ThemeAvenue /
BetterOptin
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * BetterOptin Popup Class |
||
| 4 | * |
||
| 5 | * @package BetterOptin/Popup Class |
||
| 6 | * @author ThemeAvenue <[email protected]> |
||
| 7 | * @license GPL-2.0+ |
||
| 8 | * @link http://themeavenue.net |
||
| 9 | * @copyright 2015 ThemeAvenue |
||
| 10 | */ |
||
| 11 | |||
| 12 | // If this file is called directly, abort. |
||
| 13 | if ( ! defined( 'WPINC' ) ) { |
||
| 14 | die; |
||
| 15 | } |
||
| 16 | |||
| 17 | class WPBO_Popup { |
||
| 18 | |||
| 19 | /** |
||
| 20 | * ID of the popup to work with |
||
| 21 | * |
||
| 22 | * @var int |
||
| 23 | * @since 2.0 |
||
| 24 | */ |
||
| 25 | private $popup_id; |
||
| 26 | |||
| 27 | private $settings; |
||
| 28 | |||
| 29 | public function __construct( $popup_id = 0 ) { |
||
| 30 | |||
| 31 | if ( self::popup_exists( $popup_id ) ) { |
||
| 32 | $this->popup_id = (int) $popup_id; |
||
| 33 | $this->get_settings(); |
||
| 34 | } |
||
| 35 | |||
| 36 | } |
||
| 37 | |||
| 38 | /** |
||
| 39 | * Check if a popup exists |
||
| 40 | * |
||
| 41 | * @since 2.0 |
||
| 42 | * |
||
| 43 | * @param $popup_id |
||
| 44 | * |
||
| 45 | * @return bool |
||
| 46 | */ |
||
| 47 | public static function popup_exists( $popup_id ) { |
||
| 48 | |||
| 49 | $post_type = get_post_type( $popup_id ); |
||
| 50 | |||
| 51 | return 'wpbo-popup' === $post_type ? true : false; |
||
| 52 | |||
| 53 | } |
||
| 54 | |||
| 55 | /** |
||
| 56 | * Check if the popup is currently active |
||
| 57 | * |
||
| 58 | * @since 2.0 |
||
| 59 | * @return bool |
||
| 60 | */ |
||
| 61 | protected function is_popup_active() { |
||
| 62 | |||
| 63 | } |
||
| 64 | |||
| 65 | /** |
||
| 66 | * Get the popup settings |
||
| 67 | * |
||
| 68 | * @since 2.0 |
||
| 69 | * @return void |
||
| 70 | */ |
||
| 71 | private function get_settings() { |
||
| 72 | |||
| 73 | $this->settings = get_post_meta( $this->popup_id, '_wpbo_settings', true ); |
||
| 74 | |||
| 75 | if ( ! is_array( $this->settings ) ) { |
||
| 76 | $this->settings = (array) $this->settings; |
||
| 77 | } |
||
| 78 | |||
| 79 | } |
||
| 80 | |||
| 81 | /** |
||
| 82 | * Get popup option |
||
| 83 | * |
||
| 84 | * @since 2.0 |
||
| 85 | * |
||
| 86 | * @param string $option Popup option to get the value for |
||
| 87 | * @param mixed $default Default option to return if the value doesn't exist |
||
| 88 | * |
||
| 89 | * @return mixed |
||
| 90 | */ |
||
| 91 | public function option( $option, $default = '' ) { |
||
| 92 | return array_key_exists( $option, $this->settings ) ? $this->settings[ $option ] : $default; |
||
| 93 | } |
||
| 94 | |||
| 95 | /** |
||
| 96 | * Get the popup template |
||
| 97 | * |
||
| 98 | * @since 2.0 |
||
| 99 | * @return string |
||
| 100 | */ |
||
| 101 | public function get_template() { |
||
| 102 | |||
| 103 | $template = get_post_meta( $this->popup_id, 'wpbo_template', true ); |
||
| 104 | |||
| 105 | if ( empty( $template ) ) { |
||
| 106 | return ''; |
||
| 107 | } |
||
| 108 | |||
| 109 | $file = $template . '.php'; |
||
| 110 | $filepath = WPBO_PATH . 'templates/' . $file; |
||
| 111 | $output = ''; |
||
| 112 | |||
| 113 | if ( file_exists( $filepath ) ) { |
||
| 114 | |||
| 115 | /* Turn on buffering */ |
||
| 116 | ob_start(); |
||
| 117 | |||
| 118 | require( $filepath ); |
||
| 119 | |||
