Issues (22)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/class-wp2d-contextual-help.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Plugin Contextual Help.
4
 *
5
 * @package WP_To_Diaspora\Help
6
 * @since   1.4.0
7
 */
8
9
// Exit if accessed directly.
10
defined( 'ABSPATH' ) || exit;
11
12
/**
13
 * Class that handles the contextual help.
14
 */
15
class WP2D_Contextual_Help {
16
17
	/**
18
	 * Only instance of this class.
19
	 *
20
	 * @var WP2D_Contextual_Help
21
	 */
22
	private static $instance;
23
24
	/**
25
	 * Create / Get the instance of this class.
26
	 *
27
	 * @return WP2D_Contextual_Help Instance of this class.
28
	 */
29
	public static function instance() {
30 View Code Duplication
		if ( null === self::$instance ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
31
			self::$instance = new self();
32
			self::$instance->constants();
33
			self::$instance->setup();
34
		}
35
36
		return self::$instance;
37
	}
38
39
	/**
40
	 * Define all the required constants.
41
	 *
42
	 * @since 1.5.0
43
	 */
44
	private function constants() {
45
		define( 'WP2D_EXT_WPORG', esc_url( 'https://wordpress.org/plugins/wp-to-diaspora' ) );
46
		define( 'WP2D_EXT_I18N', esc_url( 'https://poeditor.com/join/project?hash=c085b3654a5e04c69ec942e0f136716a' ) );
47
		define( 'WP2D_EXT_GH', esc_url( 'https://github.com/DiasPHPora/wp-to-diaspora' ) );
48
		define( 'WP2D_EXT_DONATE', esc_url( 'https://github.com/DiasPHPora/wp-to-diaspora#donate' ) );
49
		define( 'WP2D_EXT_GH_ISSUES', esc_url( 'https://github.com/DiasPHPora/wp-to-diaspora/issues' ) );
50
		define( 'WP2D_EXT_GH_ISSUES_NEW', esc_url( 'https://github.com/DiasPHPora/wp-to-diaspora/issues/new' ) );
51
	}
52
53
	/**
54
	 * Set up the contextual help menu.
55
	 */
56
	private function setup() {
57
		// Do we display the help tabs?
58
		$post_type          = get_current_screen()->post_type;
59
		$enabled_post_types = WP2D_Options::instance()->get_option( 'enabled_post_types' );
60
		if ( '' !== $post_type && ! in_array( $post_type, $enabled_post_types, true ) ) {
61
			return;
62
		}
63
64
		// If we don't have a post type, we're on the main settings page.
65
		if ( '' === $post_type ) {
66
			// Set the sidebar in the contextual help.
67
			$this->set_sidebar();
68
69
			// Add the main settings tabs and their content.
70
			$this->add_settings_help_tabs();
71
		} else {
72
			// Add the post type specific tabs and their content.
73
			$this->add_post_type_help_tabs();
74
		}
75
	}
76
77
	/** Singleton, keep private. */
78
	final private function __clone() {
79
	}
80
81
	/** Singleton, keep private. */
82
	final private function __construct() {
83
	}
84
85
	/**
86
	 * Set the sidebar in the contextual help.
87
	 */
88
	private function set_sidebar() {
89
		get_current_screen()->set_help_sidebar(
90
			'<p><strong>' . esc_html__( 'WP to diaspora*', 'wp-to-diaspora' ) . '</strong></p>
91
			<ul>
92
				<li><a href="' . WP2D_EXT_GH . '" target="_blank">GitHub</a>
93
				<li><a href="' . WP2D_EXT_WPORG . '" target="_blank">WordPress.org</a>
94
				<li><a href="' . WP2D_EXT_I18N . '" target="_blank">' . esc_html__( 'Help with translations', 'wp-to-diaspora' ) . '</a>
95
				<li><a href="' . WP2D_EXT_DONATE . '" target="_blank">' . esc_html__( 'Make a donation', 'wp-to-diaspora' ) . '</a>
96
			</ul>'
97
		);
98
	}
99
100
	/**
101
	 * Add help tabs to the contextual help on the settings page.
102
	 */
103
	private function add_settings_help_tabs() {
104
		$screen = get_current_screen();
105
106
		// A short overview of the plugin.
