Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class-getpaid-meta-box-invoice-address.php (2 issues)

Labels
1
<?php
2
3
/**
4
 * Invoice Address
5
 *
6
 * Display the invoice address meta box.
7
 *
8
 */
9
10
if ( ! defined( 'ABSPATH' ) ) {
11
	exit; // Exit if accessed directly
12
}
13
14
/**
15
 * GetPaid_Meta_Box_Invoice_Address Class.
16
 */
17
class GetPaid_Meta_Box_Invoice_Address {
18
19
	/**
20
	 * Output the metabox.
21
	 *
22
	 * @param WP_Post $post
23
	 */
24
	public static function output( $post ) {
25
26
		// Prepare the invoice.
27
		$invoice  = new WPInv_Invoice( $post );
28
		$customer = $invoice->exists() ? $invoice->get_user_id( 'edit' ) : get_current_user_id();
29
		$customer = new WP_User( $customer );
30
		$display  = sprintf( _x( '%1$s (%2$s)', 'user dropdown', 'invoicing' ), $customer->display_name, $customer->user_email );
31
		wp_nonce_field( 'getpaid_meta_nonce', 'getpaid_meta_nonce' );
32
33
		// Address fields.
34
		$address_fields = array(
35
			'first_name' => array(
36
				'label' => __( 'First Name', 'invoicing' ),
37
				'type'  => 'text',
38
			),
39
			'last_name'  => array(
40
				'label' => __( 'Last Name', 'invoicing' ),
41
				'type'  => 'text',
42
			),
43
			'company'    => array(
44
				'label' => __( 'Company', 'invoicing' ),
45
				'type'  => 'text',
46
				'class' => 'getpaid-recalculate-prices-on-change',
47
			),
48
			'vat_number' => array(
49
				'label' => __( 'VAT Number', 'invoicing' ),
50
				'type'  => 'text',
51
				'class' => 'getpaid-recalculate-prices-on-change',
52
			),
53
			'address'    => array(
54
				'label' => __( 'Address', 'invoicing' ),
55
				'type'  => 'text',
56
			),
57
			'city'       => array(
58
				'label' => __( 'City', 'invoicing' ),
59
				'type'  => 'text',
60
			),
61
			'country'    => array(
62
				'label'       => __( 'Country', 'invoicing' ),
63
				'type'        => 'select',
64
				'class'       => 'getpaid-recalculate-prices-on-change',
65
				'options'     => wpinv_get_country_list(),
66
				'placeholder' => __( 'Choose a country', 'invoicing' ),
67
			),
68
			'state'      => array(
69
				'label' => __( 'State', 'invoicing' ),
70
				'type'  => 'text',
71
				'class' => 'getpaid-recalculate-prices-on-change',
72
			),
73
			'zip'        => array(
74
				'label' => __( 'Zip', 'invoicing' ),
75
				'type'  => 'text',
76
			),
77
			'phone'      => array(
78
				'label' => __( 'Phone', 'invoicing' ),
79
				'type'  => 'text',
80
			),
81
		);
82
83
		$states = wpinv_get_country_states( $invoice->get_country( 'edit' ) );
84
85
		if ( ! empty( $states ) ) {
86
			$address_fields['state']['type']        = 'select';
87
			$address_fields['state']['options']     = $states;
88
			$address_fields['state']['placeholder'] = __( 'Choose a state', 'invoicing' );
89
		}
90
91
		// Maybe remove the VAT field.
