Issues (4296)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/template-functions.php (7 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Template Functions
4
 *
5
 * @package     Give
6
 * @subpackage  Functions/Templates
7
 * @copyright   Copyright (c) 2016, WordImpress
8
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
9
 * @since       1.0
10
 */
11
12
// Exit if accessed directly.
13
if ( ! defined( 'ABSPATH' ) ) {
14
	exit;
15
}
16
17
/**
18
 * Returns the path to the Give templates directory
19
 *
20
 * @since 1.0
21
 * @return string
22
 */
23
function give_get_templates_dir() {
24 47
	return GIVE_PLUGIN_DIR . 'templates';
25
}
26
27
/**
28
 * Returns the URL to the Give templates directory
29
 *
30
 * @since 1.0
31
 * @return string
32
 */
33
function give_get_templates_url() {
34 1
	return GIVE_PLUGIN_URL . 'templates';
35
}
36
37
/**
38
 * Get other templates, passing attributes and including the file.
39
 *
40
 * @since 1.6
41
 *
42
 * @param string $template_name Template file name.
43
 * @param array  $args          Passed arguments. Default is empty array().
44
 * @param string $template_path Template file path. Default is empty.
45
 * @param string $default_path  Default path. Default is empty.
46
 */
47
function give_get_template( $template_name, $args = array(), $template_path = '', $default_path = '' ) {
48
	if ( ! empty( $args ) && is_array( $args ) ) {
49
		extract( $args );
0 ignored issues
show
extract() usage is highly discouraged, due to the complexity and unintended issues it might cause.
Loading history...
50
	}
51
52
	$template_names = "{$template_name}.php";
53
54
	$located = give_get_locate_template( $template_names, $template_path, $default_path );
55
56
	if ( ! file_exists( $located ) ) {
57 44
		/* translators: %s: the template */
58
		Give()->notices->print_frontend_notice( sprintf( __( 'The %s template was not found.', 'give' ), $located ), true );
59
60 44
		return;
61 44
	}
62 44
63 44
	// Allow 3rd party plugin filter template file from their plugin.
64 44
	$located = apply_filters( 'give_get_template', $located, $template_name, $args, $template_path, $default_path );
65
66
	/**
67 44
	 * Fires in give template, before the file is included.
68
	 *
69
	 * Allows you to execute code before the file is included.
70 44
	 *
71
	 * @since 1.6
72
	 *
73
	 * @param string $template_name Template file name.
74
	 * @param string $template_path Template file path.
75
	 * @param string $located       Template file filter by 3rd party plugin.
76
	 * @param array  $args          Passed arguments.
77
	 */
78
	do_action( 'give_before_template_part', $template_name, $template_path, $located, $args );
79
80
	include( $located );
81
82
	/**
83
	 * Fires in give template, after the file is included.
84
	 *
85
	 * Allows you to execute code after the file is included.
86
	 *
87
	 * @since 1.6
88
	 *
89
	 * @param string $template_name Template file name.
90
	 * @param string $template_path Template file path.
91
	 * @param string $located       Template file filter by 3rd party plugin.
92
	 * @param array  $args          Passed arguments.
93 45
	 */
94
	do_action( 'give_after_template_part', $template_name, $template_path, $located, $args );
95
}
96 45
97
/**
98
 * Retrieves a template part
99 45
 *
100
 * Taken from bbPress.
101
 *
102
 * @since 1.0
103
 *
104 45
 * @param string $slug Template part file slug {slug}.php.
105
 * @param string $name Optional. Template part file name {slug}-{name}.php. Default is null.
106
 * @param bool   $load If true the template file will be loaded, if it is found.
107 45
 *
108
 * @return string
109 45
 */
110 45
function give_get_template_part( $slug, $name = null, $load = true ) {
111 45
112
	/**
113 45
	 * Fires in give template part, before the template part is retrieved.
114
	 *
115 45
	 * Allows you to execute code before retrieving the template part.
116 45
	 *
117
	 * @since 1.0
118 45
	 *
119
	 * @param string $slug Template part file slug {slug}.php.
120 45
	 * @param string $name Template part file name {slug}-{name}.php.
