Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

meta-boxes/class-getpaid-meta-box-item-details.php (3 issues)

Labels
Severity
1
<?php
2
3
/**
4
 * Item Details
5
 *
6
 * Display the item data meta box.
7
 *
8
 */
9
10
if ( ! defined( 'ABSPATH' ) ) {
11
	exit; // Exit if accessed directly
12
}
13
14
/**
15
 * GetPaid_Meta_Box_Item_Details Class.
16
 */
17
class GetPaid_Meta_Box_Item_Details {
18
19
    /**
20
	 * Output the metabox.
21
	 *
22
	 * @param WP_Post $post
23
	 */
24
    public static function output( $post ) {
25
		global $aui_bs5;
26
27
        // Prepare the item.
28
        $item = new WPInv_Item( $post );
29
30
        // Nonce field.
31
        wp_nonce_field( 'getpaid_meta_nonce', 'getpaid_meta_nonce' );
32
33
        // Set the currency position.
34
        $position = wpinv_currency_position();
35
36
        if ( $position == 'left_space' ) {
37
            $position = 'left';
38
        }
39
40
        if ( $position == 'right_space' ) {
41
            $position = 'right';
42
        }
43
44
        ?>
45
        <input type="hidden" id="_wpi_current_type" value="<?php echo esc_attr( $item->get_type( 'edit' ) ); ?>" />
46
        <style>#poststuff .input-group-text,#poststuff .form-control{border-color:#7e8993}.bsui label.col-sm-3.col-form-label{font-weight:600}.form-check input[type="checkbox"]:checked::before{content:none}</style>
47
        <div class='bsui' style='max-width:650px;'><div class="pt-3">
48
            <?php do_action( 'wpinv_item_details_metabox_before_price', $item ); ?>
49
            <div class="form-group mb-3 row">
50
                <label class="col-sm-3 col-form-label" for="wpinv_item_price"><span><?php esc_html_e( 'Item Price', 'invoicing' ); ?></span></label>
51
                <div class="col-sm-8">
52
                    <div class="row">
53
                        <div class="col-sm-4 getpaid-price-input">
54
                            <div class="mb-3 input-group input-group-sm">
55
                                <?php if ( 'left' == $position ) : ?>
56
                                    <?php if ( empty( $aui_bs5 ) ) : ?>
57
                                        <div class="input-group-prepend">
58
                                            <span class="input-group-text"><?php echo wp_kses_post( wpinv_currency_symbol() ); ?></span>
0 ignored issues
show
It seems like wpinv_currency_symbol() can also be of type array; however, parameter $data of wp_kses_post() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

58
                                            <span class="input-group-text"><?php echo wp_kses_post( /** @scrutinizer ignore-type */ wpinv_currency_symbol() ); ?></span>
Loading history...
59
                                        </div>
60
                                    <?php else : ?>
61
                                        <span class="input-group-text">
62
                                            <?php echo wp_kses_post( wpinv_currency_symbol() ); ?>
63
                                        </span>
64
                                    <?php endif; ?>
65
                                <?php endif; ?>
66
67
                                <input type="text" name="wpinv_item_price" id="wpinv_item_price" value="<?php echo esc_attr( getpaid_unstandardize_amount( $item->get_price( 'edit' ) ) ); ?>" placeholder="<?php echo esc_attr( wpinv_sanitize_amount( 0 ) ); ?>" class="form-control">
68
69
                                <?php if ( 'left' != $position ) : ?>
70
                                    <?php if ( empty( $aui_bs5 ) ) : ?>
71
                                        <div class="input-group-append">
72
                                            <span class="input-group-text"><?php echo wp_kses_post( wpinv_currency_symbol() ); ?></span>
73
                                        </div>
74
                                    <?php else : ?>
75
                                        <span class="input-group-text">
76
                                            <?php echo wp_kses_post( wpinv_currency_symbol() ); ?>
77
                                        </span>
78
                                    <?php endif; ?>
79
                                <?php endif; ?>
80
                            </div>
81
                        </div>
82
                        <div class="col-sm-4 wpinv_show_if_recurring">
83
                            <div class="mb-3 input-group input-group-sm">
84
                                <?php if ( empty( $aui_bs5 ) ) : ?>
85
                                    <div class="input-group-prepend"><span class="input-group-text pl-0 pr-2 border-0 bg-transparent"><?php esc_html_e( 'every' ); ?></span></div>
86
                                <?php else : ?>
87
                                    <span class="input-group-text ps-0 pe-2 border-0"><?php esc_html_e( 'every' ); ?></span>
88
                                <?php endif; ?>
89
                                <input type="number" name="wpinv_recurring_interval" id="wpinv_recurring_interval" value="<?php echo esc_attr( $item->get_recurring_interval( 'edit' ) ); ?>" placeholder="1" class="form-control rounded-1 rounded-sm">
90
                            </div>
91
                        </div>
92
                        <div class="col-sm-4 wpinv_show_if_recurring">
93
                            <?php
94
                                aui()->select(
95
                                    array(
96
                                        'id'               => 'wpinv_recurring_period',
97
                                        'name'             => 'wpinv_recurring_period',
98
                                        'label'            => __( 'Period', 'invoicing' ),
99
                                        'placeholder'      => __( 'Select Period', 'invoicing' ),
100
                                        'value'            => $item->get_recurring_period( 'edit' ),
0 ignored issues
show
'edit' of type string is incompatible with the type boolean expected by parameter $full of WPInv_Item::get_recurring_period(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

100
                                        'value'            => $item->get_recurring_period( /** @scrutinizer ignore-type */ 'edit' ),
Loading history...