| 120 | /* Get the buffered content into a var */ |
||
| 121 | $output = ob_get_contents(); |
||
| 122 | |||
| 123 | /* Clean buffer */ |
||
| 124 | ob_end_clean(); |
||
| 125 | |||
| 126 | } |
||
| 127 | |||
| 128 | return $output; |
||
| 129 | |||
| 130 | } |
||
| 131 | |||
| 132 | /** |
||
| 133 | * Get a popup markup. |
||
| 134 | * |
||
| 135 | * Retrieve the markup for a specific popup. Check if the popup |
||
| 136 | * was customized first, otherwise just load the default HTML file. |
||
| 137 | * |
||
| 138 | * @since 1.0.0 |
||
| 139 | * @return string HTML markup of the popup to display |
||
| 140 | */ |
||
| 141 | public function get_markup() { |
||
| 142 | |||
| 143 | /* Check if the template was customized */ |
||
| 144 | if ( '' != ( $customized = get_post_meta( $this->popup_id, '_wpbo_template_display', true ) ) ) { |
||
| 145 | |||
| 146 | if ( is_admin() ) { |
||
| 147 | $output = html_entity_decode( get_post_meta( $this->popup_id, '_wpbo_template_editor', true ), ENT_COMPAT | ENT_HTML401, 'UTF-8' ); |
||
| 148 | } else { |
||
| 149 | $output = html_entity_decode( $customized, ENT_COMPAT | ENT_HTML401, 'UTF-8' ); |
||
| 150 | } |
||
| 151 | } else { |
||
| 152 | $output = $this->get_template(); |
||
| 153 | } |
||
| 154 | |||
| 155 | if ( ! is_admin() ) { |
||
| 156 | |||
| 157 | global $post; |
||
| 158 | |||
| 159 | /** |
||
| 160 | * Get the return URL and filter it |
||
| 161 | * |
||
| 162 | * @since 1.0.0 |
||
| 163 | */ |
||
| 164 | $return_url = apply_filters( 'wpbo_return_url', $this->get_return_url(), $this->popup_id, $post->ID ); |
||
| 165 | |||
| 166 | /* Add the form */ |
||
| 167 | $output = sprintf( "<form role='form' class='optform' id='%s' action='%s' method='post'>\r\n", 'wpbo-popup-' . $this->popup_id, get_permalink( $post->ID ) ) . $output . "\r\n"; |
||
| 168 | |||
| 169 | /* Add all hidden fields */ |
||
| 170 | $output .= "\t" . wp_nonce_field( 'subscribe', 'wpbo_nonce', false, false ) . "\r\n"; |
||
| 171 | $output .= sprintf( "\t<input type='hidden' name='wpbo_id' id='wpbo_id' value='%s'>\r\n", $this->popup_id ); |
||
| 172 | $output .= sprintf( "\t<input type='hidden' name='post_id' id='post_id' value='%s'>\r\n", $post->ID ); |
||
| 173 | $output .= sprintf( "\t<input type='hidden' name='return_url' id='return_url' value='%s'>\r\n", $return_url ); |
||
| 174 | |||
| 175 | /** |
||
| 176 | * Fires right before the form is closed |
||
| 177 | * |
||
| 178 | * @since 1.0.0 |
||
| 179 | * @var int $popup_id ID of the popup to be triggered |
||
| 180 | * @var int $post_id ID of the post being viewed |
||
| 181 | */ |
||
| 182 | do_action( 'wpbo_popup_markup_after', $this->popup_id, $post->ID ); |
||
| 183 | |||
| 184 | /* Close the form */ |
||
| 185 | $output .= '</form>'; |
||
| 186 | |||
| 187 | } |
||
| 188 | |||
| 189 | return $output; |
||
| 190 | |||
| 191 | } |
||
| 192 | |||
| 193 | /** |
||
| 194 | * Get popup return URL |
||
| 195 | * |
||
| 196 | * @since 2.0 |
||
| 197 | * @return string |
||
| 198 | */ |
||
| 199 | public function get_return_url() { |
||
| 200 | |||
| 201 | $returl = $this->option( 'return_url', '' ); |
||
| 202 | |||
| 203 | if ( empty( $returl ) ) { |
||
| 204 | $returl = wpbo_get_option( 'return_url', home_url() ); |
||
| 205 | } |
||
| 206 | |||
| 207 | if ( is_numeric( $returl ) ) { |
||
| 208 | |||
| 209 | $post = get_post( (int) $returl ); |
||
| 210 | |||
