This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * class FooGallery_Attachment_Fields |
||
4 | * |
||
5 | * Add custom fields to media attachments |
||
6 | */ |
||
7 | if (!class_exists('FooGallery_Attachment_Fields')) { |
||
8 | |||
9 | class FooGallery_Attachment_Fields { |
||
10 | |||
11 | function __construct() { |
||
12 | add_filter( 'attachment_fields_to_edit', array( $this, 'add_fields' ), 9, 2 ); |
||
13 | add_filter( 'attachment_fields_to_save', array( $this, 'save_fields' ), 11, 2 ); |
||
14 | } |
||
15 | |||
16 | public function get_custom_fields( $post = null ) { |
||
17 | |||
18 | $target_options = apply_filters( 'foogallery_attachment_field_custom_target_options', array( |
||
19 | 'default' => __( 'Default', 'foogallery' ), |
||
20 | '_blank' => __( 'New tab (_blank)', 'foogallery' ), |
||
21 | '_self' => __( 'Same tab (_self)', 'foogallery' ), |
||
22 | 'foobox' => __( 'FooBox', 'foogallery' ) |
||
23 | ) ); |
||
24 | |||
25 | $fields = array( |
||
26 | 'foogallery_custom_url' => array( |
||
27 | 'label' => __( 'Custom URL', 'foogallery' ), |
||
28 | 'input' => 'text', //other types are 'textarea', 'checkbox', 'radio', 'select', |
||
0 ignored issues
–
show
|
|||
29 | 'helps' => __( 'Point your attachment to a custom URL', 'foogallery' ), |
||
30 | 'exclusions' => array( 'audio', 'video' ), |
||
31 | ), |
||
32 | |||
33 | 'foogallery_custom_target' => array( |
||
34 | 'label' => __( 'Custom Target', 'foogallery' ), |
||
35 | 'input' => 'select', |
||
36 | 'helps' => __( 'Set a custom target for your attachment', 'foogallery' ), |
||
37 | 'exclusions' => array( 'audio', 'video' ), |
||
38 | 'options' => $target_options |
||
39 | ) |
||
40 | ); |
||
41 | |||
42 | //original filter without $post |
||
43 | $fields = apply_filters( 'foogallery_attachment_custom_fields', $fields ); |
||
44 | |||
45 | //newer filter including the $post |
||
46 | $fields = apply_filters( 'foogallery_attachment_custom_fields_with_post', $fields, $post ); |
||
47 | |||
48 | return $fields; |
||
49 | } |
||
50 | |||
51 | /** |
||
52 | * @param $form_fields |
||
53 | * @param WP_Post $post |
||
54 | * |
||
55 | * @return mixed |
||
56 | */ |
||
57 | public function add_fields( $form_fields, $post = null ) { |
||
58 | $custom_fields = $this->get_custom_fields(); |
||
59 | |||
60 | // If our fields array is not empty |
||
61 | if ( ! empty( $custom_fields ) ) { |
||
62 | // We browse our set of options |
||
63 | foreach ( $custom_fields as $field => $values ) { |
||
64 | //remove any help, as it just looks untidy |
||
65 | if ( isset( $values['helps'] ) ) { |
||
66 | unset( $values['helps'] ); |
||
67 | } |
||
68 | |||
69 | if ( empty( $values['exclusions'] ) ) { |
||
70 | $values['exclusions'] = array(); |
||
71 | } |
||
72 | |||
73 | // If the field matches the current attachment mime type |
||
74 | // and is not one of the exclusions |
||
75 | if ( !in_array( $post->post_mime_type, $values['exclusions'] ) ) { |
||
76 | // We get the already saved field meta value |
||
77 | $meta = apply_filters( 'foogallery_attachment_custom_field_value', get_post_meta( $post->ID, '_' . $field, true ), $post->ID, $field, $values ); |
||
78 | |||
79 | switch ( $values['input'] ) { |
||
80 | default: |
||
81 | case 'text': |
||
82 | $values['input'] = 'text'; |
||
83 | break; |
||
84 | |||
85 | case 'textarea': |
||
86 | $values['input'] = 'textarea'; |
||
87 | break; |
||
88 | |||
89 | case 'select': |
||
0 ignored issues
–
show
The case body in a switch statement must start on the line following the statement.
