicing_capability', wpinv_get_capability() ); |
||||||
43 | add_menu_page( |
||||||
44 | __( 'GetPaid', 'invoicing' ), |
||||||
45 | __( 'GetPaid', 'invoicing' ), |
||||||
46 | $capability, |
||||||
47 | 'wpinv', |
||||||
48 | null, |
||||||
49 | 'data:image/svg+xml;base64,' . base64_encode( file_get_contents( WPINV_PLUGIN_DIR . 'assets/images/GetPaid.svg' ) ), |
||||||
50 | '54.123460' |
||||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||||
51 | ); |
||||||
52 | |||||||
53 | } |
||||||
54 | |||||||
55 | /** |
||||||
56 | * Registers the customers menu |
||||||
57 | */ |
||||||
58 | public function add_customers_menu() { |
||||||
59 | add_submenu_page( |
||||||
60 | 'wpinv', |
||||||
61 | __( 'Customers', 'invoicing' ), |
||||||
62 | __( 'Customers', 'invoicing' ), |
||||||
63 | wpinv_get_capability(), |
||||||
64 | 'wpinv-customers', |
||||||
65 | array( $this, 'customers_page' ) |
||||||
66 | ); |
||||||
67 | } |
||||||
68 | |||||||
69 | /** |
||||||
70 | * Registers the subscriptions menu |
||||||
71 | */ |
||||||
72 | public function add_subscriptions_menu() { |
||||||
73 | add_submenu_page( |
||||||
74 | 'wpinv', |
||||||
75 | __( 'Subscriptions', 'invoicing' ), |
||||||
76 | __( 'Subscriptions', 'invoicing' ), |
||||||
77 | wpinv_get_capability(), |
||||||
78 | 'wpinv-subscriptions', |
||||||
79 | 'wpinv_subscriptions_page' |
||||||
80 | ); |
||||||
81 | } |
||||||
82 | |||||||
83 | /** |
||||||
84 | * Displays the customers page. |
||||||
85 | */ |
||||||
86 | public function customers_page() { |
||||||
87 | require_once WPINV_PLUGIN_DIR . 'includes/admin/class-wpinv-customers-table.php'; |
||||||
88 | ?> |
||||||
89 | <div class="wrap wpi-customers-wrap"> |
||||||
90 | <style> |
||||||
91 | .column-primary { |
||||||
92 | width: 240px; |
||||||
93 | } |
||||||
94 | .manage-column:not(.column-primary):not(.column-cb) { |
||||||
95 | width: 120px; |
||||||
96 | } |
||||||
97 | </style> |
||||||
98 | <h1><?php echo esc_html( __( 'Customers', 'invoicing' ) ); ?> <a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'getpaid-admin-action', 'download_customers' ), 'getpaid-nonce', 'getpaid-nonce' ) ); ?>" class="page-title-action"><?php esc_html_e( 'Export', 'invoicing' ); ?></a></h1> |
||||||
99 | <form method="get" style="overflow: auto; width: 100%" action=<?php echo esc_url( add_query_arg( array() ) ); ?>> |
||||||
100 | <input type="hidden" name="page" value="wpinv-customers" /> |
||||||
101 | <?php |
||||||
102 | $table = new WPInv_Customers_Table(); |
||||||
103 | $table->prepare_items(); |
||||||
104 | $table->search_box( __( 'Search Customers', 'invoicing' ), 'search-customers' ); |
||||||
105 | $table->display(); |
||||||
106 | ?> |
||||||
107 | </form> |
||||||
108 | </div> |
||||||
109 | <?php |
||||||
110 | } |
||||||
111 | |||||||
112 | /** |
||||||
113 | * Registers the settings menu. |
||||||
114 | */ |
||||||
115 | public function add_settings_menu() { |
||||||
116 | add_submenu_page( |
||||||
117 | 'wpinv', |
||||||
118 | __( 'Invoice Settings', 'invoicing' ), |
||||||
119 | __( 'Settings', 'invoicing' ), |
||||||
120 | apply_filters( 'invoicing_capability', wpinv_get_capability() ), |
||||||
121 | 'wpinv-settings', |
||||||
122 | array( $this, 'options_page' ) |
||||||
123 | ); |
||||||
124 | } |
||||||
125 | |||||||
126 | /** |