92
		if ( ! wpinv_use_taxes() ) {
93
			unset( $address_fields['vat_number'] );
94
		}
95
96
		$address_fields = apply_filters( 'getpaid_admin_edit_invoice_address_fields', $address_fields, $invoice );
97
		?>
98
99
		<style>
100
			#wpinv-address label {
101
				margin-bottom: 3px;
102
				font-weight: 600;
103
			}
104
		</style>
105
			<div class="bsui" style="margin-top: 1.5rem; max-width: 820px;">
106
					<div class="row">
107
						<div class="col-12 col-sm-6">
108
							<div id="getpaid-invoice-user-id-wrapper" class="form-group mb-3">
109
								<div>
110
									<label for="post_author_override"><?php esc_html_e( 'Customer', 'invoicing' ); ?></label>
111
								</div>
112
								<div>
113
									<select name="post_author_override" id="wpinv_post_author_override" class="getpaid-customer-search form-control regular-text" data-placeholder="<?php esc_attr_e( 'Search for a customer by email or name', 'invoicing' ); ?>">
114
										<option selected="selected" value="<?php echo (int) $customer->ID; ?>"><?php echo esc_html( $display ); ?> </option>)
115
									</select>
116
								</div>
117
							</div>
118
119
							<div id="getpaid-invoice-email-wrapper" class="d-none">
120
								<input type="hidden" id="getpaid-invoice-create-new-user" name="wpinv_new_user" value="" />
121
								<?php
122
									aui()->input(
123
										array(
124
											'type'        => 'text',
125
											'id'          => 'getpaid-invoice-new-user-email',
126
											'name'        => 'wpinv_email',
127
											'label'       => __( 'Email', 'invoicing' ) . '<span class="required">*</span>',
128
											'label_type'  => 'vertical',
129
											'placeholder' => '[email protected]',
130
											'class'       => 'form-control-sm',
131
										),
132
										true
133
									);
134
								?>
135
							</div>
136
						</div>
137
						<div class="col-12 col-sm-6 form-group mb-3 mt-sm-4">
138
							<?php if ( ! $invoice->is_paid() && ! $invoice->is_refunded() ) : ?>
139
								<a id="getpaid-invoice-fill-user-details" class="button button-small button-secondary" href="javascript:void(0)">
140
									<i aria-hidden="true" class="fa fa-refresh"></i>
141
									<?php esc_html_e( 'Fill User Details', 'invoicing' ); ?>
142
								</a>
143
								<a id="getpaid-invoice-create-new-user-button" class="button button-small button-secondary" href="javascript:void(0)">
144
									<i aria-hidden="true" class="fa fa-plus"></i>
145
									<?php esc_html_e( 'Add New User', 'invoicing' ); ?>
146
								</a>
147
								<a id="getpaid-invoice-cancel-create-new-user" class="button button-small button-secondary d-none" href="javascript:void(0)">
148
									<i aria-hidden="true" class="fa fa-close"></i>
149
									<?php esc_html_e( 'Cancel', 'invoicing' ); ?>
150
								</a>
151
							<?php endif; ?>
152
						</div>
153
154
						<?php foreach ( $address_fields as $key => $field ) : ?>
155
							<div class="col-12 col-sm-6 getpaid-invoice-address-field__<?php echo esc_attr( $key ); ?>--wrapper">
156
								<?php
157
158
									if ( 'select' === $field['type'] ) {
159
										aui()->select(
160
											array(
161
												'id'               => 'wpinv_' . $key,
162
												'name'             => 'wpinv_' . $key,
163
												'label'            => $field['label'],
164
												'label_type'       => 'vertical',
165
												'placeholder'      => isset( $field['placeholder'] ) ? $field['placeholder'] : '',
166
												'class'            => 'form-control-sm ' . ( isset( $field['class'] ) ? $field['class'] : '' ),
167
												'value'            => $invoice->get( $key, 'edit' ),
168
												'options'          => $field['options'],
169
												'data-allow-clear' => 'false',
170
												'select2'          => true,
171
											),
172
											true
173
										);
174
									} else {
175
										aui()->input(
176
											array(
177
												'type'        => $field['type'],
178
												'id'          => 'wpinv_' . $key,
179
												'name'        => 'wpinv_' . $key,
180
												'label'       => $field['label'],
181
												'label_type'  => 'vertical',
182
												'placeholder' => isset( $field['placeholder'] ) ? $field['placeholder'] : '',
183
												'class'       => 'form-control-sm ' . ( isset( $field['class'] ) ? $field['class'] : '' ),
184
												'value'       => $invoice->get( $key, 'edit' ),
185
											),
186
											true
187
										);
188
									}
189
190
								?>
191
							</div>
192
						<?php endforeach; ?>
193
					</div>
194
195
					<?php if ( ! apply_filters( 'getpaid_use_new_invoice_items_metabox', false ) ) : ?>
196
						<?php do_action( 'wpinv_meta_box_before_invoice_template_row', $invoice->get_id() ); ?>
197
198
						<div class="row">
199
							<div class="col-12 col-sm-6">
200
								<?php
201
									aui()->select(
202
										array(
203
											'id'          => 'wpinv_template',
204
											'name'        => 'wpinv_template',
205
											'label'       => __( 'Template', 'invoicing' ),
206
											'label_type'  => 'vertical',
207
											'placeholder' => __( 'Choose a template', 'invoicing' ),
208
											'class'       => 'form-control-sm',
209
											'value'       => $invoice->get_template( 'edit' ),
210
											'options'     => array(
211
												'quantity' => __( 'Quantity', 'invoicing' ),
212
												'hours'    => __( 'Hours', 'invoicing' ),
213
											),
214
											'data-allow-clear' => 'false',
215
											'select2'     => true,
216
										),
217
										true
218
									);
219
								?>
220
							</div>
221
							<div class="col-12 col-sm-6">
222
								<?php
223
224
									// Set currency.
