Issues (4296)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/admin/admin-pages.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Admin Pages
4
 *
5
 * @package     Give
6
 * @subpackage  Admin/Pages
7
 * @copyright   Copyright (c) 2016, WordImpress
8
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
9
 * @since       1.0
10
 */
11
12
// Exit if accessed directly.
13 1
if ( ! defined( 'ABSPATH' ) ) {
14
	exit;
15
}
16
17
/**
18
 * Creates the admin submenu pages under the Give menu and assigns their
19
 * links to global variables
20
 *
21
 * @since 1.0
22
 *
23
 * @global $give_settings_page
24
 * @global $give_payments_page
25
 * @global $give_reports_page
26
 * @global $give_add_ons_page
27
 * @global $give_donors_page
28
 *
29
 * @return void
30
 */
31
function give_add_options_links() {
32
	global $give_settings_page, $give_payments_page, $give_reports_page, $give_add_ons_page, $give_donors_page, $give_tools_page;
33
34
	//Payments
35
	$give_payment       = get_post_type_object( 'give_payment' );
36
	$give_payments_page = add_submenu_page(
37
		'edit.php?post_type=give_forms',
38
		$give_payment->labels->name,
39
		$give_payment->labels->menu_name,
40
		'edit_give_payments',
41
		'give-payment-history',
42
		'give_payment_history_page'
43
	);
44
45
	//Donors
46
	$give_donors_page = add_submenu_page(
47
		'edit.php?post_type=give_forms',
48
		esc_html__( 'Donors', 'give' ),
49
		esc_html__( 'Donors', 'give' ),
50
		'view_give_reports',
51
		'give-donors',
52
		'give_donors_page'
53
	);
54
55
	//Reports`
56 1
	$give_reports_page = add_submenu_page(
57
		'edit.php?post_type=give_forms',
58
		esc_html__( 'Donation Reports', 'give' ),
59
		esc_html__( 'Reports', 'give' ),
60
		'view_give_reports',
61
		'give-reports',
62
		array(
63
			Give()->give_settings,
64
			'output',
65
		)
66
	);
67
68
	//Settings
69
	$give_settings_page = add_submenu_page(
70
		'edit.php?post_type=give_forms',
71
		esc_html__( 'Give Settings', 'give' ),
72
		esc_html__( 'Settings', 'give' ),
73 2
		'manage_give_settings',
74
		'give-settings',
75 2
		array(
76 2
			Give()->give_settings,
77 2
			'output',
78 2
		)
79 2
	);
80 2
81 2
	//Tools.
82
	$give_tools_page = add_submenu_page(
83
		'edit.php?post_type=give_forms',
84 2
		esc_html__( 'Give Tools', 'give' ),
85
		esc_html__( 'Tools', 'give' ),
86
		'manage_give_settings',
87
		'give-tools',
88
		array(
89
			Give()->give_settings,
90
			'output',
91
		)
92
	);
93
94
	//Add-ons
95
	$give_add_ons_page = add_submenu_page(
96
		'edit.php?post_type=give_forms',
97
		esc_html__( 'Give Add-ons', 'give' ),
98
		esc_html__( 'Add-ons', 'give' ),
99
		'install_plugins',
100
		'give-addons',
101
		'give_add_ons_page'
102
	);
103
}
104
105
add_action( 'admin_menu', 'give_add_options_links', 10 );
106
107
/**
108 2
 *  Determines whether the current admin page is a Give admin page.
109
 *
110
 *  Only works after the `wp_loaded` hook, & most effective
111
 *  starting on `admin_menu` hook.
112
 *
113
 * @since 1.0
114
 * @since 2.1 Simplified function.
115
 *
116
 * @param string $passed_page Optional. Main page's slug
117
 * @param string $passed_view Optional. Page view ( ex: `edit` or `delete` )
118
 *
119
 * @return bool True if Give admin page.
120
 */
121
function give_is_admin_page( $passed_page = '', $passed_view = '' ) {
122
	global $pagenow, $typenow;
123
124
	$found          = true;
125
	$get_query_args = ! empty( $_GET ) ? @array_map( 'strtolower', $_GET ) : array();
0 ignored issues
show
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
Silencing errors is discouraged
Loading history...
126
127
	// Set default argument, if not passed.
