This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||||
2 | /** |
||||||
3 | * Invoicing extensions screen related functions |
||||||
4 | * |
||||||
5 | * All Invoicing extensions screen related functions can be found here. |
||||||
6 | * |
||||||
7 | */ |
||||||
8 | if ( ! defined( 'ABSPATH' ) ) { |
||||||
9 | exit; |
||||||
10 | } |
||||||
11 | |||||||
12 | /** |
||||||
13 | * WPInv_Admin_Addons Class. |
||||||
14 | */ |
||||||
15 | class WPInv_Admin_Addons extends Ayecode_Addons { |
||||||
16 | |||||||
17 | |||||||
18 | /** |
||||||
19 | * Get the extensions page tabs. |
||||||
20 | * |
||||||
21 | * @return array of tabs. |
||||||
22 | */ |
||||||
23 | public function get_tabs() { |
||||||
24 | $tabs = array( |
||||||
25 | 'addons' => __( 'Addons', 'invoicing' ), |
||||||
26 | 'gateways' => __( 'Payment Gateways', 'invoicing' ), |
||||||
27 | 'recommended_plugins' => __( 'Recommended plugins', 'invoicing' ), |
||||||
28 | 'membership' => __( 'Membership', 'invoicing' ), |
||||||
29 | ); |
||||||
30 | |||||||
31 | return $tabs; |
||||||
32 | } |
||||||
33 | |||||||
34 | /** |
||||||
35 | * Get section content for the addons screen. |
||||||
36 | * |
||||||
37 | * @param string $section_id |
||||||
38 | * |
||||||
39 | * @return array |
||||||
40 | */ |
||||||
41 | public function get_section_data( $section_id ) { |
||||||
42 | $section = self::get_tab( $section_id ); |
||||||
0 ignored issues
–
show
Bug
Best Practice
introduced
by
![]() |
|||||||
43 | $api_url = 'https://wpinvoicing.com/edd-api/v2/products/'; |
||||||
44 | $section_data = new stdClass(); |
||||||
45 | |||||||
46 | if ( $section_id == 'recommended_plugins' ) { |
||||||
47 | $section_data->products = self::get_recommend_wp_plugins_edd_formatted(); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::get_reco...plugins_edd_formatted() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
48 | } elseif ( ! empty( $section ) ) { |
||||||
49 | if ( false === ( $section_data = get_transient( 'wpi_addons_section_' . $section_id ) ) ) { //@todo restore after testing |
||||||
50 | //if ( 1==1) { |
||||||
51 | |||||||
52 | $query_args = array( |
||||||
53 | 'category' => $section_id, |
||||||
54 | 'number' => 100, |
||||||
55 | ); |
||||||
56 | $query_args = apply_filters( 'wpeu_edd_api_query_args', $query_args, $api_url, $section_id ); |
||||||
57 | |||||||
58 | $raw_section = wp_safe_remote_get( |
||||||
59 | esc_url_raw( add_query_arg( $query_args, $api_url ) ), |
||||||
60 | array( |
||||||
61 | 'user-agent' => 'Invoicing Addons Page', |
||||||
62 | 'timeout' => 15, |
||||||
63 | ) |
||||||
64 | ); |
||||||
65 | |||||||
66 | if ( ! is_wp_error( $raw_section ) ) { |
||||||
67 | $section_data = json_decode( wp_remote_retrieve_body( $raw_section ) ); |
||||||
68 | |||||||
69 | if ( ! empty( $section_data->products ) ) { |
||||||
70 | set_transient( 'wpi_addons_section_' . $section_id, $section_data, DAY_IN_SECONDS ); |
||||||
71 | } |
||||||
72 | } |
||||||
73 | } |
||||||
74 | } |
||||||
75 | |||||||
76 | $products = isset( $section_data->products ) ? $section_data->products : array(); |
||||||
77 | if ( 'addons' == $section_id ) { |
||||||
78 | |||||||
79 | $quotes = new stdClass(); |
||||||
80 | $quotes->info = new stdClass(); |
