This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /** |
||
3 | * Subscriptions Widget Class. |
||
4 | * |
||
5 | * @version 1.0.0 |
||
6 | */ |
||
7 | |||
8 | defined( 'ABSPATH' ) || exit; |
||
9 | |||
10 | /** |
||
11 | * Contains the subscriptions widget. |
||
12 | * |
||
13 | * @package INVOICING |
||
14 | */ |
||
15 | class WPInv_Subscriptions_Widget extends WP_Super_Duper { |
||
16 | |||
17 | /** |
||
18 | * Register the widget with WordPress. |
||
19 | * |
||
20 | */ |
||
21 | public function __construct() { |
||
22 | |||
23 | $options = array( |
||
24 | 'textdomain' => 'invoicing', |
||
25 | 'block-icon' => 'controls-repeat', |
||
26 | 'block-category' => 'widgets', |
||
27 | 'block-keywords' => "['invoicing','subscriptions', 'getpaid']", |
||
28 | 'class_name' => __CLASS__, |
||
29 | 'base_id' => 'wpinv_subscriptions', |
||
30 | 'name' => __( 'GetPaid > Subscriptions', 'invoicing' ), |
||
31 | 'widget_ops' => array( |
||
32 | 'classname' => 'getpaid-subscriptions bsui', |
||
33 | 'description' => esc_html__( "Displays the current user's subscriptions.", 'invoicing' ), |
||
34 | ), |
||
35 | 'arguments' => array( |
||
36 | 'title' => array( |
||
37 | 'title' => __( 'Widget title', 'invoicing' ), |
||
38 | 'desc' => __( 'Enter widget title.', 'invoicing' ), |
||
39 | 'type' => 'text', |
||
40 | 'desc_tip' => true, |
||
41 | 'default' => '', |
||
42 | 'advanced' => false, |
||
43 | ), |
||
44 | ), |
||
45 | |||
46 | ); |
||
47 | |||
48 | parent::__construct( $options ); |
||
49 | } |
||
50 | |||
51 | /** |
||
52 | * Retrieves current user's subscriptions. |
||
53 | * |
||
54 | * @return GetPaid_Subscriptions_Query |
||
55 | */ |
||
56 | public function get_subscriptions() { |
||
57 | |||
58 | // Prepare license args. |
||
59 | $args = array( |
||
60 | 'customer_in' => get_current_user_id(), |
||
61 | 'paged' => ( get_query_var( 'paged' ) ) ? absint( get_query_var( 'paged' ) ) : 1, |
||
62 | ); |
||
63 | |||
64 | return new GetPaid_Subscriptions_Query( $args ); |
||
65 | |||
66 | } |
||
67 | |||
68 | /** |
||
69 | * The Super block output function. |
||
70 | * |
||
71 | * @param array $args |
||
72 | * @param array $widget_args |
||
73 | * @param string $content |
||
74 | * |
||
75 | * @return mixed|string|bool |
||
76 | */ |
||
77 | public function output( $args = array(), $widget_args = array(), $content = '' ) { |
||
78 | |||
79 | // Ensure that the user is logged in. |
||
80 | if ( ! is_user_logged_in() ) { |
||
81 | |||
82 | return aui()->alert( |
||
83 | array( |
||
84 | 'content' => wp_kses_post( __( 'You need to log-in or create an account to view this section.', 'invoicing' ) ), |
||
85 | 'type' => 'error', |
||
86 | ) |
||
87 | ); |
||
88 | |||
89 | } |
||
90 | |||
91 | // Are we displaying a single subscription? |
||
92 | if ( isset( $_GET['subscription'] ) ) { |
||
93 | return $this->display_single_subscription( intval( $_GET['subscription'] ) ); |
||
94 | } |
||
95 | |||
96 | // Retrieve the user's subscriptions. |
||
97 | $subscriptions = $this->get_subscriptions(); |
||
98 | |||
99 | // Start the output buffer. |
||
100 | ob_start(); |
||
101 | |||
102 | // Backwards compatibility. |
||
103 | do_action( 'wpinv_before_user_subscriptions' ); |
||
104 | |||
105 | // Display errors and notices. |
||
106 | wpinv_print_errors(); |
||
107 | |||
108 | do_action( 'getpaid_license_manager_before_subscriptions', $subscriptions ); |
||
109 | |||
110 | // Print the table header. |
||
111 | $this->print_table_header(); |
||
112 | |||
113 | // Print table body. |
||