225
									aui()->select(
226
										array(
227
											'id'          => 'wpinv_currency',
228
											'name'        => 'wpinv_currency',
229
											'label'       => __( 'Currency', 'invoicing' ),
230
											'label_type'  => 'vertical',
231
											'placeholder' => __( 'Select Invoice Currency', 'invoicing' ),
232
											'class'       => 'form-control-sm getpaid-recalculate-prices-on-change',
233
											'value'       => $invoice->get_currency( 'edit' ),
234
											'required'    => false,
235
											'data-allow-clear' => 'false',
236
											'select2'     => true,
237
											'options'     => wpinv_get_currencies(),
238
										),
239
										true
240
									);
241
242
								?>
243
							</div>
244
						</div>
245
246
						<?php do_action( 'wpinv_meta_box_invoice_template_row', $invoice->get_id() ); ?>
247
					<?php endif; ?>
248
249
					<div class="row">
250
						<div class="col-12 col-sm-6">
251
							<?php
252
								aui()->input(
253
									array(
254
										'type'        => 'text',
255
										'id'          => 'wpinv_company_id',
256
										'name'        => 'wpinv_company_id',
257
										'label'       => __( 'Company ID', 'invoicing' ),
258
										'label_type'  => 'vertical',
259
										'placeholder' => '',
260
										'class'       => 'form-control-sm',
261
										'value'       => $invoice->get_company_id( 'edit' ),
262
									),
263
									true
264
								);
265
							?>
266
						</div>
267
					</div>
268
269
					<?php do_action( 'getpaid_after_metabox_invoice_address', $invoice ); ?>
270
			</div>
271
		<?php
272
	}
273
274
	/**
275
	 * Save meta box data.
276
	 *
277
	 * @param int $post_id
278
	 * @param array $posted the posted data.
279
	 */
280
	public static function save( $post_id, $posted ) {
281
282
		// Prepare the invoice.
283
		$invoice = new WPInv_Invoice( $post_id );
284
285
		// Load new data.
286
		$invoice->set_props(
287
			array(
288
				'template'       => isset( $posted['wpinv_template'] ) ? wpinv_clean( $posted['wpinv_template'] ) : null,
289
				'email_cc'       => isset( $posted['wpinv_cc'] ) ? wpinv_clean( $posted['wpinv_cc'] ) : null,
290
				'disable_taxes'  => ! empty( $posted['disable_taxes'] ),
291
				'currency'       => isset( $posted['wpinv_currency'] ) ? wpinv_clean( $posted['wpinv_currency'] ) : null,
292
				'gateway'        => ( $invoice->needs_payment() && isset( $posted['wpinv_gateway'] ) ) ? wpinv_clean( $posted['wpinv_gateway'] ) : null,
293
				'address'        => isset( $posted['wpinv_address'] ) ? wpinv_clean( $posted['wpinv_address'] ) : null,
294
				'vat_number'     => isset( $posted['wpinv_vat_number'] ) ? wpinv_clean( $posted['wpinv_vat_number'] ) : null,
295
				'company'        => isset( $posted['wpinv_company'] ) ? wpinv_clean( $posted['wpinv_company'] ) : null,
296
				'company_id'     => isset( $posted['wpinv_company_id'] ) ? wpinv_clean( $posted['wpinv_company_id'] ) : null,
297
				'zip'            => isset( $posted['wpinv_zip'] ) ? wpinv_clean( $posted['wpinv_zip'] ) : null,
298
				'state'          => isset( $posted['wpinv_state'] ) ? wpinv_clean( $posted['wpinv_state'] ) : null,
299
				'city'           => isset( $posted['wpinv_city'] ) ? wpinv_clean( $posted['wpinv_city'] ) : null,
300
				'country'        => isset( $posted['wpinv_country'] ) ? wpinv_clean( $posted['wpinv_country'] ) : null,
301
				'phone'          => isset( $posted['wpinv_phone'] ) ? wpinv_clean( $posted['wpinv_phone'] ) : null,
302
				'first_name'     => isset( $posted['wpinv_first_name'] ) ? wpinv_clean( $posted['wpinv_first_name'] ) : null,