||||||
81 | $quotes->info->id = ''; |
||||||
82 | $quotes->info->slug = 'invoicing-quotes'; |
||||||
83 | $quotes->info->title = __( 'Quotes', 'invoicing' ); |
||||||
84 | $quotes->info->excerpt = __( 'Create quotes and estimates', 'invoicing' ); |
||||||
85 | $quotes->info->link = 'https://wordpress.org/plugins/invoicing-quotes/'; |
||||||
86 | $quotes->info->thumbnail = WPINV_PLUGIN_URL . 'assets/images/Quotes-1-768x384.png'; |
||||||
87 | |||||||
88 | $products[] = $quotes; |
||||||
89 | } |
||||||
90 | |||||||
91 | return apply_filters( 'wpi_addons_section_data', $products, $section_id ); |
||||||
92 | } |
||||||
93 | |||||||
94 | /** |
||||||
95 | * Outputs a button. |
||||||
96 | *ccc |
||||||
97 | * @param string $url |
||||||
98 | * @param string $text |
||||||
99 | * @param string $theme |
||||||
100 | * @param string $plugin |
||||||
101 | */ |
||||||
102 | public function output_button( $addon ) { |
||||||
103 | |||||||
104 | // print_r($addon); |
||||||
105 | $current_tab = empty( $_GET['tab'] ) ? 'addons' : sanitize_title( $_GET['tab'] ); |
||||||
106 | // $button_text = __('Free','invoicing'); |
||||||
107 | // $licensing = false; |
||||||
108 | // $installed = false; |
||||||
109 | // $price = ''; |
||||||
110 | // $license = ''; |
||||||
111 | // $slug = ''; |
||||||
112 | // $url = isset($addon->info->link) ? $addon->info->link : ''; |
||||||
113 | // $class = 'button-primary'; |
||||||
114 | // $install_status = 'get'; |
||||||
115 | // $onclick = ''; |
||||||
116 | |||||||
117 | $wp_org_themes = array( 'supreme-directory', 'directory-starter' ); |
||||||
118 | |||||||
119 | $button_args = array( |
||||||
120 | 'type' => ($current_tab == 'addons' || $current_tab == 'gateways') ? 'addons' : $current_tab, |
||||||
121 | 'id' => isset( $addon->info->id ) ? absint( $addon->info->id ) : '', |
||||||
122 | 'title' => isset( $addon->info->title ) ? $addon->info->title : '', |
||||||
123 | 'button_text' => __( 'Free', 'invoicing' ), |
||||||
124 | 'price_text' => __( 'Free', 'invoicing' ), |
||||||
125 | 'link' => isset( $addon->info->link ) ? $addon->info->link : '', // link to product |
||||||
126 | 'url' => isset( $addon->info->link ) ? $addon->info->link : '', // button url |
||||||
127 | 'class' => 'button-primary', |
||||||
128 | 'install_status' => 'get', |
||||||
129 | 'installed' => false, |
||||||
130 | 'price' => '', |
||||||
131 | 'licensing' => isset( $addon->licensing->enabled ) && $addon->licensing->enabled ? true : false, |
||||||
132 | 'license' => isset( $addon->licensing->license ) && $addon->licensing->license ? $addon->licensing->license : '', |
||||||
133 | 'onclick' => '', |
||||||
134 | 'slug' => isset( $addon->info->slug ) ? $addon->info->slug : '', |
||||||
135 | 'active' => false, |
||||||
136 | 'file' => '', |
||||||
137 | 'update_url' => '', |
||||||
138 | ); |
||||||
139 | |||||||
140 | if ( 'invoicing-quotes' == $addon->info->slug || 'getpaid-stripe-payments' == $addon->info->slug || ( $current_tab == 'recommended_plugins' && isset( $addon->info->slug ) && $addon->info->slug ) ) { |
||||||
141 | include_once ABSPATH . 'wp-admin/includes/plugin-install.php'; //for plugins_api.. |
||||||
142 | $status = install_plugin_install_status( |
||||||
143 | array( |
||||||
