Issues (36)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/uix/ui/uix.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * UIX Core
4
 *
5
 * @package   ui
6
 * @author    David Cramer
7
 * @license   GPL-2.0+
8
 * @link
9
 * @copyright 2016 David Cramer
10
 */
11
12
namespace uix\ui;
13
14
/**
15
 * Core UIX abstract class.
16
 *
17
 * @package uix\ui
18
 * @author  David Cramer
19
 */
20
abstract class uix {
21
22
	/**
23
	 * The type of UI object
24
	 *
25
	 * @since  1.0.0
26
	 * @access public
27
	 * @var      string
28
	 */
29
	public $type = 'uix';
30
31
	/**
32
	 * Config Structure of object
33
	 *
34
	 * @since  1.0.0
35
	 * @access public
36
	 * @var      array
37
	 */
38
	public $struct = array();
39
40
	/**
41
	 * Set this object type assets
42
	 *
43
	 * @since  1.0.0
44
	 * @access public
45
	 * @var      array
46
	 */
47
	public $assets = array(
48
		'script' => array(),
49
		'style'  => array(),
50
	);
51
52
	/**
53
	 * Object slug
54
	 *
55
	 * @access public
56
	 * @since  1.0.0
57
	 * @var      string
58
	 */
59
	public $slug;
60
61
	/**
62
	 * Array of child objects
63
	 *
64
	 * @since  1.0.0
65
	 * @access public
66
	 * @var      array
67
	 */
68
	public $child = array();
69
70
	/**
71
	 * Objects parent
72
	 *
73
	 * @since  1.0.0
74
	 * @access public
75
	 * @var      object/uix
76
	 */
77
	public $parent;
78
79
	/**
80
	 * List of attributes to apply to the wrapper element
81
	 *
82
	 * @since  1.0.0
83
	 * @access public
84
	 * @var array
85
	 */
86
	public $attributes = array();
87
88
	/**
89
	 * Base URL of this class
90
	 *
91
	 * @since  1.0.0
92
	 * @access protected
93
	 * @var      string
94
	 */
95
	protected $url;
96
97
	/**
98
	 * List of core object scripts ( common scripts )
99
	 *
100
	 * @since  1.0.0
101
	 * @access protected
102
	 * @var      array
103
	 */
104
	protected $scripts = array();
105
106
	/**
107
	 * List of core object styles ( common styles )
108
	 *
109
	 * @since  1.0.0
110
	 * @access protected
111
	 * @var      array
112
	 */
113
	protected $styles = array();
114
115
	/**
116
	 * UIX constructor
117
	 *
118
	 * @since  1.0.0
119
	 * @access protected
120
	 *
121
	 * @param string $slug   Object slug.
122
	 * @param array  $object Objects structure array.
123
	 * @param uix    $parent Parent UIX Object.
124
	 */
125 18
	protected function __construct( $slug, $object, $parent = null ) {
126
127
		// set the slug.
128 18
		$this->slug = $slug;
129
		// set the object.
130 18
		$this->struct = $object;
131
		// set parent if given.
132 18
		$this->parent = $parent;
133
		// Set the root URL for this plugin.
134 18
		$this->set_url();
135
		// do setup.
136 18
		$this->setup();
137
		// Set required assets.
138 18
		$this->set_assets();
139
		// start internal actions to allow for automating post init.
140 18
		$this->actions();
141
142 18
	}
143
144
	/**
145
	 * Detects the root of the plugin folder and sets the URL
146
	 *
147
	 * @since  1.0.0
148
	 * @access public
149
	 */
150 18
	public function set_url() {
151
152 18
		$plugins_url = plugins_url();
153 18
		$this_url    = trim( substr( trailingslashit( plugin_dir_url( __FILE__ ) ), strlen( $plugins_url ) ), '/' );
154
155 18
		if ( false !== strpos( $this_url, '/' ) ) {
156 18
			$url_path = explode( '/', $this_url );
157
			// generic 3 path depth: classes/namespace/ui|data.
158 18
			array_splice( $url_path, count( $url_path ) - 3 );
159 18
			$this_url = implode( '/', $url_path );
160
		}
161
		// setup the base URL.
162 18
		$this->url = trailingslashit( $plugins_url . '/' . $this_url );
163 18
	}
164
165
	/**
166
	 * Autoload Children - Checks structure for nested structures
167
	 *
168
	 * @since  1.0.0
169
	 * @access public
170
	 */
171 17
	public function setup() {
172
173 17
		foreach ( $this->struct as $struct_key => $sub_struct ) {
174 17
			if ( is_array( $sub_struct ) && uix()->get_register_callback( $struct_key ) ) {
175 17
				$this->process_child( $struct_key );
176
			}
177
		}
178 17
	}
179
180
	/**
181
	 * Process type key child
182
	 *
183
	 * @since  1.0.0
184
	 * @access public
185
	 *
186
	 * @param string $type The type of child object.
