AyeCode /
invoicing
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | /** |
||||
| 3 | * Contains the class that exports invoices. |
||||
| 4 | * |
||||
| 5 | * |
||||
| 6 | */ |
||||
| 7 | |||||
| 8 | defined( 'ABSPATH' ) || exit; |
||||
| 9 | |||||
| 10 | /** |
||||
| 11 | * GetPaid_Invoice_Exporter Class. |
||||
| 12 | */ |
||||
| 13 | class GetPaid_Invoice_Exporter extends GetPaid_Graph_Downloader { |
||||
| 14 | |||||
| 15 | /** |
||||
| 16 | * Retrieves invoices query args. |
||||
| 17 | * |
||||
| 18 | * @param string $post_type post type to retrieve. |
||||
| 19 | * @param array $args Args to search for. |
||||
| 20 | * @return array |
||||
| 21 | */ |
||||
| 22 | public function get_invoice_query_args( $post_type, $args ) { |
||||
| 23 | |||||
| 24 | $query_args = array( |
||||
| 25 | 'post_type' => $post_type, |
||||
| 26 | 'post_status' => array_keys( wpinv_get_invoice_statuses( true, false, $post_type ) ), |
||||
| 27 | 'posts_per_page' => -1, |
||||
| 28 | 'no_found_rows' => true, |
||||
| 29 | 'update_post_term_cache' => false, |
||||
| 30 | 'fields' => 'ids', |
||||
| 31 | ); |
||||
| 32 | |||||
| 33 | if ( ! empty( $args['status'] ) && in_array( $args['status'], $query_args['post_status'], true ) ) { |
||||
| 34 | $query_args['post_status'] = wpinv_clean( wpinv_parse_list( $args['status'] ) ); |
||||
| 35 | } |
||||
| 36 | |||||
| 37 | $date_query = array(); |
||||
| 38 | if ( ! empty( $args['to_date'] ) ) { |
||||
| 39 | $date_query['before'] = wpinv_clean( $args['to_date'] ); |
||||
| 40 | } |
||||
| 41 | |||||
| 42 | if ( ! empty( $args['from_date'] ) ) { |
||||
| 43 | $date_query['after'] = wpinv_clean( $args['from_date'] ); |
||||
| 44 | } |
||||
| 45 | |||||
| 46 | if ( ! empty( $date_query ) ) { |
||||
| 47 | $date_query['inclusive'] = true; |
||||
| 48 | $query_args['date_query'] = array( $date_query ); |
||||
| 49 | } |
||||
| 50 | |||||
| 51 | return $query_args; |
||||
| 52 | } |
||||
| 53 | |||||
| 54 | /** |
||||
| 55 | * Retrieves invoices. |
||||
| 56 | * |
||||
| 57 | * @param array $query_args WP_Query args. |
||||
| 58 | * @return WPInv_Invoice[] |
||||
| 59 | */ |
||||
| 60 | public function get_invoices( $query_args ) { |
||||
| 61 | |||||
| 62 | // Get invoices. |
||||
| 63 | $invoices = new WP_Query( $query_args ); |
||||
| 64 | |||||
| 65 | // Prepare the results. |
||||
| 66 | return array_map( 'wpinv_get_invoice', $invoices->posts ); |
||||
| 67 | |||||
| 68 | } |
||||
| 69 | |||||
| 70 | /** |
||||
| 71 | * Handles the actual download. |
||||
| 72 | * |
||||
| 73 | */ |
||||
| 74 | public function export( $post_type, $args ) { |
||||
| 75 | |||||
| 76 | $invoices = $this->get_invoices( $this->get_invoice_query_args( $post_type, $args ) ); |
||||
| 77 | $stream = $this->prepare_output(); |
||||
| 78 | $headers = $this->get_export_fields( $post_type ); |
||||
| 79 | $file_type = $this->prepare_file_type( strtolower( getpaid_get_post_type_label( $post_type ) ) ); |
||||
| 80 | |||||
| 81 | if ( 'csv' == $file_type ) { |