101
                                        'data-allow-clear' => 'false',
102
                                        'class'            => ( $aui_bs5 ? 'form-select-sm' : 'custom-select-sm' ),
103
                                        'options'          => array(
104
                                            'D' => __( 'day(s)', 'invoicing' ),
105
                                            'W' => __( 'week(s)', 'invoicing' ),
106
                                            'M' => __( 'month(s)', 'invoicing' ),
107
                                            'Y' => __( 'year(s)', 'invoicing' ),
108
                                        ),
109
                                    ),
110
                                    true
111
                                );
112
                            ?>
113
                        </div>
114
                    </div>
115
                    <div class="row">
116
                        <div class="col-sm-12">
117
                            <?php
118
119
                                // Dynamic pricing.
120
                                if ( $item->supports_dynamic_pricing() ) {
121
122
								do_action( 'wpinv_item_details_metabox_before_dynamic_pricing_checkbox', $item );
123
124
								// NYP toggle.
125
								aui()->input(
126
                                    array(
127
										'id'      => 'wpinv_name_your_price',
128
										'name'    => 'wpinv_name_your_price',
129
										'type'    => 'checkbox',
130
										'label'   => apply_filters( 'wpinv_name_your_price_toggle_text', __( 'Let customers name their price', 'invoicing' ) ),
131
										'value'   => '1',
132
										'checked' => $item->user_can_set_their_price(),
133
										'no_wrap' => true,
134
										'switch'  => 'sm',
135
                                    ),
136
                                    true
137
                                );
138
139
							do_action( 'wpinv_item_details_metabox_dynamic_pricing_checkbox', $item );
140
141
                                }
142
143
                                // Subscriptions.
144
                                do_action( 'wpinv_item_details_metabox_before_subscription_checkbox', $item );
145
                                aui()->input(
146
                                    array(
147
                                        'id'      => 'wpinv_is_recurring',
148
                                        'name'    => 'wpinv_is_recurring',
149
                                        'type'    => 'checkbox',
150
                                        'label'   => apply_filters( 'wpinv_is_recurring_toggle_text', __( 'Charge customers a recurring amount for this item', 'invoicing' ) ),
151
                                        'value'   => '1',
152
                                        'checked' => $item->is_recurring(),
153
                                        'no_wrap' => true,
154
										'switch'  => 'sm',
155
                                    ),
156
                                    true
157
                                );
158
                                do_action( 'wpinv_item_details_metabox_subscription_checkbox', $item );
159
160
                            ?>
161
                            <div class="wpinv_show_if_recurring">
162
                                <em><?php echo wp_kses_post( wpinv_get_recurring_gateways_text() ); ?></em>
163
                            </div>
164
                        </div>
165
                    </div>
166
                </div>
167
                <div class="col-sm-1 pt-2 pl-0">
168
                    <span class="wpi-help-tip dashicons dashicons-editor-help wpinv_show_if_recurring" title="<?php esc_attr_e( 'Set the subscription price, billing interval and period.', 'invoicing' ); ?>"></span>
169
                </div>
170
            </div>
171
            <?php do_action( 'wpinv_item_details_metabox_after_price', $item ); ?>
172
173
            <?php if ( $item->supports_dynamic_pricing() ) : ?>
174
                <?php do_action( 'wpinv_item_details_metabox_before_minimum_price', $item ); ?>
175
                <div class="wpinv_show_if_dynamic wpinv_minimum_price">
176
177
                    <div class="form-group mb-3 row">
178
                        <label for="wpinv_minimum_price" class="col-sm-3 col-form-label">
179
                            <?php esc_html_e( 'Minimum Price', 'invoicing' ); ?>
180
                        </label>
181
                        <div class="col-sm-8">
182
                            <div class="input-group input-group-sm">
183
                                <?php if ( 'left' == $position ) : ?>
184
                                    <?php if ( empty( $aui_bs5 ) ) : ?>
185
                                        <div class="input-group-prepend">
186
                                            <span class="input-group-text"><?php echo wp_kses_post( wpinv_currency_symbol() ); ?></span>
187
                                        </div>
188
                                    <?php else : ?>
189
                                        <span class="input-group-text">
190
