Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/payments/class-getpaid-form-item.php (8 issues)

1
<?php
2
if ( ! defined( 'ABSPATH' ) ) {
3
	exit;
4
}
5
6
/**
7
 * Form Item Class
8
 *
9
 */
10
class GetPaid_Form_Item  extends WPInv_Item {
11
12
    /**
13
	 * Stores a custom description for the item.
14
	 *
15
	 * @var string
16
	 */
17
	protected $custom_description = null;
18
19
	/**
20
	 * Stores the item quantity.
21
	 *
22
	 * @var float
23
	 */
24
	protected $quantity = 1;
25
26
	/**
27
	 * Stores the item meta.
28
	 *
29
	 * @var array
30
	 */
31
	protected $meta = array();
32
33
	/**
34
	 * Is this item required?
35
	 *
36
	 * @var int
37
	 */
38
	protected $is_required = true;
39
40
	/**
41
	 * Are quantities allowed?
42
	 *
43
	 * @var int
44
	 */
45
	protected $allow_quantities = false;
46
47
	/**
48
	 * Associated invoice.
49
	 *
50
	 * @var int
51
	 */
52
	public $invoice_id = 0;
53
54
	/**
55
	 * Item discount.
56
	 *
57
	 * @var float
58
	 */
59
	public $item_discount = 0;
60
61
	/**
62
	 * Recurring item discount.
63
	 *
64
	 * @var float
65
	 */
66
	public $recurring_item_discount = 0;
67
68
	/**
69
	 * Item tax.
70
	 *
71
	 * @var float
72
	 */
73
	public $item_tax = 0;
74
75
    /*
76
	|--------------------------------------------------------------------------
77
	| CRUD methods
78
	|--------------------------------------------------------------------------
79
	|
80
	| Methods which create, read, update and delete items from the object.
81
	|
82
    */
83
84
    /*
85
	|--------------------------------------------------------------------------
86
	| Getters
87
	|--------------------------------------------------------------------------
88
    */
89
90
    /**
91
	 * Get the item name.
92
	 *
93
	 * @since 1.0.19
94
	 * @param  string $context View or edit context.
95
	 * @return string
96
	 */
97
	public function get_name( $context = 'view' ) {
98
		$name = parent::get_name( $context );
99
		return $name . wpinv_get_item_suffix( $this );
100
	}
101
102
	/**
103
	 * Get the item name without a suffix.
104
	 *
105
	 * @since 1.0.19
106
	 * @param  string $context View or edit context.
107
	 * @return string
108
	 */
109
	public function get_raw_name( $context = 'view' ) {
110
		return parent::get_name( $context );
111
	}
112
113
	/**
114
	 * Get the item description.
115
	 *
116
	 * @since 1.0.19
117
	 * @param  string $context View or edit context.
118
	 * @return string
119
	 */
120
	public function get_description( $context = 'view' ) {
121
122
		if ( isset( $this->custom_description ) ) {
123
			return $this->custom_description;
124
		}
125
126
		return parent::get_description( $context );
127
	}
128
129
	/**
130
	 * Returns the sub total.
131
	 *
132
	 * @since 1.0.19
133
	 * @param  string $context View or edit context.
134
	 * @return float
135
	 */
136
	public function get_sub_total( $context = 'view' ) {
137
		return $this->get_quantity( $context ) * $this->get_initial_price( $context );
138
	}
139
140
	/**
141
	 * Returns the recurring sub total.
142
	 *
143
	 * @since 1.0.19
144
	 * @param  string $context View or edit context.
145
	 * @return float
146
	 */
147
	public function get_recurring_sub_total( $context = 'view' ) {
148
149
		if ( $this->is_recurring() ) {
150
			return $this->get_quantity( $context ) * $this->get_price( $context );
151
		}
152
153
		return 0;
154
	}
155
156
	/**
157
	 * @deprecated
158
	 */
159
	public function get_qantity( $context = 'view' ) {
160
		return $this->get_quantity( $context );
161
	}
162
163
	/**
164
	 * Get the item quantity.
165
	 *
166
	 * @since 1.0.19
167
	 * @param  string $context View or edit context.
168
	 * @return float
169
	 */
170
	public function get_quantity( $context = 'view' ) {
171
		$quantity = (float) $this->quantity;
172
173
		if ( 'view' === $context ) {
174
			return apply_filters( 'getpaid_payment_form_item_quantity', $quantity, $this );
175
		}
176
177
		return $quantity;
178
179
	}
180
181
	/**
182
	 * Get the item meta data.
183
	 *
184
	 * @since 1.0.19
185
	 * @param  string $context View or edit context.
186
	 * @return meta
0 ignored issues
show
The type meta was not found. Maybe you did not declare it correctly or list all dependencies?