114 | $this->print_table_body( $subscriptions->get_results() ); |
||
115 | |||
116 | // Print table footer. |
||
117 | $this->print_table_footer(); |
||
118 | |||
119 | // Print the navigation. |
||
120 | $this->print_navigation( $subscriptions->get_total() ); |
||
121 | |||
122 | // Backwards compatibility. |
||
123 | do_action( 'wpinv_after_user_subscriptions' ); |
||
124 | |||
125 | // Return the output. |
||
126 | return ob_get_clean(); |
||
127 | |||
128 | } |
||
129 | |||
130 | /** |
||
131 | * Retrieves the subscription columns. |
||
132 | * |
||
133 | * @return array |
||
134 | */ |
||
135 | public function get_subscriptions_table_columns() { |
||
136 | |||
137 | $columns = array( |
||
138 | 'subscription' => __( 'Subscription', 'invoicing' ), |
||
139 | 'amount' => __( 'Amount', 'invoicing' ), |
||
140 | 'renewal-date' => __( 'Next payment', 'invoicing' ), |
||
141 | 'status' => __( 'Status', 'invoicing' ), |
||
142 | 'actions' => '', |
||
143 | ); |
||
144 | |||
145 | return apply_filters( 'getpaid_frontend_subscriptions_table_columns', $columns ); |
||
146 | } |
||
147 | |||
148 | /** |
||
149 | * Displays the table header. |
||
150 | * |
||
151 | */ |
||
152 | public function print_table_header() { |
||
153 | |||
154 | ?> |
||
155 | |||
156 | <table class="table table-bordered table-striped"> |
||
157 | |||
158 | <thead> |
||
159 | <tr> |
||
160 | <?php foreach ( $this->get_subscriptions_table_columns() as $key => $label ) : ?> |
||
161 | <th scope="col" class="font-weight-bold getpaid-subscriptions-table-<?php echo esc_attr( $key ); ?>"> |
||
162 | <?php echo esc_html( $label ); ?> |
||
163 | </th> |
||
164 | <?php endforeach; ?> |
||
165 | </tr> |
||
166 | </thead> |
||
167 | |||
168 | <?php |
||
169 | |||
170 | } |
||
171 | |||
172 | /** |
||
173 | * Displays the table body. |
||
174 | * |
||
175 | * @param WPInv_Subscription[] $subscriptions |
||
176 | */ |
||
177 | public function print_table_body( $subscriptions ) { |
||
178 | |||
179 | if ( empty( $subscriptions ) ) { |
||
180 | $this->print_table_body_no_subscriptions(); |
||
181 | } else { |
||
182 | $this->print_table_body_subscriptions( $subscriptions ); |
||
183 | } |
||
184 | |||
185 | } |
||
186 | |||
187 | /** |
||
188 | * Displays the table body if no subscriptions were found. |
||
189 | * |
||
190 | */ |
||
191 | public function print_table_body_no_subscriptions() { |
||
192 | |||
193 | ?> |
||
194 | <tbody> |
||
195 | |||
196 | <tr> |
||
197 | <td colspan="<?php echo count( $this->get_subscriptions_table_columns() ); ?>"> |
||
198 | |||
199 | <?php |
||
200 | aui()->alert( |
||
201 | array( |
||
202 | 'content' => wp_kses_post( __( 'No subscriptions found.', 'invoicing' ) ), |
||
203 | 'type' => 'warning', |
||
204 | ), |
||
205 | true |
||
206 | ); |
||
207 | ?> |
||
208 | |||
209 | </td> |
||
210 | </tr> |
||
211 | |||
212 | </tbody> |
||
213 | <?php |
||
214 | } |
||
215 | |||
216 | /** |
||
217 | * Displays the table body if subscriptions were found. |
||
218 | * |
||
219 | * @param WPInv_Subscription[] $subscriptions |
||
220 | */ |
||
221 | public function print_table_body_subscriptions( $subscriptions ) { |
||
222 | |||
223 | ?> |
||
224 | <tbody> |
||
225 | |||
226 | <?php foreach ( $subscriptions as $subscription ) : ?> |
||
227 | <tr class="getpaid-subscriptions-table-row subscription-<?php echo (int) $subscription->get_id(); ?>"> |
||
228 | <?php |
||
229 | wpinv_get_template( |
||
230 | 'subscriptions/subscriptions-table-row.php', |
||
231 | array( |
||
232 | 'subscription' => $subscription, |