                                            <?php echo wp_kses_post( wpinv_currency_symbol() ); ?>
191
                                        </span>
192
                                    <?php endif; ?>
193
                                <?php endif; ?>
194
195
                                <input type="text" name="wpinv_minimum_price" id="wpinv_minimum_price" value="<?php echo esc_attr( getpaid_unstandardize_amount( $item->get_minimum_price( 'edit' ) ) ); ?>" placeholder="<?php echo esc_attr( wpinv_sanitize_amount( 0 ) ); ?>" class="form-control">
196
197
                                <?php if ( 'left' != $position ) : ?>
198
                                    <?php if ( empty( $aui_bs5 ) ) : ?>
199
                                        <div class="input-group-append">
200
                                            <span class="input-group-text"><?php echo wp_kses_post( wpinv_currency_symbol() ); ?></span>
201
                                        </div>
202
                                    <?php else : ?>
203
                                        <span class="input-group-text">
204
                                            <?php echo wp_kses_post( wpinv_currency_symbol() ); ?>
205
                                        </span>
206
                                    <?php endif; ?>
207
                                <?php endif; ?>
208
                            </div>
209
                        </div>
210
211
                        <div class="col-sm-1 pt-2 pl-0">
212
                            <span class="wpi-help-tip dashicons dashicons-editor-help" title="<?php esc_attr_e( 'Enter the minimum amount that users are allowed to set', 'invoicing' ); ?>"></span>
213
                        </div>
214
                    </div>
215
216
                </div>
217
                <?php do_action( 'wpinv_item_details_metabox_minimum_price', $item ); ?>
218
            <?php endif; ?>
219
220
            <?php do_action( 'wpinv_item_details_metabox_before_maximum_renewals', $item ); ?>
221
            <div class="wpinv_show_if_recurring wpinv_maximum_renewals">
222
223
                <div class="form-group mb-3 row">
224
                    <label for="wpinv_recurring_limit" class="col-sm-3 col-form-label">
225
                        <?php esc_html_e( 'Maximum Renewals', 'invoicing' ); ?>
226
                    </label>
227
                    <div class="col-sm-8">
228
                        <input type="number" value="<?php echo esc_attr( $item->get_recurring_limit( 'edit' ) ); ?>" placeholder="0" name="wpinv_recurring_limit" id="wpinv_recurring_limit" class="form-control form-control-sm" />
229
                    </div>
230
                    <div class="col-sm-1 pt-2 pl-0">
231
                        <span class="wpi-help-tip dashicons dashicons-editor-help" title="<?php esc_attr_e( 'Leave empty if you want the subscription to renew until it is cancelled.', 'invoicing' ); ?>"></span>
232
                    </div>
233
                </div>
234
235
            </div>
236
            <?php do_action( 'wpinv_item_details_metabox_maximum_renewals', $item ); ?>
237
238
            <?php do_action( 'wpinv_item_details_metabox_before_free_trial', $item ); ?>
239
            <div class="wpinv_show_if_recurring wpinv_free_trial">
240
241
                <div class="form-group mb-3 row">
242
                    <label class="col-sm-3 col-form-label" for="wpinv_trial_interval"><?php defined( 'GETPAID_PAID_TRIALS_VERSION' ) ? esc_html_e( 'Free/Paid Trial', 'invoicing' ) : esc_html_e( 'Free Trial', 'invoicing' ); ?></label>
243
244
                    <div class="col-sm-8">
245
                        <div class="row">
246
                            <div class="col-sm-6">
247
                                <?php $value = $item->has_free_trial() ? $item->get_trial_interval( 'edit' ) : 0; ?>
248
249
                                <div>
250
                                    <input type="number" name="wpinv_trial_interval" placeholder="0" id="wpinv_trial_interval" value="<?php echo esc_attr( $value ); ?>" class="form-control form-control-sm">
251
                                </div>
252
                            </div>
253
                            <div class="col-sm-6">
254
                                <?php
255
                                    aui()->select(
256
                                        array(
257
                                            'id'          => 'wpinv_trial_period',
258
                                            'name'        => 'wpinv_trial_period',
259
                                            'label'       => __( 'Trial Period', 'invoicing' ),
260
                                            'placeholder' => __( 'Trial Period', 'invoicing' ),
261
                                            'value'       => $item->get_trial_period( 'edit' ),
0 ignored issues
show
'edit' of type string is incompatible with the type boolean expected by parameter $full of WPInv_Item::get_trial_period(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

261
                                            'value'       => $item->get_trial_period( /** @scrutinizer ignore-type */ 'edit' ),
Loading history...
