Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/class-bp-getpaid-component.php (1 issue)

1
<?php
2
/**
3
 * BuddyPress & GetPaid integration.
4
 *
5
 * @package GetPaid
6
 * @subpackage BuddyPress
7
 * @since 2.1.5
8
 */
9
10
// Exit if accessed directly.
11
defined( 'ABSPATH' ) || exit;
12
13
/**
14
 * Main GetPaid Class.
15
 *
16
 * @since 2.1.5
17
 */
18
class BP_GetPaid_Component extends BP_Component {
19
20
	/**
21
	 * Start the component setup process.
22
	 *
23
	 * @since 2.1.5
24
	 */
25
	public function __construct() {
26
		parent::start(
27
			'getpaid',
28
			'GetPaid',
29
			buddypress()->plugin_dir,
30
			array(
31
				'adminbar_myaccount_order' => 30,
32
			)
33
		);
34
	}
35
36
    /**
37
	 * Set up component global variables.
38
	 *
39
	 * @since 2.1.5
40
	 *
41
	 *
42
	 * @param array $args {
43
	 *     All values are optional.
44
	 *     @type string   $slug                  The component slug. Used to construct certain URLs, such as 'friends' in
45
	 *                                           http://example.com/members/joe/friends/. Default: the value of $this->id.
46
	 *     @type string   $root_slug             The component root slug. Note that this value is generally unused if the
47
	 *                                           component has a root directory (the slug will be overridden by the
48
	 *                                           post_name of the directory page). Default: the slug of the directory page
49
	 *                                           if one is found, otherwise an empty string.
50
	 *     @type bool     $has_directory         Set to true if the component requires an associated WordPress page.
51
	 *     @type callable $notification_callback Optional. The callable function that formats the component's notifications.
52
	 *     @type string   $search_term           Optional. The placeholder text in the component directory search box. Eg,
53
	 *                                           'Search Groups...'.
54
	 *     @type array    $global_tables         Optional. An array of database table names.
55
	 *     @type array    $meta_tables           Optional. An array of metadata table names.
56
	 * }
57
	 */
58
	public function setup_globals( $args = array() ) {
59
        parent::setup_globals(
60
            array(
61
                'id'            => 'getpaid',
62
                'slug'          => 'getpaid',
63
                'root_slug'     => 'getpaid',
64
                'has_directory' => false,
65
            )
66
        );
67
	}
68
69
	/**
70
	 * Set up component navigation.
71
	 *
72
	 * @since 2.1.5
73
	 *
74
	 * @see BP_Component::setup_nav() for a description of arguments.
75
	 *
76
	 * @param array $main_nav Optional. See BP_Component::setup_nav() for description.
77
	 * @param array $sub_nav  Optional. See BP_Component::setup_nav() for description.
78
	 */
79
	public function setup_nav( $main_nav = array(), $sub_nav = array() ) {
80
81
		// Abort if the integration is inactive.
82
        if ( ! getpaid_is_buddypress_integration_active() || ! is_user_logged_in() ) {
83
            return;
84
        }
85
86
        // Or a user is not viewing their profile.
87
        if ( bp_displayed_user_id() !== bp_loggedin_user_id() ) {
88
            return;
89
        }
90
91
		// Determine user to use.
92
		$user_domain   = bp_loggedin_user_domain();
93
		$slug          = 'getpaid';
94
		$payments_link = trailingslashit( $user_domain . $slug );
95
96
		// Add 'Payments' to the main navigation.
97
		$main_nav = array(
98
			'name'                    => _x( 'Billing', 'BuddyPress profile payments screen nav', 'invoicing' ),
99
			'slug'                    => $slug,
100
			'position'                => apply_filters( 'wpinv_bp_nav_position', wpinv_get_option( 'wpinv_menu_position', 91 ), $slug ),
101
			'screen_function'         => array( $this, 'display_current_tab' ),
102
			'default_subnav_slug'     => apply_filters( 'getpaid_default_tab', 'gp-edit-address' ),
103
            'show_for_displayed_user' => false,
104
			'item_css_id'             => $this->id,
105
			'parent_url'              => $user_domain,
106
			'parent_slug'             => buddypress()->slug,
107
		);
108
109
		// Add the subnav items to the payments nav item if we are using a theme that supports this.