187
	 */
188 10
	public function process_child( $type ) {
189
190 10
		if ( isset( $this->struct[ $type ]['id'] ) ) {
191 2
			$this->{$type}( $this->struct[ $type ]['id'], $this->struct[ $type ] );
192
		} else {
193 10
			$this->process_children( $type );
194
		}
195
196 10
	}
197
198
	/**
199
	 * Process all children under type key
200
	 *
201
	 * @since  1.0.0
202
	 * @access public
203
	 */
204 10
	public function process_children( $type ) {
205 10
		$this->struct[ $type ] = array_filter( $this->struct[ $type ], 'is_array' );
206 10
		foreach ( $this->struct[ $type ] as $sub_slug => $sub_structure ) {
207 10
			if ( ! empty( $sub_structure['id'] ) ) {
208 1
				$sub_slug = $sub_structure['id'];
209
			}
210
211 10
			$this->{$type}( $sub_slug, $sub_structure );
212
		}
213
214 10
	}
215
216
	/**
217
	 * Define core UIX styles - override to register core ( common styles for
218
	 * uix type )
219
	 *
220
	 * @since  1.0.0
221
	 * @access public
222
	 */
223 19
	public function set_assets() {
224 19 View Code Duplication
		if ( ! empty( $this->struct['style'] ) ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
225 1
			$this->assets['style'] = array_merge( $this->assets['style'], $this->struct['style'] );
226
		}
227 19 View Code Duplication
		if ( ! empty( $this->struct['script'] ) ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
228 1
			$this->assets['script'] = array_merge( $this->assets['script'], $this->struct['script'] );
229
		}
230 19
	}
231
232
	/**
233
	 * setup actions and hooks - override to add specific hooks. use
234
	 * parent::actions() to keep admin head
235
	 *
236
	 * @since  1.0.0
237
	 * @access protected
238
	 */
239 18
	protected function actions() {
240
241
		// init uix after loaded.
242 18
		add_action( 'init', array( $this, 'init' ) );
243
244
		// set location.
245 18
		$location = 'wp_print_styles';
246
247 18
		if ( is_admin() ) {
248 1
			$location = 'admin_enqueue_scripts';
249
		}
250
251
		// init UIX headers.
252 18
		add_action( $location, array( $this, 'enqueue_core' ) );
253
254 18
	}
255
256
	/**
257
	 * Register the UIX objects
258
	 *
259
	 * @since  1.0.0
260
	 * @access public
261
	 *
262
	 * @param string $slug   Object slug
263
	 * @param array  $object object structure array
264
	 *
265
	 * @return object|\uix object instance
266
	 */
267 15
	public static function register( $slug, $object, $parent = null ) {
268
		// get the current instance
269 15
		$caller = get_called_class();
270
271 15
		return new $caller( $slug, $object, $parent );
272
	}
273
274
	/**
275
	 * All objects loaded - application method for finishing off loading objects
276
	 *
277
	 * @since  1.0.0
278
	 * @access public
279
	 */
280
	public function init() {}
281
282
	/**
283
	 * Magic caller for adding child objects
284
	 *
285
	 * @since  1.0.0
286
	 * @access public
287
	 *
288
	 * @param string $type Type of object to attempt to create
289
	 * @param array  $args arguments for the caller
290
	 *
291
	 * @return UIX|null
292
	 */
293 10
	public function __call( $type, $args ) {
294 10
		$init  = uix()->get_register_callback( $type );
295 10
		$child = null;
296 10
		if ( null !== $init ) {
297 10
			$this->sanitize_slug( $args[0] );
298 10
			$args[] = $this;
299 10
			$child  = call_user_func_array( $init, $args );
300 10
			if ( null !== $child ) {
301 10
				$this->child[ $args[0] ] = $child;
302
			}
303
		}
304
305 10
		return $child;
306
	}
307
308
	/**
309
	 * Create a slug for the object
310
	 *
311
	 * @since  1.0.0
312
	 *
313
	 * @param string $slug The slug to be checked and created
314
	 *
315
	 * @access private
316
	 */
317 10
	private function sanitize_slug( &$slug ) {
318 10
		$slug = sanitize_key( $slug );
319 10
		if ( '' === $slug ) {
320
			$slug = count( $this->child );
321
		}
322 10
	}
323
324
	/**
325
	 * enqueue core assets
326
	 *
327
	 * @since  1.0.0
328
	 * @access public
329
	 */
330 5
	public function enqueue_core() {
331
332
		// attempt to get a config
333 5
		if ( ! $this->is_active() ) {
334 1
			return;
335
		}
336
		// register uix core asset
337 5
		$this->core_assets();
338
339
		/**
340
		 * do object initilisation
341
		 *
342
		 * @param object current uix instance
343
		 */
344 5
		do_action( 'uix_admin_enqueue_scripts_' . $this->type, $this );
345
346
		/**
347
		 * do object initilisation for specific slug
348
		 *
349
		 * @param object current uix instance
350
		 */
351 5
		do_action( 'uix_admin_enqueue_scripts_' . $this->type . '_' . $this->slug, $this );
352
353
		// push assets to ui manager
354 5
		uix()->set_assets( $this->assets );
355
		// done enqueuing - dpo inline or manual enqueue.