||||||
127 | * Registers the anonymization logs menu. |
||||||
128 | * |
||||||
129 | * @since 2.8.22 |
||||||
130 | */ |
||||||
131 | public function add_anonymization_logs_menu() { |
||||||
132 | $anonymization_logs_page = new GetPaid_Anonymization_Logs(); |
||||||
133 | add_management_page( |
||||||
134 | __( 'Anonymization Logs', 'invoicing' ), |
||||||
135 | __( 'Anonymization Logs', 'invoicing' ), |
||||||
136 | 'manage_options', |
||||||
137 | 'wpinv-anonymization-logs', |
||||||
138 | array( $anonymization_logs_page, 'display_logs' ) |
||||||
139 | ); |
||||||
140 | } |
||||||
141 | |||||||
142 | public function add_addons_menu() { |
||||||
143 | if ( ! apply_filters( 'wpi_show_addons_page', true ) ) { |
||||||
144 | return; |
||||||
145 | } |
||||||
146 | |||||||
147 | add_submenu_page( |
||||||
148 | 'wpinv', |
||||||
149 | __( 'Invoicing extensions', 'invoicing' ), |
||||||
150 | __( 'Extensions', 'invoicing' ), |
||||||
151 | 'manage_options', |
||||||
152 | 'wpi-addons', |
||||||
153 | array( $this, 'addons_page' ) |
||||||
154 | ); |
||||||
155 | } |
||||||
156 | |||||||
157 | public function addons_page() { |
||||||
158 | $addon_obj = new WPInv_Admin_Addons(); |
||||||
159 | $addon_obj->output(); |
||||||
160 | } |
||||||
161 | |||||||
162 | function options_page() { |
||||||
0 ignored issues
–
show
|
|||||||
163 | |||||||
164 | if ( ! wpinv_current_user_can_manage_invoicing() ) { |
||||||
165 | return; |
||||||
166 | } |
||||||
167 | |||||||
168 | $settings_tabs = wpinv_get_settings_tabs(); |
||||||
169 | $settings_tabs = empty( $settings_tabs ) ? array() : $settings_tabs; |
||||||
170 | $active_tab = isset( $_GET['tab'] ) && array_key_exists( $_GET['tab'], $settings_tabs ) ? sanitize_text_field( $_GET['tab'] ) : 'general'; |
||||||
171 | $sections = wpinv_get_settings_tab_sections( $active_tab ); |
||||||
172 | $key = 'main'; |
||||||
173 | |||||||
174 | if ( is_array( $sections ) ) { |
||||||
175 | $key = key( $sections ); |
||||||
176 | } |
||||||
177 | |||||||
178 | add_thickbox(); |
||||||
179 | |||||||
180 | $registered_sections = wpinv_get_settings_tab_sections( $active_tab ); |
||||||
181 | $section = isset( $_GET['section'] ) && ! empty( $registered_sections ) && array_key_exists( $_GET['section'], $registered_sections ) ? sanitize_text_field( $_GET['section'] ) : $key; |
||||||
182 | ?> |
||||||
183 | <div class="wrap"> |
||||||
184 | <h1 class="nav-tab-wrapper"> |
||||||
185 | <?php |
||||||
186 | foreach ( wpinv_get_settings_tabs() as $tab_id => $tab_name ) { |
||||||
187 | $tab_url = add_query_arg( |
||||||
188 | array( |
||||||
189 | 'settings-updated' => false, |
||||||
190 | 'tab' => $tab_id, |
||||||
191 | ), |
||||||
192 | 'admin.php?page=wpinv-settings' |
||||||
193 | ); |
||||||
194 | |||||||
195 | // Remove the section from the tabs so we always end up at the main section |
||||||
196 | $tab_url = remove_query_arg( 'section', $tab_url ); |
||||||
197 | $tab_url = remove_query_arg( 'wpi_sub', $tab_url ); |
||||||
198 | |||||||
199 | $active = $active_tab == $tab_id ? ' nav-tab-active' : ''; |
||||||
200 | |||||||
201 | echo '<a href="' . esc_url( $tab_url ) . '" title="' . esc_attr( $tab_name ) . '" class="nav-tab ' . esc_attr( $active ) . '">'; |
||||||
202 | echo esc_html( $tab_name ); |
||||||
203 | echo '</a>'; |
