Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/class-wpinv-privacy.php (1 issue)

Labels
Severity
1
<?php
2
/**
3
 * Privacy/GDPR related functionality which ties into WordPress functionality.
4
 */
5
6
defined( 'ABSPATH' ) || exit;
7
8
/**
9
 * WPInv_Privacy Class.
10
 */
11
class WPInv_Privacy extends WPInv_Abstract_Privacy {
12
13
    /**
14
     * This is the name of this object type.
15
     *
16
     * @var string
17
     */
18
    public $name = 'GetPaid';
19
20
    /**
21
     * Init - hook into events.
22
     */
23
    public function __construct() {
24
25
        // Init hooks.
26
        $this->init();
27
28
        // Initialize data exporters and erasers.
29
        add_action( 'init', array( $this, 'register_erasers_exporters' ) );
30
    }
31
32
   /**
33
     * Initial registration of privacy erasers and exporters.
34
     *
35
     * Due to the use of translation functions, this should run only after plugins loaded.
36
     */
37
    public function register_erasers_exporters() {
38
        $this->name = __( 'GetPaid', 'invoicing' );
39
40
        // This hook registers Invoicing data exporters.
41
        $this->add_exporter( 'wpinv-customer-invoices', __( 'Customer Invoices', 'invoicing' ), array( 'WPInv_Privacy_Exporters', 'customer_invoice_data_exporter' ) );
0 ignored issues
show
array('WPInv_Privacy_Exp...invoice_data_exporter') of type array<integer,string> is incompatible with the type string expected by parameter $callback of WPInv_Abstract_Privacy::add_exporter(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

41
        $this->add_exporter( 'wpinv-customer-invoices', __( 'Customer Invoices', 'invoicing' ), /** @scrutinizer ignore-type */ array( 'WPInv_Privacy_Exporters', 'customer_invoice_data_exporter' ) );
Loading history...
42
    }
43
44
    /**
45
     * Add privacy policy content for the privacy policy page.
46
     *
47
     * @since 1.4.0
48
     */
49
    public function get_privacy_message() {
50
51
        $content = '<div class="wp-suggested-text">' .
52
                   '<h2>' . __( 'Invoices and checkout', 'invoicing' ) . '</h2>' .
53
                   '<p class="privacy-policy-tutorial">' . __( 'Example privacy texts.', 'invoicing' ) . '</p>' .
54
                   '<p>' . __( 'We collect information about you during the checkout process on our site. This information may include, but is not limited to, your name, email address, phone number, address, IP and any other details that might be requested from you for the purpose of processing your payment and retaining your invoice details for legal reasons.', 'invoicing' ) . '</p>' .
55
                   '<p>' . __( 'Handling this data also allows us to:', 'invoicing' ) . '</p>' .
56
                   '<ul>' .
57
                   '<li>' . __( '- Send you important account/invoice/service information.', 'invoicing' ) . '</li>' .
58
                   '<li>' . __( '- Estimate taxes based on your location.', 'invoicing' ) . '</li>' .
59
                   '<li>' . __( '- Respond to your queries or complaints.', 'invoicing' ) . '</li>' .
60
                   '<li>' . __( '- Process payments and to prevent fraudulent transactions. We do this on the basis of our legitimate business interests.', 'invoicing' ) . '</li>' .
61
                   '<li>' . __( '- Retain historical payment and invoice history. We do this on the basis of legal obligations.', 'invoicing' ) . '</li>' .
62
                   '<li>' . __( '- Set up and administer your account, provide technical and/or customer support, and to verify your identity. We do this on the basis of our legitimate business interests.', 'invoicing' ) . '</li>' .
63
                   '</ul>' .
64
                   '<p>' . __( 'In addition to collecting information at checkout we may also use and store your contact details when manually creating invoices for require payments relating to prior contractual agreements or agreed terms.', 'invoicing' ) . '</p>' .
65
                   '<h2>' . __( 'What we share with others', 'invoicing' ) . '</h2>' .
66
                   '<p>' . __( 'We share information with third parties who help us provide our payment and invoicing services to you; for example --', 'invoicing' ) . '</p>' .
67
                   '<p class="privacy-policy-tutorial">' . __( 'In this subsection you should list which third party payment processors you’re using to take payments since these may handle customer data. We’ve included PayPal as an example, but you should remove this if you’re not using PayPal.', 'invoicing' ) . '</p>' .
68
                   '<p>' . __( 'We accept payments through PayPal. When processing payments, some of your data will be passed to PayPal, including information required to process or support the payment, such as the purchase total and billing information.', 'invoicing' ) . '</p>' .
69
                   '<p>' . __( 'Please see the <a href="https://www.paypal.com/us/webapps/mpp/ua/privacy-full">PayPal Privacy Policy</a> for more details.', 'invoicing' ) . '</p>' .
70
                   '</div>';
71
72
        return apply_filters( 'wpinv_privacy_policy_content', $content );
73
    }
74
75
}
76
77
new WPInv_Privacy();
78