| 211 | if ( ! is_null( $post ) ) { |
||
| 212 | $returl = get_permalink( $post->ID ); |
||
| 213 | } |
||
| 214 | |||
| 215 | } |
||
| 216 | |||
| 217 | return esc_url( $returl ); |
||
| 218 | |||
| 219 | } |
||
| 220 | |||
| 221 | /** |
||
| 222 | * Get the rendered popup HTML markup |
||
| 223 | * |
||
| 224 | * @since 1.0.0 |
||
| 225 | * @return string |
||
| 226 | */ |
||
| 227 | private function get_popup() { |
||
| 228 | |||
| 229 | $output = false; |
||
|
0 ignored issues
–
show
|
|||
| 230 | |||
| 231 | if ( false === $this->popup_id ) { |
||
| 232 | return ''; |
||
| 233 | } |
||
| 234 | |||
| 235 | /** |
||
| 236 | * wpbo_popup_output hook |
||
| 237 | * |
||
| 238 | * @since 1.0.0 |
||
| 239 | */ |
||
| 240 | $output = apply_filters( 'wpbo_popup_output', $this->get_markup(), $this->popup_id ); |
||
| 241 | |||
| 242 | if ( false === $output ) { |
||
| 243 | $output = "<!-- No template selected for popup #$this->popup_id -->"; |
||
| 244 | } |
||
| 245 | |||
| 246 | /** |
||
| 247 | * wpbo_before_popup_form hook |
||
| 248 | * |
||
| 249 | * @since 1.0.0 |
||
| 250 | */ |
||
| 251 | do_action( 'wpbo_before_popup_form', $this->popup_id ); |
||
| 252 | |||
| 253 | /* Echo the popup */ |
||
| 254 | $output = '<div class="wpbo wpbo-popup-' . $this->popup_id . '">' . $output . '</div>'; |
||
| 255 | |||
| 256 | /** |
||
| 257 | * wpbo_after_popup_form hook |
||
| 258 | * |
||
| 259 | * @since 1.0.0 |
||
| 260 | */ |
||
| 261 | do_action( 'wpbo_after_popup_form', $this->popup_id ); |
||
| 262 | |||
| 263 | return $output; |
||
| 264 | |||
| 265 | } |
||
| 266 | |||
| 267 | public function popup() { |
||
| 268 | echo $this->get_popup(); |
||
| 269 | } |
||
| 270 | |||
| 271 | /** |
||
| 272 | * Get the number of impressions for this popup |
||
| 273 | * |
||
| 274 | * @since 2.0 |
||
| 275 | * @return int |
||
| 276 | */ |
||
| 277 | public function get_impressions() { |
||
| 278 | return (int) get_post_meta( $this->popup_id, 'wpbo_impressions', true ); |
||
| 279 | } |
||
| 280 | |||
| 281 | /** |
||
| 282 | * Record popup impression. |
||
| 283 | * |
||
| 284 | * @since 1.0.0 |
||
| 285 | * @return int|WP_Error |
||
| 286 | */ |
||
| 287 | View Code Duplication | public function new_impression() { |
|
| 288 | |||
| 289 | /* Log the impression */ |
||
| 290 | $log = wpbo_db_insert_data( array( |
||
| 291 | 'popup_id' => $this->popup_id, |
||
| 292 | 'data_type' => 'impression', |
||
| 293 | 'ip_address' => wpbo_get_ip_address(), |
||
| 294 | 'referer' => esc_url( $_SERVER['HTTP_REFERER'] ), |
||
| 295 | 'user_agent' => $_SERVER['HTTP_USER_AGENT'] |
||
| 296 | ), true ); |
||
| 297 | |||
| 298 | return $log; |
||
| 299 | |||
| 300 | } |
||
| 301 | |||
| 302 | /** |
||
| 303 | * Log a new popup conversion |
||
| 304 | * |
||
| 305 | * @since 2.0 |
||
| 306 | * @return int|WP_Error |
||
| 307 | */ |
||
| 308 | View Code Duplication | public function new_conversion() { |
|
| 309 | |||
| 310 | $log = wpbo_db_insert_data( array( |
||
| 311 | 'popup_id' => $this->popup_id, |
||
| 312 | 'data_type' => 'conversion', |
||
| 313 | 'ip_address' => wpbo_get_ip_address(), |
||
| 314 | 'referer' => esc_url( $_SERVER['HTTP_REFERER'] ), |
||
| 315 | 'user_agent' => $_SERVER['HTTP_USER_AGENT'] |
||
| 316 | ), false ); |
||
| 317 | |||
| 318 | return $log; |
||
| 319 | |||
| 320 | } |
||
| 321 | |||
| 322 | /** |
||