121 44
	 */
122 44
	do_action( "get_template_part_{$slug}", $slug, $name );
123
124 45
	// Setup possible parts
125
	$templates = array();
126
	if ( isset( $name ) ) {
127
		$templates[] = $slug . '-' . $name . '.php';
128
	}
129
	$templates[] = $slug . '.php';
130
131
	// Allow template parts to be filtered
132
	$templates = apply_filters( 'give_get_template_part', $templates, $slug, $name );
133
134
	// Return the part that is found
135 46
	return give_locate_template( $templates, $load, false );
136
}
137
138 46
/**
139 46
 * Retrieve the name of the highest priority template file that exists.
140 46
 *
141 46
 * Searches in the STYLESHEETPATH before TEMPLATEPATH so that themes which
142
 * inherit from a parent theme can just overload one file. If the template is
143 46
 * not found in either of those, it looks in the theme-compat folder last.
144
 *
145
 * Forked from bbPress
146 46
 *
147
 * @since 1.0
148 46
 *
149
 * @param string|array $template_names Template file(s) to search for, in order.
150
 * @param bool         $load           If true the template file will be loaded if it is found.
151
 * @param bool         $require_once   Whether to require_once or require. Default true.
152
 *                                     Has no effect if $load is false.
153
 *
154
 * @return string The template filename if one is located.
155
 */
156
function give_locate_template( $template_names, $load = false, $require_once = true ) {
157
	// No file found yet
158
	$located = false;
159
160 48
	// Try to find a template file
161
	foreach ( (array) $template_names as $template_name ) {
162
163
		// Continue if template is empty
164
		if ( empty( $template_name ) ) {
165
			continue;
166
		}
167
168
		// Trim off any slashes from the template name
169
		$template_name = ltrim( $template_name, '/' );
170
171
		// try locating this template file by looping through the template paths
172
		foreach ( give_get_theme_template_paths() as $template_path ) {
173
174
			if ( file_exists( $template_path . $template_name ) ) {
175
				$located = $template_path . $template_name;
176
				break;
177
			}
178
		}
179
180
		if ( $located ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $located of type string|false is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
181
			break;
182
		}
183
	}
184
185
	if ( ( true == $load ) && ! empty( $located ) ) {
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
186
		load_template( $located, $require_once );
187
	}
188
189
	return $located;
190
}
191
192
/**
193
 * Locate a template and return the path for inclusion.
194
 *
195
 * This is the load order:
196
 *
197
 *        yourtheme        /    $template_path    /    $template_name
198
 *        yourtheme        /    $template_name
199
 *        $default_path    /    $template_name
200
 *
201
 * @since  2.0.3
202
 * @access public
203
 *
204
 * @param string $template_name
205
 * @param string $template_path (default: '')
206
 * @param string $default_path  (default: '')
207
 *
208
 * @return string
209
 */
210
function give_get_locate_template( $template_name, $template_path = '', $default_path = '' ) {
211
	if ( ! $template_path ) {
212
		$template_path = give_get_theme_template_dir_name() . '/';
213
	}
214
215
	if ( ! $default_path ) {
216
		$default_path = GIVE_PLUGIN_DIR . 'templates/';
217
	}
218
219
	// Look within passed path within the theme - this is priority.
220
	$template = locate_template(
221
		array(
222
			trailingslashit( $template_path ) . $template_name,
223
			$template_name,
224
		)
225
	);
226
227
	// Get default template/
228
	if ( ! $template ) {
229
		$template = $default_path . $template_name;
230
	}
231
232
	/**
233
	 * Filter the template
234
	 *
235
	 * @since 2.0.3
236
	 */
237
	return apply_filters( 'give_get_locate_template', $template, $template_name, $template_path );
238
}
239
240
/**
241
 * Returns a list of paths to check for template locations
242
 *
243
 * @since 1.0
244
 * @return array
245
 */
246
function give_get_theme_template_paths() {
247
248
	$template_dir = give_get_theme_template_dir_name();
249
250
	$file_paths = array(
251
		1   => trailingslashit( get_stylesheet_directory() ) . $template_dir,
252
		10  => trailingslashit( get_template_directory() ) . $template_dir,
253
		100 => give_get_templates_dir(),
254
	);
255
256
	$file_paths = apply_filters( 'give_template_paths', $file_paths );
257
258
	// sort the file paths based on priority
259
	ksort( $file_paths, SORT_NUMERIC );
260
261
	return array_map( 'trailingslashit', $file_paths );
262
}
263
264
/**
265
 * Returns the template directory name.