303
				'last_name'      => isset( $posted['wpinv_last_name'] ) ? wpinv_clean( $posted['wpinv_last_name'] ) : null,
304
				'author'         => isset( $posted['post_author_override'] ) ? wpinv_clean( $posted['post_author_override'] ) : null,
305
				'date_created'   => isset( $posted['date_created'] ) ? wpinv_clean( $posted['date_created'] ) : null,
306
				'date_completed' => isset( $posted['wpinv_date_completed'] ) ? wpinv_clean( $posted['wpinv_date_completed'] ) : null,
307
				'due_date'       => isset( $posted['wpinv_due_date'] ) ? wpinv_clean( $posted['wpinv_due_date'] ) : null,
308
				'number'         => isset( $posted['wpinv_number'] ) ? wpinv_clean( $posted['wpinv_number'] ) : null,
309
				'status'         => isset( $posted['wpinv_status'] ) ? wpinv_clean( $posted['wpinv_status'] ) : null,
310
			)
311
		);
312
313
		// Discount code.
314
		if ( ! $invoice->is_paid() && ! $invoice->is_refunded() ) {
315
316
			if ( isset( $posted['wpinv_discount_code'] ) ) {
317
				$invoice->set_discount_code( wpinv_clean( $posted['wpinv_discount_code'] ) );
0 ignored issues
show
It seems like wpinv_clean($posted['wpinv_discount_code']) can also be of type array; however, parameter $value of WPInv_Invoice::set_discount_code() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

317
				$invoice->set_discount_code( /** @scrutinizer ignore-type */ wpinv_clean( $posted['wpinv_discount_code'] ) );
Loading history...
318
			}
319
320
			$discount = new WPInv_Discount( $invoice->get_discount_code() );
321
			if ( $discount->exists() ) {
322
				$invoice->add_discount( getpaid_calculate_invoice_discount( $invoice, $discount ) );
323
			} else {
324
				$invoice->remove_discount( 'discount_code' );
325
			}
326
327
			// Recalculate totals.
328
			$invoice->recalculate_total();
329
330
		}
331
332
		// If we're creating a new user...
333
		if ( ! empty( $posted['wpinv_new_user'] ) && is_email( stripslashes( $posted['wpinv_email'] ) ) ) {
334
335
			// Attempt to create the user.
336
			$user = wpinv_create_user( sanitize_email( stripslashes( $posted['wpinv_email'] ) ), $invoice->get_first_name() . $invoice->get_last_name() );
337
338
			// If successful, update the invoice author.
339
			if ( is_numeric( $user ) ) {
0 ignored issues
show
The condition is_numeric($user) is always false.
Loading history...
340
				$invoice->set_author( $user );
341
			} else {
342
				wpinv_error_log( $user->get_error_message(), __( 'Invoice add new user', 'invoicing' ), __FILE__, __LINE__ );
343
			}
344
		}
345
346
		// Do not send new invoice notifications.
347
		$GLOBALS['wpinv_skip_invoice_notification'] = true;
348
349
		// Save the invoice.
350
		$invoice->save();
351
352
		// Save the user address.
353
		getpaid_save_invoice_user_address( $invoice );
354
355
		// Undo do not send new invoice notifications.
356
		$GLOBALS['wpinv_skip_invoice_notification'] = false;
357
358
		// (Maybe) send new user notification.
359
		$should_send_notification = wpinv_get_option( 'disable_new_user_emails' );
360
		if ( ! empty( $user ) && is_numeric( $user ) && apply_filters( 'getpaid_send_new_user_notification', empty( $should_send_notification ) ) ) {
361
			wp_send_new_user_notifications( $user, 'user' );
362
		}
363
364
		if ( ! empty( $posted['send_to_customer'] ) && ! $invoice->is_draft() ) {
365
			getpaid()->get( 'invoice_emails' )->user_invoice( $invoice, true );
366
		}
367
368
		// Fires after an invoice is saved.
369
		do_action( 'wpinv_invoice_metabox_saved', $invoice );
370
	}
371
}
372