128 2
	$query_args = wp_parse_args( $get_query_args, array_fill_keys( array( 'post_type', 'action', 'taxonomy', 'page', 'view', 'tab' ), false ) );
129
130
	switch ( $passed_page ) {
131
		case 'categories':
132
		case 'tags':
133
			$has_view = in_array( $passed_view, array( 'list-table', 'edit', 'new' ), true );
134
135
			if (
136
				! in_array( $query_args['taxonomy'], array( 'give_forms_category', 'give_forms_tag' ), true ) &&
137
				'edit-tags.php' !== $pagenow &&
138
				(
139
					$has_view ||
140
					(
141
						( in_array( $passed_view, array( 'list-table', 'new' ), true ) && 'edit' === $query_args['action'] ) ||
142
						( 'edit' !== $passed_view && 'edit' !== $query_args['action'] ) &&
143
						! $has_view
144
					)
145
				)
146
			) {
147
				$found = false;
148 2
			}
149
			break;
150
		// Give Donation form page.
151
		case 'give_forms':
152
			$has_view = in_array( $passed_view, array( 'new', 'list-table', 'edit' ), true );
153
154
			if (
155
				'give_forms' !== $typenow &&
156
				(
157
					( 'list-table' !== $passed_view && 'edit.php' !== $pagenow ) &&
158
					( 'edit' !== $passed_view && 'post.php' !== $pagenow ) &&
159
					( 'new' !== $passed_view && 'post-new.php' !== $pagenow )
160
				) ||
161
				(
162
					! $has_view &&
163
					( 'post-new.php' !== $pagenow && 'give_forms' !== $query_args['post_type'] )
164
				)
165
			) {
166
				$found = false;
167 2
			}
168
			break;
169
		// Give Donors page.
170
		case 'donors':
171
			$has_view = array_intersect( array( $passed_view, $query_args['view'] ), array( 'list-table', 'overview', 'notes' ) );
172
173
			if (
174
				( 'give-donors' !== $query_args['page'] || 'edit.php' !== $pagenow ) &&
175
				(
176
					( $passed_view !== $query_args['view'] || ! empty( $has_view ) ) ||
177
					( false !== $query_args['view'] && 'list-table' !== $passed_view )
178
				)
179
			) {
180
				$found = false;
181
			}
182
			break;
183
		// Give Donations page.
184
		case 'payments':
185
			if (
186
				( 'give-payment-history' !== $query_args['page'] || 'edit.php' !== $pagenow ) &&
187
				(
188
					! in_array( $passed_view, array( 'list-table', 'edit' ), true ) ||
189
					(
190
						( 'list-table' !== $passed_view && false !== $query_args['view'] ) ||
191
						( 'edit' !== $passed_view && 'view-payment-details' !== $query_args['view'] )
192
					)
193
				)
194
			) {
195
				$found = false;
196
			}
197
			break;
198
		case 'reports':
199
		case 'settings':
200
		case 'addons':
201
			// Get current tab.
202 2
			$current_tab       = empty( $passed_view ) ? $query_args['tab'] : $passed_view;
203
			$give_setting_page = in_array( $query_args['page'], array( 'give-reports', 'give-settings', 'give-addons' ), true );
204
205
			// Check if it's Give Setting page or not.
206
			if (
207
				( 'edit.php' !== $pagenow || ! $give_setting_page ) &&
208
				! Give_Admin_Settings::is_setting_page( $current_tab )
209
			) {
210
				$found = false;
211
			}
212
			break;
213
		default:
214
			global $give_payments_page, $give_settings_page, $give_reports_page, $give_system_info_page, $give_add_ons_page, $give_settings_export, $give_donors_page, $give_tools_page;
215
			$admin_pages = apply_filters( 'give_admin_pages', array(
216
				$give_payments_page,
217
				$give_settings_page,
218
				$give_reports_page,
219
				$give_system_info_page,
220
				$give_add_ons_page,
221
				$give_settings_export,
222
				$give_donors_page,
223
				$give_tools_page,
224
				'widgets.php',
225
			) );
226
227
			$found = ( 'give_forms' === $typenow || in_array( $pagenow, array_merge( $admin_pages, array( 'index.php', 'post-new.php', 'post.php' ) ), true ) ) ? true : false;
228
	}
229
	return (bool) apply_filters( 'give_is_admin_page', $found, $query_args['page'], $query_args['view'], $passed_page, $passed_view );
230
}
231
232
/**
233
 * Add setting tab to give-settings page
234
 *
235
 * @since  1.8
236
 * @param  array $settings
237
 * @return array
238
 */
239
function give_settings_page_pages( $settings ) {
240
	include( 'abstract-admin-settings-page.php' );
241
	include( 'settings/class-settings-cmb2-backward-compatibility.php' );
242
243
	$settings = array(
244
		// General settings.