266
 *
267
 * Themes can filter this by using the give_templates_dir filter.
268
 *
269
 * @since 1.0
270
 * @return string
271
 */
272
function give_get_theme_template_dir_name() {
273
	return trailingslashit( apply_filters( 'give_templates_dir', 'give' ) );
274
}
275
276
/**
277
 * Adds Give Version to the <head> tag
278
 *
279
 * @since 1.0
280
 * @return void
281
 */
282
function give_version_in_header() {
283
	echo '<meta name="generator" content="Give v' . GIVE_VERSION . '" />' . "\n";
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'GIVE_VERSION'
Loading history...
284
}
285
286
add_action( 'wp_head', 'give_version_in_header' );
287
288
/**
289
 * Determines if we're currently on the Donations History page.
290
 *
291
 * @since 1.0
292
 * @return bool True if on the Donations History page, false otherwise.
293
 */
294
function give_is_donation_history_page() {
295
296
	$ret = is_page( give_get_option( 'history_page' ) );
297
298
	return apply_filters( 'give_is_donation_history_page', $ret );
299
}
300
301
/**
302
 * Adds body classes for Give pages
303
 *
304
 * @since 1.0
305
 *
306
 * @param array $class current classes
307
 *
308
 * @return array Modified array of classes
309
 */
310
function give_add_body_classes( $class ) {
311
	$classes = (array) $class;
312
313
	if ( give_is_success_page() ) {
314
		$classes[] = 'give-success';
315
		$classes[] = 'give-page';
316
	}
317
318
	if ( give_is_failed_transaction_page() ) {
319
		$classes[] = 'give-failed-transaction';
320
		$classes[] = 'give-page';
321
	}
322
323
	if ( give_is_donation_history_page() ) {
324
		$classes[] = 'give-donation-history';
325
		$classes[] = 'give-page';
326
	}
327
328
	if ( give_is_test_mode() ) {
329
		$classes[] = 'give-test-mode';
330
		$classes[] = 'give-page';
331
	}
332
333
	// Theme-specific Classes used to prevent conflicts via CSS
334
	/* @var WP_Theme $current_theme */
335
	$current_theme = wp_get_theme();
336
337
	switch ( $current_theme->get_template() ) {
338
339
		case 'Divi':
340
			$classes[] = 'give-divi';
341
			break;
342
		case 'Avada':
343
			$classes[] = 'give-avada';
344
			break;
345
		case 'twentysixteen':
346
			$classes[] = 'give-twentysixteen';
347
			break;
348
		case 'twentyseventeen':
349
			$classes[] = 'give-twentyseventeen';
350
			break;
351
352
	}
353
354
	return array_unique( $classes );
355
}
356
357
add_filter( 'body_class', 'give_add_body_classes' );
358
359
360
/**
361
 * Add Post Class Filter
362
 *
363
 * Adds extra post classes for forms
364
 *
365
 * @since       1.0
366
 *
367
 * @param array        $classes
368
 * @param string|array $class
369
 * @param int|string   $post_id
370
 *
371
 * @return array
372
 */
373
function give_add_post_class( $classes, $class = '', $post_id = '' ) {
0 ignored issues
show
The parameter $class is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
374
	if ( ! $post_id || 'give_forms' !== get_post_type( $post_id ) ) {
375
		return $classes;
376
	}
377
378
	//@TODO: Add classes for custom taxonomy and form configurations (multi vs single donations, etc).
379
380
	if ( false !== ( $key = array_search( 'hentry', $classes ) ) ) {
381
		unset( $classes[ $key ] );
382
	}
383
384
	return $classes;
385
}
386
387
388
add_filter( 'post_class', 'give_add_post_class', 20, 3 );
389
390
/**
391
 * Get the placeholder image URL for forms etc
392
 *
393
 * @access public
394
 * @return string
395
 */
396
function give_get_placeholder_img_src() {
397
398
	$placeholder_url = '//placehold.it/600x600&text=' . urlencode( esc_attr__( 'Give Placeholder Image', 'give' ) );
399
400
	return apply_filters( 'give_placeholder_img_src', $placeholder_url );
401
}
402
403
404
/**
405
 * Global
406
 */
407
if ( ! function_exists( 'give_output_content_wrapper' ) ) {
408
409
	/**
410
	 * Output the start of the page wrapper.