110
        foreach ( getpaid_get_user_content_tabs() as $_slug => $tab ) {
111
112
            $sub_nav[] = array(
113
                'name'                    => $tab['label'],
114
                'slug'                    => $_slug,
115
                'parent_url'              => $payments_link,
116
                'parent_slug'             => $slug,
117
                'position'                => 10,
118
                'screen_function'         => function() use ( $tab ) {
119
					$GLOBALS['getpaid_bp_current_tab'] = $tab;
120
					$this->display_current_tab();
121
                },
122
                'show_for_displayed_user' => false,
123
                'item_css_id'             => "getpaid-bp-$_slug",
124
            );
125
126
        }
127
128
		parent::setup_nav( $main_nav, $sub_nav );
129
	}
130
131
	/**
132
	 * Set up the component entries in the WordPress Admin Bar.
133
	 *
134
	 * @since 2.1.5
135
	 *
136
	 * @see BP_Component::setup_nav() for a description of the $wp_admin_nav
137
	 *      parameter array.
138
	 *
139
	 * @param array $wp_admin_nav See BP_Component::setup_admin_bar() for a
140
	 *                            description.
141
	 */
142
	public function setup_admin_bar( $wp_admin_nav = array() ) {
143
144
		// Menus for logged in user.
145
		if ( is_user_logged_in() ) {
146
147
			// Setup the logged in user variables.
148
			$payments_link = trailingslashit( bp_loggedin_user_domain() . 'getpaid/' );
149
150
            // Add the "Payments" sub menu.
151
            $wp_admin_nav[] = array(
152
                'parent' => buddypress()->my_account_menu_id,
153
                'id'     => 'my-account-getpaid',
154
                'title'  => _x( 'Billing', 'BuddyPress my account payments sub nav', 'invoicing' ),
155
                'href'   => $payments_link . apply_filters( 'getpaid_default_tab', 'gp-edit-address' ),
156
            );
157
158
            foreach ( getpaid_get_user_content_tabs() as $slug => $tab ) {
159
160
                $wp_admin_nav[] = array(
161
                    'parent'   => 'my-account-getpaid',
162
                    'id'       => 'my-account-getpaid' . $slug,
163
                    'title'    => $tab['label'],
164
                    'href'     => trailingslashit( $payments_link . $slug ),
165
                    'position' => 20,
166
                );
167
168
            }
169
}
170
171
		parent::setup_admin_bar( $wp_admin_nav );
172
	}
173
174
	/**
175
	 * Retrieves the current tab.
176
	 *
177
	 * @since 2.1.5
178
	 */
179
	public function get_current_tab() {
180
		global $getpaid_bp_current_tab;
181
182
		if ( empty( $getpaid_bp_current_tab ) ) {
183
			return array(
184
				'label'   => __( 'Invoices', 'invoicing' ),
185
				'content' => '[wpinv_history]',
186
				'icon'    => 'fas fa-file-invoice',
187
			);
188
		}
189
190
		return $getpaid_bp_current_tab;
191
	}
192
193
	/**
194
	 * Displays the current tab.
195
	 *
196
	 * @since 2.1.5
197
	 */
198
	public function display_current_tab() {
199
200
		add_action( 'bp_template_content', array( $this, 'handle_display_current_tab' ) );
201
		$template = apply_filters( 'bp_core_template_plugin', 'members/single/plugins' );
202
203
        bp_core_load_template( apply_filters( 'wpinv_bp_core_template_plugin', $template ) );
0 ignored issues
show
The function bp_core_load_template was not found. Maybe you did not declare it correctly or list all dependencies? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

203
        /** @scrutinizer ignore-call */ 
204
        bp_core_load_template( apply_filters( 'wpinv_bp_core_template_plugin', $template ) );
Loading history...
204
	}
205
206
	/**
207
	 * Handles the actual display of the current tab.
208
	 *
209
	 * @since 2.1.5
210
	 */
211
	public function handle_display_current_tab() {
212
		echo getpaid_prepare_user_content_tab( $this->get_current_tab() );
213
	}
214
215
}
216