144 | 'slug' => $button_args['slug'], |
||||||
145 | 'version' => '', |
||||||
146 | ) |
||||||
147 | ); |
||||||
148 | $button_args['install_status'] = isset( $status['status'] ) ? $status['status'] : 'install'; |
||||||
149 | $button_args['file'] = isset( $status['file'] ) ? $status['file'] : ''; |
||||||
150 | } elseif ( ($current_tab == 'addons' || $current_tab == 'gateways') && isset( $addon->info->id ) && $addon->info->id ) { |
||||||
151 | include_once ABSPATH . 'wp-admin/includes/plugin-install.php'; //for plugins_api.. |
||||||
152 | if ( ! empty( $addon->licensing->edd_slug ) ) { |
||||||
153 | $button_args['slug'] = $addon->licensing->edd_slug;} |
||||||
154 | $status = self::install_plugin_install_status( $addon ); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::install_plugin_install_status() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
155 | $button_args['file'] = isset( $status['file'] ) ? $status['file'] : ''; |
||||||
156 | if ( isset( $status['status'] ) ) { |
||||||
157 | $button_args['install_status'] = $status['status'];} |
||||||
158 | $button_args['update_url'] = 'https://wpinvoicing.com'; |
||||||
159 | } elseif ( $current_tab == 'themes' && isset( $addon->info->id ) && $addon->info->id ) { |
||||||
160 | if ( ! empty( $addon->licensing->edd_slug ) ) { |
||||||
161 | $button_args['slug'] = $addon->licensing->edd_slug;} |
||||||
162 | $button_args['installed'] = self::is_theme_installed( $addon ); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::is_theme_installed() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
163 | if ( ! in_array( $button_args['slug'], $wp_org_themes ) ) { |
||||||
164 | $button_args['update_url'] = 'https://wpinvoicing.com'; |
||||||
165 | } |
||||||
166 | } |
||||||
167 | |||||||
168 | // set price |
||||||
169 | if ( isset( $addon->pricing ) && ! empty( $addon->pricing ) ) { |
||||||
170 | if ( is_object( $addon->pricing ) ) { |
||||||
171 | $prices = (array)$addon->pricing; |
||||||
172 | $button_args['price'] = reset( $prices ); |
||||||
173 | } elseif ( isset( $addon->pricing ) ) { |
||||||
174 | $button_args['price'] = $addon->pricing; |
||||||
175 | } |
||||||
176 | } |
||||||
177 | |||||||
178 | // set price text |
||||||
179 | if ( $button_args['price'] && $button_args['price'] != '0.00' ) { |
||||||
180 | $button_args['price_text'] = sprintf( __( 'From: $%d', 'invoicing' ), $button_args['price'] ); |
||||||
181 | } |
||||||
182 | |||||||
183 | // set if installed |
||||||
184 | if ( in_array( $button_args['install_status'], array( 'installed', 'latest_installed', 'update_available', 'newer_installed' ) ) ) { |
||||||
185 | $button_args['installed'] = true; |
||||||
186 | } |
||||||
187 | |||||||
188 | // print_r($button_args); |
||||||
189 | // set if active |
||||||
190 | if ( $button_args['installed'] && ($button_args['file'] || $button_args['type'] == 'themes') ) { |
||||||
191 | if ( $button_args['type'] != 'themes' ) { |
||||||
192 | $button_args['active'] = is_plugin_active( $button_args['file'] ); |
||||||
193 | } else { |
||||||
194 | $button_args['active'] = self::is_theme_active( $addon ); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::is_theme_active() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