| 323 | * Clean the post. |
||
| 324 | * |
||
| 325 | * Filter the post data and only keep |
||
| 326 | * values that are actually supported |
||
| 327 | * by the API. |
||
| 328 | * |
||
| 329 | * @since 1.0.0 |
||
| 330 | * |
||
| 331 | * @param array $data Data to sanitize |
||
| 332 | * |
||
| 333 | * @return array Clean list of merge fields |
||
| 334 | */ |
||
| 335 | protected function get_clean_fields( $data = array() ) { |
||
| 336 | |||
| 337 | $fields = wpbo_get_form_fields(); |
||
| 338 | |||
| 339 | if ( empty( $data ) && ! empty( $_POST ) ) { |
||
| 340 | $data = $_POST; |
||
| 341 | } |
||
| 342 | |||
| 343 | $clean = array(); |
||
| 344 | |||
| 345 | foreach ( $fields as $field_id => $atts ) { |
||
| 346 | |||
| 347 | if ( ! function_exists( $atts['sanitize_callback'] ) ) { |
||
| 348 | $atts['sanitize_callback'] = 'sanitize_text_field'; |
||
| 349 | } |
||
| 350 | |||
| 351 | if ( isset( $data[ $atts['form_name'] ] ) ) { |
||
| 352 | $clean[ $field_id ] = call_user_func( $atts['sanitize_callback'], $data[ $atts['form_name'] ] ); |
||
| 353 | } |
||
| 354 | |||
| 355 | } |
||
| 356 | |||
| 357 | return $clean; |
||
| 358 | |||
| 359 | } |
||
| 360 | |||
| 361 | /** |
||
| 362 | * Trigger form submission. |
||
| 363 | * |
||
| 364 | * @since 1.0.0 |
||
| 365 | * @return void |
||
| 366 | */ |
||
| 367 | public function submit() { |
||
| 368 | |||
| 369 | if ( ! wpbo_is_provider_ready() ) { |
||
| 370 | return; |
||
| 371 | } |
||
| 372 | |||
| 373 | $data = $this->get_clean_fields(); |
||
| 374 | $result = call_user_func( array( wpbo_get_provider_class(), 'submit' ), $data ); |
||
| 375 | |||
| 376 | // Log the conversion |
||
| 377 | $conversion = $this->new_conversion(); |
||
| 378 | |||
| 379 | $first_name = isset( $data['first_name'] ) ? $data['first_name'] : $data['name']; |
||
| 380 | $last_name = isset( $data['last_name'] ) ? $data['last_name'] : ''; |
||
| 381 | |||
| 382 | // Dismiss the popup |
||
| 383 | wpbo_dismiss_popup( $this->popup_id ); |
||
| 384 | |||
| 385 | // Backup the subscriber in case something went wrong |
||
| 386 | if ( true !== $result ) { |
||
| 387 | |||
| 388 | $failsafe = array( |
||
| 389 | 'conversion_id' => $conversion, |
||
| 390 | 'first_name' => $first_name, |
||
| 391 | 'last_name' => $last_name, |
||
| 392 | 'email' => $data['email'], |
||
| 393 | 'status' => 'failed', |
||
| 394 | ); |
||
| 395 | |||
| 396 | wpbo_failsafe_add_subscriber( $failsafe ); |
||
| 397 | |||
| 398 | } |
||
| 399 | |||
| 400 | // Redirect |
||
| 401 | wp_redirect( $this->get_return_url() ); |
||
| 402 | exit; |
||
| 403 | |||
| 404 | } |
||
| 405 | |||
| 406 | /** |
||
| 407 | * Shows a confirmation alert. |
||
| 408 | * |
||
| 409 | * This is only used if the used didn't set a custom |
||
| 410 | * thank you page. |
||
| 411 | * |
||
| 412 | * @since 1.0.0 |
||
| 413 | */ |
||
| 414 | public function submission_confirmation_fallback() { ?> |
||
| 415 | |||
| 416 | <script type="text/javascript">if(window.location.search.indexOf("wpbo_submit=done")>-1){alert("<?php esc_html_e( 'You have successfully registered!', 'betteroptin' ); ?>")}if(window.location.search.indexOf("wpbo_submit=fail")>-1){alert("<?php _e( 'Fail. Please try again.', 'wpbo' ); ?>")}</script> |
||
| 417 | |||
| 418 | <?php } |
||
| 419 | |||
| 420 | } |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.