||||
| 82 | $this->download_csv( $invoices, $stream, $headers ); |
||||
| 83 | } elseif ( 'xml' == $file_type ) { |
||||
| 84 | $this->download_xml( $invoices, $stream, $headers ); |
||||
| 85 | } else { |
||||
| 86 | $this->download_json( $invoices, $stream, $headers ); |
||||
| 87 | } |
||||
| 88 | |||||
| 89 | fclose( $stream ); |
||||
| 90 | exit; |
||||
|
0 ignored issues
–
show
|
|||||
| 91 | } |
||||
| 92 | |||||
| 93 | /** |
||||
| 94 | * Prepares a single invoice for download. |
||||
| 95 | * |
||||
| 96 | * @param WPInv_Invoice $invoice The invoice to prepare.. |
||||
| 97 | * @param array $fields The fields to stream. |
||||
| 98 | * @since 1.0.19 |
||||
| 99 | * @return array |
||||
| 100 | */ |
||||
| 101 | public function prepare_row( $invoice, $fields ) { |
||||
| 102 | |||||
| 103 | $prepared = array(); |
||||
| 104 | $amount_fields = $this->get_amount_fields( $invoice->get_post_type() ); |
||||
| 105 | $meta_fields = $this->get_payment_form_meta( $invoice ); |
||||
| 106 | |||||
| 107 | foreach ( $fields as $field ) { |
||||
| 108 | $value = ''; |
||||
| 109 | $method = "get_$field"; |
||||
| 110 | |||||
| 111 | if ( method_exists( $invoice, $method ) ) { |
||||
| 112 | $value = $invoice->$method(); |
||||
| 113 | } else if( strpos( $field, '_' ) === 0 && isset( $meta_fields[ $field ] ) ) { |
||||
| 114 | $value = $meta_fields[ $field ]; |
||||
| 115 | } |
||||
| 116 | |||||
| 117 | if ( in_array( $field, $amount_fields ) ) { |
||||
| 118 | $value = wpinv_round_amount( wpinv_sanitize_amount( $value ) ); |
||||
| 119 | } |
||||
| 120 | |||||
| 121 | $prepared[ $field ] = wpinv_clean( $value ); |
||||
| 122 | |||||
| 123 | } |
||||
| 124 | |||||
| 125 | return $prepared; |
||||
| 126 | } |
||||
| 127 | |||||
| 128 | /** |
||||
| 129 | * Retrieves export fields. |
||||
| 130 | * |
||||
| 131 | * @param string $post_type |
||||
| 132 | * @since 1.0.19 |
||||
| 133 | * @return array |
||||
| 134 | */ |
||||
| 135 | public function get_export_fields( $post_type ) { |
||||
| 136 | |||||
| 137 | $fields = array( |
||||
| 138 | 'id', |
||||
| 139 | 'parent_id', |
||||
| 140 | 'status', |
||||
| 141 | 'date_created', |
||||
| 142 | 'date_modified', |
||||
| 143 | 'date_due', |
||||
| 144 | 'date_completed', |
||||
| 145 | 'number', |
||||
| 146 | 'key', |
||||
| 147 | 'description', |
||||
| 148 | 'post_type', |
||||
| 149 | 'mode', |
||||
| 150 | 'customer_id', |
||||
| 151 | 'customer_first_name', |
||||
| 152 | 'customer_last_name', |
||||
| 153 | 'customer_phone', |
||||
| 154 | 'customer_email', |
||||
| 155 | 'customer_country', |
||||
| 156 | 'customer_city', |
||||
| 157 | 'customer_state', |
||||
| 158 | 'customer_zip', |
||||
| 159 | 'customer_company', |
||||
| 160 | 'customer_vat_number', |
||||
| 161 | 'customer_address', |
||||
| 162 | 'subtotal', |
||||
| 163 | 'total_discount', |
||||
| 164 | 'total_tax', |
||||
| 165 | 'total_fees', |
||||
| 166 | 'fees', |
||||
| 167 | 'discounts', |
||||
| 168 | 'taxes', |
||||