The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g. excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:

filter:
    dependency_paths: ["lib/*"]

For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths

Loading history...
187
	 */
188
	public function get_item_meta( $context = 'view' ) {
189
		$meta = $this->meta;
190
191
		if ( 'view' === $context ) {
192
			return apply_filters( 'getpaid_payment_form_item_meta', $meta, $this );
0 ignored issues
show
Bug Best Practice introduced by
The expression return apply_filters('ge...em_meta', $meta, $this) also could return the type array which is incompatible with the documented return type meta.
Loading history...
193
		}
194
195
		return $meta;
0 ignored issues
show
Bug Best Practice introduced by
The expression return $meta returns the type array which is incompatible with the documented return type meta.
Loading history...
196
197
	}
198
199
	/**
200
	 * Returns whether or not customers can update the item quantity.
201
	 *
202
	 * @since 1.0.19
203
	 * @param  string $context View or edit context.
204
	 * @return bool
205
	 */
206
	public function get_allow_quantities( $context = 'view' ) {
207
		$allow_quantities = (bool) $this->allow_quantities;
208
209
		if ( 'view' === $context ) {
210
			return apply_filters( 'getpaid_payment_form_item_allow_quantities', $allow_quantities, $this );
211
		}
212
213
		return $allow_quantities;
214
215
	}
216
217
	/**
218
	 * Returns whether or not the item is required.
219
	 *
220
	 * @since 1.0.19
221
	 * @param  string $context View or edit context.
222
	 * @return bool
223
	 */
224
	public function get_is_required( $context = 'view' ) {
225
		$is_required = (bool) $this->is_required;
226
227
		if ( 'view' === $context ) {
228
			return apply_filters( 'getpaid_payment_form_item_is_required', $is_required, $this );
229
		}
230
231
		return $is_required;
232
233
	}
234
235
	/**
236
	 * Prepares form data for use.
237
	 *
238
	 * @since 1.0.19
239
	 * @return array
240
	 */
241
	public function prepare_data_for_use( $required = null ) {
242
243
		$required = is_null( $required ) ? $this->is_required() : $required;
244
		return array(
245
			'title'            => wp_strip_all_tags( $this->get_name() ),
246
			'id'               => $this->get_id(),
247
			'price'            => $this->get_price(),
248
			'recurring'        => $this->is_recurring(),
249
			'description'      => $this->get_description(),
250
			'allow_quantities' => $this->allows_quantities(),
251
			'required'         => $required,
252
		);
253
254
	}
255
256
	/**
257
	 * Prepares form data for ajax use.
258
	 *
259
	 * @since 1.0.19
260
	 * @return array
261
	 */
262
	public function prepare_data_for_invoice_edit_ajax( $currency = '', $is_renewal = false ) {
263
264
		$description = getpaid_item_recurring_price_help_text( $this, $currency );
265
266
		if ( $description ) {
267
			$description = "<div class='getpaid-subscription-help-text'>$description</div>";
268
		}
269
270
		$price    = ! $is_renewal ? $this->get_price() : $this->get_recurring_price();
271
		$subtotal = ! $is_renewal ? $this->get_sub_total() : $this->get_recurring_sub_total();
272
		return array(
273
			'id'     => $this->get_id(),
274
			'texts'  => array(
275
				'item-name'        => sanitize_text_field( $this->get_name() ),
276
				'item-description' => wp_kses_post( $this->get_description() ) . $description,
277
				'item-quantity'    => floatval( $this->get_quantity() ),
278
				'item-price'       => wpinv_price( $price, $currency ),
279
				'item-total'       => wpinv_price( $subtotal, $currency ),
280
			),
281
			'inputs' => array(
282
				'item-id'          => $this->get_id(),
283
				'item-name'        => sanitize_text_field( $this->get_name() ),
284
				'item-description' => wp_kses_post( $this->get_description() ),
285
				'item-quantity'    => floatval( $this->get_quantity() ),
286
				'item-price'       => $price,
287
			),
288
		);
289
290
	}
291
292
	/**
293
	 * Prepares form data for saving (cart_details).
294
	 *
295
	 * @since 1.0.19
296
	 * @return array
297
	 */
298
	public function prepare_data_for_saving() {
299
300
		return array(
301
			'post_id'          => $this->invoice_id,
302
			'item_id'          => $this->get_id(),
303
			'item_name'        => sanitize_text_field( $this->get_raw_name( 'edit' ) ),
304
			'item_description' => $this->get_description( 'edit' ),
305
			'tax'              => $this->item_tax,
306
			'item_price'       => $this->get_price( 'edit' ),
307
			'quantity'         => (float) $this->get_quantity( 'edit' ),
308
			'discount'         => $this->item_discount,
309
			'subtotal'         => $this->get_sub_total( 'edit' ),
310
			'price'            => $this->get_sub_total( 'edit' ) + $this->item_tax - $this->item_discount,
311
			'meta'             => $this->get_item_meta( 'edit' ),
312
		);
313
314
	}
315
316
    /*
317
	|--------------------------------------------------------------------------
318
	| Setters
319
	|--------------------------------------------------------------------------
320
	|
321
	| Functions for setting order data. These should not update anything in the
322
	| database itself and should only change what is stored in the class
323
	| object.
324
    */
325
326
	/**
327
	 * Set the item qantity.
328
	 *
329
	 * @since 1.0.19
330
	 * @param  float $quantity The item quantity.
331
	 */
332
	public function set_quantity( $quantity ) {
333
334
		if ( ! is_numeric( $quantity ) ) {
0 ignored issues
show
The condition is_numeric($quantity) is always true.
Loading history...
335
			$quantity = 1;
336
		}
337
338
		$this->quantity = (float) $quantity;
339
340
	}
341
342
	/**
343
	 * Set the item meta data.
344
	 *
345
	 * @since 1.0.19
346
	 * @param  array $meta The item meta data.
347
	 */
348
	public function set_item_meta( $meta ) {
349
		$this->meta = maybe_unserialize( $meta );
0 ignored issues
show
$meta of type array is incompatible with the type string expected by parameter $data of maybe_unserialize(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