107
		$screen->add_help_tab( [
108
			'id'      => 'overview',
109
			'title'   => esc_html__( 'Overview', 'wp-to-diaspora' ),
110
			'content' => '<p><strong>' . esc_html__( 'With WP to diaspora*, sharing your WordPress posts to diaspora* is as easy as ever.', 'wp-to-diaspora' ) . '</strong></p>
111
				<ol>
112
					<li>' . esc_html__( 'Enter your diaspora* login details on the "Setup" tab.', 'wp-to-diaspora' ) . '
113
					<li>' . esc_html__( 'Define the default posting behaviour on the "Defaults" tab.', 'wp-to-diaspora' ) . '
114
					<li>' . esc_html__( 'Automatically share your WordPress post on diaspora* when publishing it on your website.', 'wp-to-diaspora' ) . '
115
					<li>' . esc_html__( 'Check out your new post on diaspora*.', 'wp-to-diaspora' ) . '
116
				</ol>',
117
		] );
118
119
		// How to set up the connection to diaspora*.
120
		$screen->add_help_tab( [
121
			'id'      => 'setup',
122
			'title'   => esc_html__( 'Setup', 'wp-to-diaspora' ),
123
			'content' => '<p><strong>' . esc_html__( 'Enter your diaspora* login details to connect your account.', 'wp-to-diaspora' ) . '</strong></p>
124
				<ul>
125
					<li><strong>' . esc_html__( 'diaspora* Pod', 'wp-to-diaspora' ) . '</strong>: ' .
126
						esc_html__( 'This is the domain name of the pod you are on (e.g. joindiaspora.com)', 'wp-to-diaspora' ) . '
127
					<li><strong>' . esc_html__( 'Username', 'wp-to-diaspora' ) . '</strong>: ' .
128
						esc_html__( 'Your diaspora* username (without the pod domain).', 'wp-to-diaspora' ) . '
129
					<li><strong>' . esc_html__( 'Password', 'wp-to-diaspora' ) . '</strong>: ' .
130
						esc_html__( 'Your diaspora* password.', 'wp-to-diaspora' ) . '
131
				</ul>',
132
		] );
133
134
		// Explain the default options and what they do.
135
		$screen->add_help_tab( [
136
			'id'      => 'defaults',
137
			'title'   => esc_html__( 'Defaults', 'wp-to-diaspora' ),
138
			'content' => '<p><strong>' . esc_html__( 'Define the default posting behaviour.', 'wp-to-diaspora' ) . '</strong></p>
139
				<ul>
140
					<li><strong>' . esc_html__( 'Post types', 'wp-to-diaspora' ) . '</strong>: ' .
141
						esc_html__( 'Choose the post types that are allowed to be shared to diaspora*.', 'wp-to-diaspora' ) . '
142
					<li><strong>' . esc_html__( 'Post to diaspora*', 'wp-to-diaspora' ) . '</strong>: ' .
143
						esc_html__( 'Automatically share new posts to diaspora* when publishing them.', 'wp-to-diaspora' ) . '
144
					<li><strong>' . esc_html__( 'Show "Posted at" link?', 'wp-to-diaspora' ) . '</strong>: ' .
145
						esc_html__( 'Add a link back to your original post, at the bottom of the diaspora* post.', 'wp-to-diaspora' ) . '
146
					<li><strong>' . esc_html__( 'Display', 'wp-to-diaspora' ) . '</strong>: ' .
147
						esc_html__( 'Choose whether you would like to post the whole post or just the excerpt.', 'wp-to-diaspora' ) . '
148
					<li><strong>' . esc_html__( 'Tags to post', 'wp-to-diaspora' ) . '</strong>: ' .
149
						esc_html__( 'You can add tags to your post to make it easier to find on diaspora*.', 'wp-to-diaspora' ) . '<br>
150
						<ul>
151
							<li><strong>' . esc_html__( 'Global tags', 'wp-to-diaspora' ) . '</strong>: ' . esc_html__( 'Tags that apply to all posts.', 'wp-to-diaspora' ) . '
152
							<li><strong>' . esc_html__( 'Custom tags', 'wp-to-diaspora' ) . '</strong>: ' . esc_html__( 'Tags that apply to individual posts (can be set on each post).', 'wp-to-diaspora' ) . '
153
							<li><strong>' . esc_html__( 'Post tags', 'wp-to-diaspora' ) . '</strong>: ' . esc_html__( 'Default WordPress Tags of individual posts.', 'wp-to-diaspora' ) . '
154
						</ul>
155
					<li><strong>' . esc_html__( 'Global tags', 'wp-to-diaspora' ) . '</strong>: ' .
156
						esc_html__( 'A list of tags that gets added to every post.', 'wp-to-diaspora' ) . '
157
					<li><strong>' . esc_html__( 'Aspects', 'wp-to-diaspora' ) . '</strong>: ' .
158
						esc_html__( 'Decide which of your diaspora* aspects can see your posts.', 'wp-to-diaspora' ) . '<br>
159
						<em>' . sprintf( esc_html__( 'Use the "%s" button to load your aspects from diaspora*.', 'wp-to-diaspora' ), esc_html__( 'Refresh Aspects', 'wp-to-diaspora' ) ) . '</em>
160
					<li><strong>' . esc_html__( 'Services', 'wp-to-diaspora' ) . '</strong>: ' .