262
                                            'data-allow-clear' => 'false',
263
                                            'no_wrap'     => true,
264
                                            'class'       => ( $aui_bs5 ? 'form-select-sm' : 'custom-select-sm' ),
265
                                            'options'     => array(
266
                                                'D' => __( 'day(s)', 'invoicing' ),
267
                                                'W' => __( 'week(s)', 'invoicing' ),
268
                                                'M' => __( 'month(s)', 'invoicing' ),
269
                                                'Y' => __( 'year(s)', 'invoicing' ),
270
                                            ),
271
                                        ),
272
                                        true
273
                                    );
274
                                ?>
275
276
                            </div>
277
                        </div>
278
                    </div>
279
280
                    <div class="col-sm-1 pt-2 pl-0">
281
                        <span class="wpi-help-tip dashicons dashicons-editor-help" title="<?php esc_attr_e( 'An optional period of time to wait before charging the first recurring payment.', 'invoicing' ); ?>"></span>
282
                    </div>
283
284
                </div>
285
286
            </div>
287
            <?php do_action( 'wpinv_item_details_metabox__free_trial', $item ); ?>
288
289
            <?php do_action( 'wpinv_item_details_metabox_item_details', $item ); ?>
290
        </div>
291
        </div>
292
        <?php
293
    }
294
295
    /**
296
	 * Save meta box data.
297
	 *
298
	 * @param int $post_id
299
	 */
300
	public static function save( $post_id ) {
301
302
        // Prepare the item.
303
        $item = new WPInv_Item( $post_id );
304
305
        // Load new data.
306
        $item->set_props(
307
			array(
308
				'price'              => isset( $_POST['wpinv_item_price'] ) ? getpaid_standardize_amount( $_POST['wpinv_item_price'] ) : null,
309
				'vat_rule'           => isset( $_POST['wpinv_vat_rules'] ) ? wpinv_clean( $_POST['wpinv_vat_rules'] ) : null,
310
				'vat_class'          => isset( $_POST['wpinv_vat_class'] ) ? wpinv_clean( $_POST['wpinv_vat_class'] ) : null,
311
				'type'               => isset( $_POST['wpinv_item_type'] ) ? wpinv_clean( $_POST['wpinv_item_type'] ) : null,
312
				'is_dynamic_pricing' => ! empty( $_POST['wpinv_name_your_price'] ),
313
                'minimum_price'      => isset( $_POST['wpinv_minimum_price'] ) ? getpaid_standardize_amount( $_POST['wpinv_minimum_price'] ) : null,
314
				'is_recurring'       => ! empty( $_POST['wpinv_is_recurring'] ),
315
				'recurring_period'   => isset( $_POST['wpinv_recurring_period'] ) ? wpinv_clean( $_POST['wpinv_recurring_period'] ) : null,
316
				'recurring_interval' => isset( $_POST['wpinv_recurring_interval'] ) ? (int) $_POST['wpinv_recurring_interval'] : 1,
317
				'recurring_limit'    => isset( $_POST['wpinv_recurring_limit'] ) ? (int) $_POST['wpinv_recurring_limit'] : null,
318
				'is_free_trial'      => isset( $_POST['wpinv_trial_interval'] ) ? ( 0 != (int) $_POST['wpinv_trial_interval'] ) : null,
319
				'trial_period'       => isset( $_POST['wpinv_trial_period'] ) ? wpinv_clean( $_POST['wpinv_trial_period'] ) : null,
320
				'trial_interval'     => isset( $_POST['wpinv_trial_interval'] ) ? (int) $_POST['wpinv_trial_interval'] : null,
321
			)
322
        );
323
324
		$item->save();
325
		do_action( 'getpaid_item_metabox_save', $post_id, $item );
326
	}
327
}
328