||
233 | 'widget' => $this, |
||
234 | ) |
||
235 | ); |
||
236 | ?> |
||
237 | </tr> |
||
238 | <?php endforeach; ?> |
||
239 | |||
240 | </tbody> |
||
241 | <?php |
||
242 | } |
||
243 | |||
244 | /** |
||
245 | * Adds row actions to a column |
||
246 | * |
||
247 | * @param string $content column content |
||
248 | * @param WPInv_Subscription $subscription |
||
249 | * @since 1.0.0 |
||
250 | * @return string |
||
251 | */ |
||
252 | public function add_row_actions( $content, $subscription ) { |
||
253 | |||
254 | // Prepare row actions. |
||
255 | $actions = array(); |
||
256 | |||
257 | // View subscription action. |
||
258 | $view_url = getpaid_get_tab_url( 'gp-subscriptions', get_permalink( (int) wpinv_get_option( 'invoice_subscription_page' ) ) ); |
||
259 | $view_url = esc_url( add_query_arg( 'subscription', (int) $subscription->get_id(), $view_url ) ); |
||
260 | $actions['view'] = "<a href='$view_url' class='btn btn-xs btn-outline-primary text-decoration-none'><i class='fa fa-cog'></i> " . __( 'Manage', 'invoicing' ) . '</a>'; |
||
261 | |||
262 | // Filter the actions. |
||
263 | $actions = apply_filters( 'getpaid_subscriptions_table_subscription_actions', $actions, $subscription ); |
||
264 | |||
265 | $sanitized = array(); |
||
266 | foreach ( $actions as $key => $action ) { |
||
267 | $key = sanitize_html_class( $key ); |
||
268 | $action = wp_kses_post( $action ); |
||
269 | $sanitized[] = "<span class='$key'>$action</span>"; |
||
270 | } |
||
271 | |||
272 | $row_actions = "<small class='form-text getpaid-subscription-item-btn-actions'>"; |
||
273 | $row_actions .= implode( ' | ', $sanitized ); |
||
274 | $row_actions .= '</small>'; |
||
275 | |||
276 | return $content . $row_actions; |
||
277 | } |
||
278 | |||
279 | /** |
||
280 | * Displays the table footer. |
||
281 | * |
||
282 | */ |
||
283 | public function print_table_footer() { |
||
284 | |||
285 | ?> |
||
286 | |||
287 | <tfoot> |
||
288 | <tr> |
||
289 | <?php foreach ( $this->get_subscriptions_table_columns() as $key => $label ) : ?> |
||
290 | <th class="font-weight-bold getpaid-subscriptions-<?php echo esc_attr( $key ); ?>"> |
||
291 | <?php echo esc_html( $label ); ?> |
||
292 | </th> |
||
293 | <?php endforeach; ?> |
||
294 | </tr> |
||
295 | </tfoot> |
||
296 | |||
297 | </table> |
||
298 | <?php |
||
299 | |||
300 | } |
||
301 | |||
302 | /** |
||
303 | * Displays the navigation. |
||
304 | * |
||
305 | * @param int $total |
||
306 | */ |
||
307 | public function print_navigation( $total ) { |
||
308 | |||
309 | if ( $total < 1 ) { |
||
310 | |||
311 | // Out-of-bounds, run the query again without LIMIT for total count. |
||
312 | $args = array( |
||
313 | 'customer_in' => get_current_user_id(), |
||
314 | 'fields' => 'id', |
||
315 | ); |
||
316 | |||
317 | $count_query = new GetPaid_Subscriptions_Query( $args ); |
||
318 | $total = $count_query->get_total(); |
||
319 | } |
||
320 | |||
321 | // Abort if we do not have pages. |
||
322 | if ( 2 > $total ) { |
||
323 | return; |
||
324 | } |
||
325 | |||
326 | ?> |
||
327 | |||
328 | <div class="getpaid-subscriptions-pagination"> |
||
329 | <?php |
||
330 | $big = 999999; |
||
331 | |||
332 | echo wp_kses_post( |
||
333 | getpaid_paginate_links( |
||
334 | array( |
||
335 | 'base' => str_replace( $big, '%#%', esc_url( get_pagenum_link( $big ) ) ), |
||
336 | 'format' => '?paged=%#%', |
||
337 | 'total' => (int) ceil( $total / 10 ), |
||
338 | ) |
||
339 | ) |
||
340 | ); |
||
341 | ?> |
||
342 | </div> |
||
343 | |||
344 | <?php |
||
345 | } |
||