349
		$this->meta = maybe_unserialize( /** @scrutinizer ignore-type */ $meta );
Loading history...
350
	}
351
352
	/**
353
	 * Set whether or not the quantities are allowed.
354
	 *
355
	 * @since 1.0.19
356
	 * @param  bool $allow_quantities
357
	 */
358
	public function set_allow_quantities( $allow_quantities ) {
359
		$this->allow_quantities = (bool) $allow_quantities;
0 ignored issues
show
Documentation Bug introduced by
The property $allow_quantities was declared of type integer, but (bool)$allow_quantities is of type boolean. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
360
	}
361
362
	/**
363
	 * Set whether or not the item is required.
364
	 *
365
	 * @since 1.0.19
366
	 * @param  bool $is_required
367
	 */
368
	public function set_is_required( $is_required ) {
369
		$this->is_required = (bool) $is_required;
0 ignored issues
show
Documentation Bug introduced by
The property $is_required was declared of type integer, but (bool)$is_required is of type boolean. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
370
	}
371
372
	/**
373
	 * Sets the custom item description.
374
	 *
375
	 * @since 1.0.19
376
	 * @param  string $description
377
	 */
378
	public function set_custom_description( $description ) {
379
		$this->custom_description = $description;
380
	}
381
382
    /**
383
     * We do not want to save items to the database.
384
     *
385
	 * @return int item id
386
     */
387
    public function save( $data = array() ) {
0 ignored issues
show
The parameter $data is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

387
    public function save( /** @scrutinizer ignore-unused */ $data = array() ) {

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
388
        return $this->get_id();
389
	}
390
391
    /*
392
	|--------------------------------------------------------------------------
393
	| Conditionals
394
	|--------------------------------------------------------------------------
395
	|
396
	| Checks if a condition is true or false.
397
	|
398
	*/
399
400
    /**
401
	 * Checks whether the item has enabled dynamic pricing.
402
	 *
403
	 * @since 1.0.19
404
	 * @return bool
405
	 */
406
	public function is_required() {
407
        return (bool) $this->get_is_required();
408
	}
409
410
	/**
411
	 * Checks whether users can edit the quantities.
412
	 *
413
	 * @since 1.0.19
414
	 * @return bool
415
	 */
416
	public function allows_quantities() {
417
        return (bool) $this->get_allow_quantities();
418
	}
419
420
}
421