195 | } |
||||||
196 | } |
||||||
197 | |||||||
198 | // set button text and class |
||||||
199 | if ( $button_args['active'] ) { |
||||||
200 | $button_args['button_text'] = __( 'Active', 'invoicing' ); |
||||||
201 | $button_args['class'] = ' button-secondary disabled '; |
||||||
202 | } elseif ( $button_args['installed'] ) { |
||||||
203 | $button_args['button_text'] = __( 'Activate', 'invoicing' ); |
||||||
204 | |||||||
205 | if ( $button_args['type'] != 'themes' ) { |
||||||
206 | if ( current_user_can( 'manage_options' ) ) { |
||||||
207 | $button_args['url'] = wp_nonce_url( admin_url( 'plugins.php?action=activate&plugin=' . $button_args['file'] ), 'activate-plugin_' . $button_args['file'] ); |
||||||
208 | } else { |
||||||
209 | $button_args['url'] = '#'; |
||||||
210 | } |
||||||
211 | } else { |
||||||
212 | if ( current_user_can( 'switch_themes' ) ) { |
||||||
213 | $button_args['url'] = self::get_theme_activation_url( $addon ); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::get_theme_activation_url() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
214 | } else { |
||||||
215 | $button_args['url'] = '#'; |
||||||
216 | } |
||||||
217 | } |
||||||
218 | } else { |
||||||
219 | if ( $button_args['type'] == 'recommended_plugins' ) { |
||||||
220 | $button_args['button_text'] = __( 'Install', 'invoicing' ); |
||||||
221 | } else { |
||||||
222 | $button_args['button_text'] = __( 'Get it', 'invoicing' ); |
||||||
223 | |||||||
224 | /*if($button_args['type'] == 'themes' && in_array($button_args['slug'],$wp_org_themes) ){ |
||||||
225 | $button_args['button_text'] = __('Install','invoicing'); |
||||||
226 | $button_args['url'] = self::get_theme_install_url($button_args['slug']); |
||||||
227 | $button_args['onclick'] = 'gd_set_button_installing(this);'; |
||||||
228 | }*/ |
||||||
229 | |||||||
230 | } |
||||||
231 | } |
||||||
232 | |||||||
233 | // filter the button arguments |
||||||
234 | $button_args = apply_filters( 'edd_api_button_args', $button_args ); |
||||||
235 | // print_r($button_args); |
||||||
236 | // set price text |
||||||
237 | if ( isset( $button_args['price_text'] ) ) { |
||||||
238 | ?> |
||||||
239 | <a |
||||||
240 | target="_blank" |
||||||
241 | class="addons-price-text" |
||||||
242 | href="<?php echo esc_url( $button_args['link'] ); ?>"> |
||||||
243 | <?php echo esc_html( $button_args['price_text'] ); ?> |
||||||
244 | </a> |
||||||
245 | <?php |
||||||
246 | } |
||||||
247 | |||||||
248 | ?> |
||||||
249 | <a |
||||||
250 | data-licence="<?php echo esc_attr( $button_args['license'] ); ?>" |
||||||
251 | data-licensing="<?php echo $button_args['licensing'] ? 1 : 0; ?>" |
||||||
252 | data-title="<?php echo esc_attr( $button_args['title'] ); ?>" |
||||||
253 | data-type="<?php echo esc_attr( $button_args['type'] ); ?>" |
||||||
254 | data-text-error-message="<?php esc_attr_e( 'Something went wrong!', 'invoicing' ); ?>" |
||||||
255 | data-text-activate="<?php esc_attr_e( 'Activate', 'invoicing' ); ?>" |
||||||
256 | data-text-activating="<?php esc_attr_e( 'Activating', 'invoicing' ); ?>" |
||||||
257 | data-text-deactivate="<?php esc_attr_e( 'Deactivate', 'invoicing' ); ?>" |
||||||
258 | data-text-installed="<?php esc_attr_e( 'Installed', 'invoicing' ); ?>" |