356 5
		$this->set_active_styles();
357 5
	}
358
359
	/**
360
	 * Determin if a UIX object should be active for this screen
361
	 * Intended to be ovveridden
362
	 *
363
	 * @since  1.0.0
364
	 * @access public
365
	 */
366 4
	public function is_active() {
367 4
		if ( ! empty( $this->parent ) ) {
368 1
			return $this->parent->is_active();
369
		}
370
371 3
		return true; // base is_active will result in true;
372
	}
373
374
	/**
375
	 * Register UIX depend js and css and call set assets
376
	 *
377
	 * @since  1.0.0
378
	 * @access protected
379
	 */
380 5
	protected function core_assets() {
381 5
		wp_register_script( 'uix', $this->url . 'assets/js/core' . UIX_ASSET_DEBUG . '.js' );
382 5
		wp_register_style( 'uix', $this->url . 'assets/css/core' . UIX_ASSET_DEBUG . '.css', array( 'dashicons' ) );
383 5
		wp_localize_script( 'uix', 'uixApi', array(
384 5
			'root'  => esc_url_raw( rest_url() ),
385 5
			'nonce' => wp_create_nonce( 'wp_rest' ),
386
		) );
387
388
		// set assets . methods at before this point can set assets, after this not so much.
389 5
		$this->set_assets();
390 5
	}
391
392
	/**
393
	 * runs after assets have been enqueued
394
	 *
395
	 * @since  1.0.0
396
	 * @access protected
397
	 */
398 2
	protected function set_active_styles() {
399 2
	}
400
401
402
	/**
403
	 * Build Attributes for the input control
404
	 *
405
	 * @since  1.0.0
406
	 * @access public
407
	 * @return string Attributes string for applying to an element
408
	 */
409 8
	public function build_attributes() {
410
		// setup attributes
411 8
		$this->set_attributes();
412
413 8
		$attributes = array();
414 8
		foreach ( $this->attributes as $att => $value ) {
415 8
			$attributes[] = sprintf( '%s="%s"', esc_html( $att ), esc_attr( $value ) );
416
		}
417
418 8
		return implode( ' ', $attributes );
419
	}
420
421
	/**
422
	 * Sets the wrappers attributes
423
	 *
424
	 * @since  1.0.0
425
	 * @access public
426
	 */
427 9
	public function set_attributes() {
428
429 9
		if ( empty( $this->attributes['id'] ) ) {
430 7
			$this->attributes['id'] = $this->id();
431
		}
432
433 9
		if ( ! empty( $this->struct['attributes'] ) ) {
434 3
			$this->attributes = array_merge( $this->attributes, $this->struct['attributes'] );
435
		}
436
437 9
	}
438
439
	/**
440
	 * uix object id
441
	 *
442
	 * @since  1.0.0
443
	 * @access public
444
	 * @return string The object ID
445
	 */
446 16
	public function id() {
447 16
		$id = $this->slug;
448 16
		if ( ! empty( $this->parent ) ) {
449 11
			$id = $this->parent->id() . '-' . $this->slug;
450
		}
451
452 16
		return $id;
453
	}
454
455
	/**
456
	 * Render the UIX object
457
	 *
458
	 * @since  1.0.0
459
	 * @access public
460
	 * @return string HTML of rendered object
461
	 */
462
	abstract public function render();
463
464
	/**
465
	 * Render the child objects
466
	 *
467
	 * @since  1.0.0
468
	 * @access public
469
	 * @return string|null
470
	 */
471 2
	public function render_children() {
472 2
		$output = null;
473 2
		foreach ( $this->child as $child ) {
474 2
			$output .= $child->render();
475
		}
476
477 2
		return $output;
478
	}
479
480
	/**
481
	 * Base color helper
482
	 *
483
	 * @since  1.0.0
484
	 * @access public
485
	 */
486 6
	protected function base_color() {
487 6
		$color = '#D84315';
488 6
		if ( empty( $this->struct['base_color'] ) ) {
489 5
			if ( ! empty( $this->parent ) ) {
490 5
				$color = $this->parent->base_color();
491
			}
492
		} else {
493 3
			$color = $this->struct['base_color'];
494
		}
495
496
		/**
497
		 * do object initilisation for specific slug
498
		 *
499
		 * @param object current uix instance
500
		 */
501 6
		return apply_filters( 'uix_base_color_' . $this->type . '_' . $this->slug, $color );
502
503
	}
504
}
505