161
						esc_html__( 'Choose the services your new diaspora* post gets shared to.', 'wp-to-diaspora' ) . '<br>
162
						<em>' . sprintf( esc_html__( 'Use the "%s" button to fetch the list of your connected services from diaspora*.', 'wp-to-diaspora' ), esc_html__( 'Refresh Services', 'wp-to-diaspora' ) ) . '</em>
163
				</ul>',
164
		] );
165
166
		$screen->add_help_tab( [
167
			'id'      => 'ssl',
168
			'title'   => esc_html__( 'SSL', 'wp-to-diaspora' ),
169
			'content' => '<p><strong>' . esc_html__( 'WP to diaspora* makes sure the connection to your pod is secure!', 'wp-to-diaspora' ) . '</strong></p>
170
				<p>' . esc_html__( 'Most diaspora* pods are secured using SSL (Secure Sockets Layer), which makes your connection encrypted. For this connection to work, your server needs to know that those SSL certificates can be trusted.', 'wp-to-diaspora' ) . '</p>
171
				<p>' . esc_html__( 'Therefore, if your WordPress installation or server does not have an up to date CA certificate bundle, WP to diaspora* may not work for you.', 'wp-to-diaspora' ) . '</p>
172
				<p>' . esc_html__( 'Lucky for you though, we have you covered if this is the case for you!', 'wp-to-diaspora' ) . '</p>
173
				<p><a href="https://github.com/DiasPHPora/wp-to-diaspora/wiki/SSL-and-TLS-Issues">' . esc_html__( 'Learn more in the wiki', 'wp-to-diaspora' ) . '</a></p>',
174
		] );
175
176
		// Explain the meta box and the differences to the global defaults.
177
		$screen->add_help_tab( [
178
			'id'      => 'meta-box',
179
			'title'   => esc_html__( 'Meta Box', 'wp-to-diaspora' ),
180
			'content' => '<p><strong>' . esc_html__( 'The Meta Box is the new "WP to diaspora*" box you see when editing a post.', 'wp-to-diaspora' ) . '</strong></p>
181
				<p>' . esc_html__( 'When creating or editing a post, you will notice a new meta box called "WP to diaspora*" which has some options. These options are almost the same as the options you can find in the "Defaults" tab on the settings page. These options are post-specific though, meaning they override the global defaults for the post itself. You will see that the default values are filled in automatically, allowing you to change individual ones as you please.', 'wp-to-diaspora' ) . '</p>
182
				<p>' . esc_html__( 'There are a few important differences to the settings page:', 'wp-to-diaspora' ) . '</p>
183
				<ul>
184
					<li><strong>' . esc_html__( 'Already posted to diaspora*', 'wp-to-diaspora' ) . '</strong>: ' .
185
						esc_html__( 'If the post has already been posted to diaspora* a link to the diaspora* post will appear at the top.', 'wp-to-diaspora' ) . '
186
					<li><strong>' . esc_html__( 'Custom tags', 'wp-to-diaspora' ) . '</strong>: ' .
187
						esc_html__( 'A list of tags that gets added to this post. Note that they are seperate from the WordPress post tags!', 'wp-to-diaspora' ) . '
188
				</ul>
189
				<p class="dashicons-before dashicons-info">' . esc_html__( 'If you don\'t see the meta box, make sure the post type you\'re on has been added to the "Post types" list on the settings page. Also make sure it has been selected from the "Screen Options" at the top of the screen.', 'wp-to-diaspora' ) . '</p>',
190
		] );
191
192
		// Troubleshooting.
193
		$screen->add_help_tab( [
194
			'id'      => 'troubleshooting',
195
			'title'   => esc_html__( 'Troubleshooting', 'wp-to-diaspora' ),
196
			'content' => '<p><strong>' . esc_html__( 'Troubleshooting common errors.', 'wp-to-diaspora' ) . '</strong></p>
197
				<p>' . esc_html__( 'Here are a few common errors and their possible solutions:', 'wp-to-diaspora' ) . '</p>
198
				<ul>
199
					<li><strong>' . esc_html( sprintf( __( 'Failed to initialise connection to pod "%s"', 'wp-to-diaspora' ), 'xyz' ) ) . '</strong>: ' .