245
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-general.php' ),
246
247
		// Payment Gateways Settings.
248
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-gateways.php' ),
249
250
		// Display settings.
251 2
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-display.php' ),
252
253
		// Emails settings.
254
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-email.php' ),
255
256 2
		// Addons settings.
257
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-addon.php' ),
258
259
		// License settings.
260
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-license.php' ),
261
262
		// Advanced settings.
263
		include( GIVE_PLUGIN_DIR . 'includes/admin/settings/class-settings-advanced.php' ),
264
	);
265
266
	// Output.
267
	return $settings;
268
}
269
add_filter( 'give-settings_get_settings_pages', 'give_settings_page_pages', 0, 1 );
270
271
272
/**
273
 * Add setting tab to give-settings page
274
 *
275
 * @since  1.8
276
 * @param  array $settings
277
 * @return array
278
 */
279
function give_reports_page_pages( $settings ) {
280 2
	include( 'abstract-admin-settings-page.php' );
281
282
	$settings = array(
283
		// Earnings.
284
		include( 'reports/class-earnings-report.php' ),
285 2
286 2
		// Forms.
287
		include( 'reports/class-forms-report.php' ),
288 2
289 2
		// Gateways.
290 2
		include( 'reports/class-gateways-report.php' ),
291 2
292 2
	);
293 2
294 2
	// Output.
295 2
	return $settings;
296
}
297 2
add_filter( 'give-reports_get_settings_pages', 'give_reports_page_pages', 0, 1 );
298 2
299
/**
300
 * Add setting tab to give-settings page
301
 *
302
 * @since  1.8
303 2
 * @param  array $settings
304 1
 * @return array
305 1
 */
306 2
function give_tools_page_pages( $settings ) {
307 2
	include( 'abstract-admin-settings-page.php' );
308
309 2
	$settings = array(
310
311 1
		// Export.
312
		include( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-export.php' ),
313
314
		// Import
315
		include_once( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-import.php' ),
316
317
		// Logs.
318
		include( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-logs.php' ),
319
320
		// API.
321
		include( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-api.php' ),
322
323
		// Data.
324
		include( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-data.php' ),
325
326
		// System Info.
327
		include( GIVE_PLUGIN_DIR . 'includes/admin/tools/class-settings-system-info.php' ),
328
	);
329
330
	// Output.
331
	return $settings;
332
}
333
add_filter( 'give-tools_get_settings_pages', 'give_tools_page_pages', 0, 1 );
334
335
/**
336
 * Set default tools page tab.
337
 *
338
 * @since  1.8
339
 * @param  string $default_tab Default tab name.
340
 * @return string
341
 */
342
function give_set_default_tab_form_tools_page( $default_tab ) {
0 ignored issues
show
The parameter $default_tab is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
343
	return 'export';
344
}
345
add_filter( 'give_default_setting_tab_give-tools', 'give_set_default_tab_form_tools_page', 10, 1 );
346
347
348
/**
349
 * Set default reports page tab.
350
 *
351
 * @since  1.8
352
 * @param  string $default_tab Default tab name.
353
 * @return string
354
 */
355
function give_set_default_tab_form_reports_page( $default_tab ) {
0 ignored issues
show
The parameter $default_tab is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
356
	return 'earnings';
357
}
358
add_filter( 'give_default_setting_tab_give-reports', 'give_set_default_tab_form_reports_page', 10, 1 );
359
360
361
/**
362
 * Add a page display state for special Give pages in the page list table.
363
 *
364
 * @since 1.8.18
365
 *
366
 * @param array $post_states An array of post display states.
367
 * @param WP_Post $post The current post object.
368
 *
369
 * @return array
370
 */
371
function give_add_display_page_states( $post_states, $post ) {
372
373
	switch ( $post->ID ) {
374
		case give_get_option( 'success_page' ):
375
			$post_states['give_successfully_page'] = __( 'Donation Success Page', 'give' );
376
			break;
377
378
		case give_get_option( 'failure_page' ):
379
			$post_states['give_failure_page'] = __( 'Donation Failed Page', 'give' );
380
			break;
381
382
		case give_get_option( 'history_page' ):
383
			$post_states['give_history_page'] = __( 'Donation History Page', 'give' );
384
			break;
385
	}
386
387
	return $post_states;
388
}
389
390
// Add a post display state for special Give pages.
391
add_filter( 'display_post_states', 'give_add_display_page_states', 10, 2 );
392