||||||
204 | } |
||||||
205 | ?> |
||||||
206 | </h1> |
||||||
207 | <?php |
||||||
208 | $number_of_sections = count( $sections ); |
||||||
209 | $number = 0; |
||||||
210 | if ( $number_of_sections > 1 ) { |
||||||
211 | echo '<div><ul class="subsubsub">'; |
||||||
212 | foreach ( $sections as $section_id => $section_name ) { |
||||||
213 | echo '<li>'; |
||||||
214 | $number++; |
||||||
215 | $tab_url = add_query_arg( |
||||||
216 | array( |
||||||
217 | 'settings-updated' => false, |
||||||
218 | 'tab' => $active_tab, |
||||||
219 | 'section' => $section_id, |
||||||
220 | ), |
||||||
221 | admin_url( 'admin.php?page=wpinv-settings' ) |
||||||
222 | ); |
||||||
223 | $tab_url = remove_query_arg( 'wpi_sub', $tab_url ); |
||||||
224 | $class = ''; |
||||||
225 | if ( $section == $section_id ) { |
||||||
226 | $class = 'current'; |
||||||
227 | } |
||||||
228 | echo '<a class="' . esc_attr( $class ) . '" href="' . esc_url( $tab_url ) . '">' . esc_html( $section_name ) . '</a>'; |
||||||
229 | |||||||
230 | if ( $number != $number_of_sections ) { |
||||||
231 | echo ' | '; |
||||||
232 | } |
||||||
233 | echo '</li>'; |
||||||
234 | } |
||||||
235 | echo '</ul></div>'; |
||||||
236 | } |
||||||
237 | ?> |
||||||
238 | <div id="tab_container"> |
||||||
239 | <form method="post" action="options.php"> |
||||||
240 | <table class="form-tablex"> |
||||||
241 | <?php |
||||||
242 | settings_fields( 'wpinv_settings' ); |
||||||
243 | |||||||
244 | if ( 'main' === $section ) { |
||||||
245 | do_action( 'wpinv_settings_tab_top', $active_tab ); |
||||||
246 | } |
||||||
247 | |||||||
248 | do_action( 'wpinv_settings_tab_top_' . $active_tab . '_' . $section, $active_tab, $section ); |
||||||
249 | do_settings_sections( 'wpinv_settings_' . $active_tab . '_' . $section, $active_tab, $section ); |
||||||
0 ignored issues
–
show
The call to
do_settings_sections() has too many arguments starting with $active_tab .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. ![]() |
|||||||
250 | do_action( 'wpinv_settings_tab_bottom_' . $active_tab . '_' . $section, $active_tab, $section ); |
||||||
251 | do_action( 'getpaid_settings_tab_bottom', $active_tab, $section ); |
||||||
252 | |||||||
253 | // For backwards compatibility |
||||||
254 | if ( 'main' === $section ) { |
||||||
255 | do_action( 'wpinv_settings_tab_bottom', $active_tab ); |
||||||
256 | } |
||||||
257 | ?> |
||||||
258 | </table> |
||||||
259 | <?php submit_button(); ?> |
||||||
260 | </form> |
||||||
261 | </div><!-- #tab_container--> |
||||||
262 | </div><!-- .wrap --> |
||||||
263 | <?php |
||||||
264 | } |
||||||
265 | |||||||
266 | public function remove_admin_submenus() { |
||||||
267 | remove_submenu_page( 'edit.php?post_type=wpi_invoice', 'post-new.php?post_type=wpi_invoice' ); |
||||||
268 | } |
||||||
269 | |||||||
270 | /** |
||||||
271 | * Register our own endpoints section. |
||||||
272 | */ |
||||||
273 | public function add_nav_menu_meta_boxes() { |
||||||
274 | |||||||
275 | add_meta_box( |
||||||
276 | 'wpinv_endpoints_nav_link', |
||||||
277 | __( 'GetPaid endpoints', 'invoicing' ), |
||||||
278 | array( $this, 'nav_menu_links' ), |
||||||
279 | 'nav-menus', |
||||||
280 | 'side', |
||||||
281 | 'low' |
||||||
282 | ); |
||||||
283 | |||||||
284 | } |
||||||
285 | |||||||
286 | /** |