200
						esc_html__( 'This could have multiple reasons.', 'wp-to-diaspora' ) . '
201
						<ul>
202
							<li>' . esc_html__( 'Make sure that your pod domain is entered correctly.', 'wp-to-diaspora' ) . '
203
							<li>' . esc_html__( 'It might be an SSL problem.', 'wp-to-diaspora' ) . sprintf( ' <a href="https://github.com/DiasPHPora/wp-to-diaspora/wiki/SSL-and-TLS-Issues" class="open-help-tab" data-help-tab="ssl">%s</a>', esc_html__( 'Learn more', 'wp-to-diaspora' ) ) . '
204
							<li>' . esc_html__( 'The pod might be offline at the moment.', 'wp-to-diaspora' ) . '
205
						</ul>
206
					<li><strong>' . esc_html__( 'Login failed. Check your login details.', 'wp-to-diaspora' ) . '</strong>: ' .
207
						esc_html__( 'Make sure that your username and password are entered correctly.', 'wp-to-diaspora' ) . '
208
					<li><strong>' . esc_html__( 'Invalid credentials. Please re-save your login info.', 'wp-to-diaspora' ) . '</strong>: ' .
209
						esc_html__( 'This may be due to defining WP2D_ENC_KEY after upgrading to 2.2.0, which saves a new encrypted version of your password.', 'wp-to-diaspora' ) .
210
						sprintf( ' <a href="https://github.com/DiasPHPora/wp-to-diaspora/wiki/Configuration#wp2d_enc_key-since-220" target="_blank">%s</a>', esc_html__( 'Learn more', 'wp-to-diaspora' ) ) . '
211
				</ul>',
212
		] );
213
214
		// Show different ways to contribute to the plugin.
215
		$screen->add_help_tab( [
216
			'id'      => 'contributing',
217
			'title'   => esc_html__( 'Contributing', 'wp-to-diaspora' ),
218
			'content' => '<p><strong>' . esc_html__( 'So you feel like contributing to the WP to diaspora* plugin? Great!', 'wp-to-diaspora' ) . '</strong></p>
219
				<p>' . esc_html__( 'There are many different ways that you can help out with this plugin:', 'wp-to-diaspora' ) . '</p>
220
				<ul>
221
					<li><a href="' . WP2D_EXT_GH_ISSUES_NEW . '" target="_blank">' . esc_html__( 'Report a bug', 'wp-to-diaspora' ) . '</a>
222
					<li><a href="' . WP2D_EXT_GH_ISSUES_NEW . '" target="_blank">' . esc_html__( 'Suggest a new feature', 'wp-to-diaspora' ) . '</a>
223
					<li><a href="' . WP2D_EXT_I18N . '" target="_blank">' . esc_html__( 'Help with translations', 'wp-to-diaspora' ) . '</a>
224
					<li><a href="' . WP2D_EXT_DONATE . '" target="_blank">' . esc_html__( 'Make a donation', 'wp-to-diaspora' ) . '</a>
225
				</ul>',
226
		] );
227
	}
228
229
	/**
230
	 * Add help tabs to the contextual help on the post pages.
231
	 */
232
	private function add_post_type_help_tabs() {
233
		get_current_screen()->add_help_tab( [
234
			'id'      => 'wp-to-diaspora',
235
			'title'   => esc_html__( 'WP to diaspora*', 'wp-to-diaspora' ),
236
			'content' => sprintf(
237
				'<p>' . esc_html_x(
238
					'For detailed information, refer to the contextual help on the %1$sWP to diaspora*%2$s settings page.',
239
					'Placeholders represent the link.',
240
					'wp-to-diaspora'
241
				) . '</p>',
242
				'<a href="' . esc_url( admin_url( 'options-general.php?page=wp_to_diaspora' ) ) . '" target="_blank">',
243
				'</a>'
244
			),
245
		] );
246
	}
247
248
	/**
249
	 * Get a link that directly opens a help tab via JS.
250
	 *
251
	 * @since 1.6.0
252
	 *
253
	 * @param WP_Error|string $error The WP_Error object with the tab id as data or the tab id itself.
254
	 *
255
	 * @return string HTML link.
256
	 */
257
	public static function get_help_tab_quick_link( $error ) {
258
		$help_tab = '';
259
		if ( is_wp_error( $error ) && ( $error_data = $error->get_error_data() ) && array_key_exists( 'help_tab', $error_data ) ) {
260
			$help_tab = $error_data['help_tab'];
261
		} elseif ( is_string( $error ) ) {
262
			$help_tab = $error;
263
		}
264
		if ( '' !== $help_tab ) {
265
			return sprintf(
266
				'<a href="#" class="open-help-tab" data-help-tab="%1$s">%2$s</a>',
267
				$help_tab,
268
				esc_html__( 'Help', 'wp-to-diaspora' )
269
			);
270
		}
271
272
		return '';
273
	}
274
}
275