411
	 */
412
	function give_output_content_wrapper() {
413
		give_get_template_part( 'global/wrapper-start' );
414
	}
415
}
416
if ( ! function_exists( 'give_output_content_wrapper_end' ) ) {
417
418
	/**
419
	 * Output the end of the page wrapper.
420
	 */
421
	function give_output_content_wrapper_end() {
422
		give_get_template_part( 'global/wrapper-end' );
423
	}
424
}
425
426
/**
427
 * Single Give Form
428
 */
429
if ( ! function_exists( 'give_left_sidebar_pre_wrap' ) ) {
430
	function give_left_sidebar_pre_wrap() {
431
		echo apply_filters( 'give_left_sidebar_pre_wrap', '<div id="give-sidebar-left" class="give-sidebar give-single-form-sidebar-left">' );
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'apply_filters'
Loading history...
432
	}
433
}
434
435
if ( ! function_exists( 'give_left_sidebar_post_wrap' ) ) {
436
	function give_left_sidebar_post_wrap() {
437
		echo apply_filters( 'give_left_sidebar_post_wrap', '</div>' );
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'apply_filters'
Loading history...
438
	}
439
}
440
441
if ( ! function_exists( 'give_get_forms_sidebar' ) ) {
442
	function give_get_forms_sidebar() {
443
		give_get_template_part( 'single-give-form/sidebar' );
444
	}
445
}
446
447
if ( ! function_exists( 'give_show_form_images' ) ) {
448
449
	/**
450
	 * Output the donation form featured image.
451
	 */
452
	function give_show_form_images() {
453
		if ( give_is_setting_enabled( give_get_option( 'form_featured_img' ) ) ) {
454
			give_get_template_part( 'single-give-form/featured-image' );
455
		}
456
	}
457
}
458
459
if ( ! function_exists( 'give_template_single_title' ) ) {
460
461
	/**
462
	 * Output the form title.
463
	 */
464
	function give_template_single_title() {
465
		give_get_template_part( 'single-give-form/title' );
466
	}
467
}
468
469
/**
470
 * Conditional Functions
471
 */
472
473
if ( ! function_exists( 'is_give_form' ) ) {
474
475
	/**
476
	 * is_give_form
477
	 *
478
	 * Returns true when viewing a single form.
479
	 *
480
	 * @since 1.6
481
	 *
482
	 * @return bool
483
	 */
484
	function is_give_form() {
485
		return is_singular( array( 'give_form' ) );
486
	}
487
}
488
489
if ( ! function_exists( 'is_give_category' ) ) {
490
491
	/**
492
	 * is_give_category
493
	 *
494
	 * Returns true when viewing give form category archive.
495
	 *
496
	 * @since 1.6
497
	 *
498
	 * @param string $term The term slug your checking for.
499
	 *                     Leave blank to return true on any.
500
	 *                     Default is blank.
501
	 *
502
	 * @return bool
503
	 */
504
	function is_give_category( $term = '' ) {
505
		return is_tax( 'give_forms_category', $term );
506
	}
507
}
508
509
if ( ! function_exists( 'is_give_tag' ) ) {
510
511
	/**
512
	 * is_give_tag
513
	 *
514
	 * Returns true when viewing give form tag archive.
515
	 *
516
	 * @since 1.6
517
	 *
518
	 * @param string $term The term slug your checking for.
519
	 *                     Leave blank to return true on any.
520
	 *                     Default is blank.
521
	 *
522
	 * @return bool
523
	 */
524
	function is_give_tag( $term = '' ) {
525
		return is_tax( 'give_forms_tag', $term );
526
	}
527
}
528
529
if ( ! function_exists( 'is_give_taxonomy' ) ) {
530
531
	/**
532
	 * is_give_taxonomy
533
	 *
534
	 * Returns true when viewing a give form taxonomy archive.
535
	 *
536
	 * @since 1.6
537
	 *
538
	 * @return bool
539
	 */
540
	function is_give_taxonomy() {
541
		return is_tax( get_object_taxonomies( 'give_form' ) );
542
	}
543
}
544