||||||
287 | * Displays GetPaid nav menu links. |
||||||
288 | */ |
||||||
289 | public function nav_menu_links() { |
||||||
290 | $endpoints = $this->get_menu_items(); |
||||||
291 | ?> |
||||||
292 | <div id="invoicing-endpoints" class="posttypediv"> |
||||||
293 | <?php if ( ! empty( $endpoints['pages'] ) ) : ?> |
||||||
294 | <div id="tabs-panel-invoicing-endpoints" class="tabs-panel tabs-panel-active"> |
||||||
295 | <ul id="invoicing-endpoints-checklist" class="categorychecklist form-no-clear"> |
||||||
296 | <?php |
||||||
297 | $walker = new Walker_Nav_Menu_Checklist( array() ); |
||||||
298 | echo walk_nav_menu_tree( array_map( 'wp_setup_nav_menu_item', $endpoints['pages'] ), 0, (object) array( 'walker' => $walker ) ); |
||||||
299 | ?> |
||||||
300 | </ul> |
||||||
301 | </div> |
||||||
302 | <?php endif; ?> |
||||||
303 | |||||||
304 | <p class="button-controls wp-clearfix" data-items-type="invoicing-endpoints"> |
||||||
305 | <span class="list-controls hide-if-no-js"> |
||||||
306 | <input type="checkbox" id="invoicing-endpoints-tab" class="select-all"> |
||||||
307 | <label for="invoicing-endpoints-tab"><?php esc_html_e( 'Select all', 'invoicing' ); ?></label> |
||||||
308 | </span> |
||||||
309 | |||||||
310 | <span class="add-to-menu"> |
||||||
311 | <input type="submit" class="button submit-add-to-menu right" value="<?php esc_attr_e( 'Add to menu', 'invoicing' ); ?>" name="add-invoicing-endpoints-item" id="submit-invoicing-endpoints"> |
||||||
312 | <span class="spinner"></span> |
||||||
313 | </span> |
||||||
314 | </p> |
||||||
315 | </div> |
||||||
316 | <?php |
||||||
317 | } |
||||||
318 | |||||||
319 | /** |
||||||
320 | * Returns the menu entry pages. |
||||||
321 | * |
||||||
322 | * @return array. |
||||||
0 ignored issues
–
show
|
|||||||
323 | */ |
||||||
324 | public function get_menu_items() { |
||||||
325 | $items = array(); |
||||||
326 | |||||||
327 | $pages = array( |
||||||
328 | array( |
||||||
329 | 'id' => wpinv_get_option( 'invoice_history_page' ), |
||||||
330 | 'label' => __( 'My Invoices', 'invoicing' ), |
||||||
331 | ), |
||||||
332 | array( |
||||||
333 | 'id' => wpinv_get_option( 'invoice_subscription_page' ), |
||||||
334 | 'label' => __( 'My Subscriptions', 'invoicing' ), |
||||||
335 | ), |
||||||
336 | ); |
||||||
337 | |||||||
338 | foreach ( apply_filters( 'getpaid_menu_pages', $pages ) as $page ) { |
||||||
339 | |||||||
340 | if ( (int) $page['id'] > 0 ) { |
||||||
341 | |||||||
342 | $item = new stdClass(); |
||||||
343 | $item->object_id = (int) $page['id']; |
||||||
344 | $item->db_id = 0; |
||||||
345 | $item->object = 'page'; |
||||||
346 | $item->menu_item_parent = 0; |
||||||
347 | $item->type = 'post_type'; |
||||||
348 | $item->title = esc_html( $page['label'] ); |
||||||
349 | $item->url = get_permalink( (int) $page['id'] ); |
||||||
350 | $item->target = ''; |
||||||
351 | $item->attr_title = ''; |
||||||
352 | $item->classes = array( 'wpinv-menu-item' ); |
||||||
353 | $item->xfn = ''; |
||||||
354 | |||||||
355 | $items['pages'][] = $item; |
||||||
356 | |||||||
357 | } |
||||||
358 | } |
||||||
359 | |||||||
360 | return apply_filters( 'wpinv_menu_items', $items ); |
||||||
361 | } |
||||||
362 | |||||||
363 | } |
||||||
364 | |||||||
365 | return new WPInv_Admin_Menus(); |
||||||
366 |