346 | |||
347 | /** |
||
348 | * Returns a single subscription's columns. |
||
349 | * |
||
350 | * @param WPInv_Subscription $subscription |
||
351 | * |
||
352 | * @return array |
||
353 | */ |
||
354 | public function get_single_subscription_columns( $subscription ) { |
||
355 | |||
356 | // Prepare subscription detail columns. |
||
357 | $subscription_group = getpaid_get_invoice_subscription_group( $subscription->get_parent_invoice_id(), $subscription->get_id() ); |
||
358 | $items_count = empty( $subscription_group ) ? 1 : count( $subscription_group['items'] ); |
||
359 | $fields = apply_filters( |
||
360 | 'getpaid_single_subscription_details_fields', |
||
361 | array( |
||
362 | 'status' => __( 'Status', 'invoicing' ), |
||
363 | 'initial_amount' => __( 'Initial amount', 'invoicing' ), |
||
364 | 'recurring_amount' => __( 'Recurring amount', 'invoicing' ), |
||
365 | 'start_date' => __( 'Start date', 'invoicing' ), |
||
366 | 'expiry_date' => __( 'Next payment', 'invoicing' ), |
||
367 | 'payments' => __( 'Payments', 'invoicing' ), |
||
368 | 'item' => $items_count > 1 ? __( 'Items', $items_count, 'invoicing' ) : __( 'Item', 'invoicing' ) |
||
0 ignored issues
–
show
|
|||
369 | ), |
||
370 | $subscription, |
||
371 | $items_count |
||
372 | ); |
||
373 | |||
374 | if ( isset( $fields['expiry_date'] ) ) { |
||
375 | |||
376 | if ( ! $subscription->is_active() || $subscription->is_last_renewal() ) { |
||
377 | $fields['expiry_date'] = __( 'End date', 'invoicing' ); |
||
378 | } |
||
379 | |||
380 | if ( 'pending' === $subscription->get_status() ) { |
||
381 | unset( $fields['expiry_date'] ); |
||
382 | } |
||
383 | } |
||
384 | |||
385 | if ( isset( $fields['start_date'] ) && 'pending' === $subscription->get_status() ) { |
||
386 | unset( $fields['start_date'] ); |
||
387 | } |
||
388 | |||
389 | if ( $subscription->get_initial_amount() === $subscription->get_recurring_amount() ) { |
||
390 | unset( $fields['initial_amount'] ); |
||
391 | } |
||
392 | |||
393 | return $fields; |
||
394 | } |
||
395 | |||
396 | /** |
||
397 | * Displays a single subscription. |
||
398 | * |
||
399 | * @param string $subscription |
||
400 | * |
||
401 | * @return string |
||
402 | */ |
||
403 | public function display_single_subscription( $subscription ) { |
||
404 | |||
405 | // Fetch the subscription. |
||
406 | $subscription = new WPInv_Subscription( (int) $subscription ); |
||
407 | |||
408 | if ( ! $subscription->exists() ) { |
||
409 | |||
410 | return aui()->alert( |
||
411 | array( |
||
412 | 'content' => wp_kses_post( __( 'Subscription not found.', 'invoicing' ) ), |
||
413 | 'type' => 'error', |
||
414 | ) |
||
415 | ); |
||
416 | |||
417 | } |
||
418 | |||
419 | // Ensure that the user owns this subscription key. |
||
420 | if ( get_current_user_id() != $subscription->get_customer_id() && ! wpinv_current_user_can_manage_invoicing() ) { |
||
421 | |||
422 | return aui()->alert( |
||
423 | array( |
||
424 | 'content' => wp_kses_post( __( 'You do not have permission to view this subscription. Ensure that you are logged in to the account that owns the subscription.', 'invoicing' ) ), |
||
425 | 'type' => 'error', |
||
426 | ) |
||
427 | ); |
||
428 | |||
429 | } |
||
430 | |||
431 | return wpinv_get_template_html( |
||
432 | 'subscriptions/subscription-details.php', |
||
433 | array( |
||
434 | 'subscription' => $subscription, |
||
435 | 'widget' => $this, |
||
436 | ) |
||
437 | ); |
||
438 | |||
439 | } |
||
440 | |||
441 | } |
||
442 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.