| 169 | 'cart_details', |
||||
| 170 | 'item_ids', |
||||
| 171 | 'payment_form', |
||||
| 172 | 'discount_code', |
||||
| 173 | 'gateway', |
||||
| 174 | 'transaction_id', |
||||
| 175 | 'currency', |
||||
| 176 | 'disable_taxes', |
||||
| 177 | 'subscription_id', |
||||
| 178 | 'remote_subscription_id', |
||||
| 179 | 'is_viewed', |
||||
| 180 | 'email_cc', |
||||
| 181 | 'template', |
||||
| 182 | 'created_via', |
||||
| 183 | ); |
||||
| 184 | |||||
| 185 | // Payment form meta fields. |
||||
| 186 | $meta_fields = getpaid_get_payment_form_custom_fields(); |
||||
| 187 | |||||
| 188 | if ( ! empty( $meta_fields ) ) { |
||||
| 189 | foreach ( $meta_fields as $field_key => $field_label ) { |
||||
| 190 | $fields[] = $field_key; |
||||
| 191 | } |
||||
| 192 | } |
||||
| 193 | |||||
| 194 | return apply_filters( 'getpaid_invoice_exporter_get_fields', $fields, $post_type ); |
||||
| 195 | } |
||||
| 196 | |||||
| 197 | /** |
||||
| 198 | * Retrieves amount fields. |
||||
| 199 | * |
||||
| 200 | * @param string $post_type |
||||
| 201 | * @since 1.0.19 |
||||
| 202 | * @return array |
||||
| 203 | */ |
||||
| 204 | public function get_amount_fields( $post_type ) { |
||||
| 205 | |||||
| 206 | $fields = array( |
||||
| 207 | 'subtotal', |
||||
| 208 | 'total_discount', |
||||
| 209 | 'total_tax', |
||||
| 210 | 'total_fees', |
||||
| 211 | ); |
||||
| 212 | |||||
| 213 | return apply_filters( 'getpaid_invoice_exporter_get_amount_fields', $fields, $post_type ); |
||||
| 214 | } |
||||
| 215 | |||||
| 216 | /** |
||||
| 217 | * Retrieves payment form meta fields. |
||||
| 218 | * |
||||
| 219 | * @since 2.8.23 |
||||
| 220 | * |
||||
| 221 | * @return array |
||||
| 222 | */ |
||||
| 223 | public function get_payment_form_meta( $invoice ) { |
||||
| 224 | // Payment form meta fields. |
||||
| 225 | $field_keys = getpaid_get_payment_form_custom_fields(); |
||||
| 226 | $meta = get_post_meta( $invoice->get_id(), 'additional_meta_data', true ); |
||||
| 227 | |||||
| 228 | $field_values = array(); |
||||
| 229 | if ( ! empty( $field_keys ) ) { |
||||
| 230 | foreach ( $field_keys as $field_key => $field_label ) { |
||||
| 231 | $value = ''; |
||||
| 232 | |||||
| 233 | if ( ! empty( $meta ) ) { |
||||
| 234 | foreach ( $meta as $meta_label => $meta_value ) { |
||||
| 235 | if ( getpaid_strtolower( wpinv_clean( wp_unslash( $meta_label ) ) ) == getpaid_strtolower( $field_label ) ) { |
||||
|
0 ignored issues
–
show
It seems like
wpinv_clean(wp_unslash($meta_label)) can also be of type array; however, parameter $string of getpaid_strtolower() does only seem to accept string, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 236 | $value = $meta_value; |
||||
| 237 | } |
||||
| 238 | } |
||||
| 239 | } |
||||
| 240 | |||||
| 241 | $field_values[ $field_key ] = $value; |
||||
| 242 | } |
||||
| 243 | } |
||||
| 244 | |||||
| 245 | return $field_values; |
||||
| 246 | } |
||||
| 247 | } |
||||
| 248 |
In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.