||||||
259 | data-text-install="<?php esc_attr_e( 'Install', 'invoicing' ); ?>" |
||||||
260 | data-text-installing="<?php esc_attr_e( 'Installing', 'invoicing' ); ?>" |
||||||
261 | data-text-error="<?php esc_attr_e( 'Error', 'invoicing' ); ?>" |
||||||
262 | <?php |
||||||
263 | if ( ! empty( $button_args['onclick'] ) ) { |
||||||
264 | echo " onclick='" . esc_attr( $button_args['onclick'] ) . "' ";} |
||||||
265 | ?> |
||||||
266 | class="addons-button <?php echo esc_attr( $button_args['class'] ); ?>" |
||||||
267 | href="<?php echo esc_url( $button_args['url'] ); ?>"> |
||||||
268 | <?php echo esc_html( $button_args['button_text'] ); ?> |
||||||
269 | </a> |
||||||
270 | <?php |
||||||
271 | |||||||
272 | } |
||||||
273 | |||||||
274 | |||||||
275 | /** |
||||||
276 | * Handles output of the addons page in admin. |
||||||
277 | */ |
||||||
278 | public function output() { |
||||||
279 | $tabs = self::get_tabs(); |
||||||
0 ignored issues
–
show
The method
WPInv_Admin_Addons::get_tabs() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
280 | $sections = self::get_sections(); |
||||||
0 ignored issues
–
show
The method
Ayecode_Addons::get_sections() is not static, but was called statically.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
281 | $theme = wp_get_theme(); |
||||||
0 ignored issues
–
show
|
|||||||
282 | $section_keys = array_keys( $sections ); |
||||||
283 | $current_section = isset( $_GET['section'] ) ? sanitize_text_field( $_GET['section'] ) : current( $section_keys ); |
||||||
0 ignored issues
–
show
|
|||||||
284 | $current_tab = empty( $_GET['tab'] ) ? 'addons' : sanitize_title( $_GET['tab'] ); |
||||||
0 ignored issues
–
show
|
|||||||
285 | include_once WPINV_PLUGIN_DIR . '/includes/admin/html-admin-page-addons.php'; |
||||||
286 | } |
||||||
287 | |||||||
288 | /** |
||||||
289 | * A list of recommended wp.org plugins. |
||||||
290 | * @return array |
||||||
291 | */ |
||||||
292 | public function get_recommend_wp_plugins() { |
||||||
293 | $plugins = array( |
||||||
294 | 'invoicing-quotes' => array( |
||||||
295 | 'url' => 'https://wordpress.org/plugins/invoicing-quotes/', |
||||||
296 | 'slug' => 'invoicing-quotes', |
||||||
297 | 'name' => 'Quotes', |
||||||
298 | 'thumbnail' => 'https://ps.w.org/invoicing-quotes/assets/banner-772x250.png', |
||||||
299 | 'desc' => __( 'Allows you to create quotes, send them to clients and convert them to Invoices when accepted by the customer.', 'invoicing' ), |
||||||
300 | ), |
||||||
301 | 'geodirectory' => array( |
||||||
302 | 'url' => 'https://wordpress.org/plugins/geodirectory/', |
||||||
303 | 'slug' => 'geodirectory', |
||||||
304 | 'name' => 'GeoDirectory', |
||||||
305 | 'desc' => __( 'Turn any WordPress theme into a global business directory portal.', 'invoicing' ), |
||||||
306 | ), |
||||||
307 | 'userswp' => array( |
||||||
308 | 'url' => 'https://wordpress.org/plugins/userswp/', |
||||||
309 | 'slug' => 'userswp', |
||||||
310 | 'name' => 'UsersWP', |
||||||
311 | 'desc' => __( 'Allow frontend user login and registration as well as have slick profile pages.', 'invoicing' ), |
||||||
312 | ), |
||||||
313 | ); |
||||||
314 | |||||||
315 | return $plugins; |
||||||
316 | } |
||||||
317 | } |
||||||
318 |