According to the PSR-2, the body of a case statement must start on the line immediately following the case statement. switch ($expr) {
case "A":
doSomething(); //right
break;
case "B":
doSomethingElse(); //wrong
break;
} To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
90 | |||
91 | // Select type doesn't exist, so we will create the html manually |
||
92 | // For this, we have to set the input type to 'html' |
||
93 | $values['input'] = 'html'; |
||
94 | |||
95 | // Create the select element with the right name (matches the one that wordpress creates for custom fields) |
||
96 | $html = '<select name="attachments[' . $post->ID . '][' . $field . ']">'; |
||
97 | |||
98 | // If options array is passed |
||
99 | if ( isset( $values['options'] ) ) { |
||
100 | // Browse and add the options |
||
101 | foreach ( $values['options'] as $k => $v ) { |
||
102 | // Set the option selected or not |
||
103 | if ( $meta == $k ) |
||
104 | $selected = ' selected="selected"'; |
||
105 | else |
||
106 | $selected = ''; |
||
107 | |||
108 | $html .= '<option' . $selected . ' value="' . $k . '">' . $v . '</option>'; |
||
109 | } |
||
110 | } |
||
111 | |||
112 | $html .= '</select>'; |
||
113 | |||
114 | // Set the html content |
||
115 | $values['html'] = $html; |
||
116 | |||
117 | break; |
||
118 | |||
119 | case 'checkbox': |
||
0 ignored issues
–
show
The case body in a switch statement must start on the line following the statement.
According to the PSR-2, the body of a case statement must start on the line immediately following the case statement. switch ($expr) {
case "A":
doSomething(); //right
break;
case "B":
doSomethingElse(); //wrong
break;
} To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
120 | |||
121 | // Checkbox type doesn't exist either |
||
122 | $values['input'] = 'html'; |
||
123 | |||
124 | // Set the checkbox checked or not |
||
125 | if ( $meta == 'on' ) |
||
126 | $checked = ' checked="checked"'; |
||
127 | else |
||
128 | $checked = ''; |
||
129 | |||
130 | $html = '<input' . $checked . ' type="checkbox" name="attachments[' . $post->ID . '][' . $field . ']" id="attachments-' . $post->ID . '-' . $field . '" />'; |
||
131 | |||
132 | $values['html'] = $html; |
||
133 | |||
134 | break; |
||
135 | |||
136 | case 'radio': |
||
0 ignored issues
–
show
The case body in a switch statement must start on the line following the statement.
According to the PSR-2, the body of a case statement must start on the line immediately following the case statement. switch ($expr) {
case "A":
doSomething(); //right
break;
case "B":
doSomethingElse(); //wrong
break;
} To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
137 | |||
138 | // radio type doesn't exist either |
||
139 | $values['input'] = 'html'; |
||
140 | |||
141 | $html = ''; |
||
142 | |||
143 | if ( ! empty( $values['options'] ) ) { |
||
144 | $i = 0; |
||
145 | |||
146 | foreach ( $values['options'] as $k => $v ) { |
||
147 | if ( $meta == $k ) |
||
148 | $checked = ' checked="checked"'; |
||
149 | else |
||
150 | $checked = ''; |
||
151 | |||
152 | $html .= '<input' . $checked . ' value="' . $k . '" type="radio" name="attachments[' . $post->ID . '][' . $field . ']" id="' . sanitize_key( $field . '_' . $post->ID . '_' . $i ) . '" /> <label for="' . sanitize_key( $field . '_' . $post->ID . '_' . $i ) . '">' . $v . '</label><br />'; |
||
153 | $i++; |
||
154 | } |
||
155 | } |
||
156 | |||
157 | $values['html'] = $html; |
||
158 | |||
159 | break; |
||
160 | } |
||
161 | |||
162 | // And set it to the field before building it |
||
163 | $values['value'] = $meta; |
||
164 | |||
165 | // We add our field into the $form_fields array |
||
166 | $form_fields[$field] = apply_filters( 'foogallery_attachment_field_' . $field, $values, $post->ID ); |
||
167 | } |
||
168 | } |
||
169 | } |
||
170 | |||
171 | //allow it to change |
||
172 | $form_fields = apply_filters( 'foogallery_attachment_add_fields', $form_fields ); |
||
173 | |||
174 | // We return the completed $form_fields array |
||
175 | return $form_fields; |
||
176 | } |
||
177 | |||
178 | function save_fields( $post, $attachment ) { |
||
179 | $custom_fields = $this->get_custom_fields(); |
||
180 | |||
181 | // If our fields array is not empty |
||
182 | if ( ! empty( $custom_fields ) ) { |
||
183 | // We browse our set of options |
||
184 | foreach ( $custom_fields as $field => $values ) { |
||
185 | switch ( $values['input'] ) { |
||
186 | case 'text': |
||
187 | case 'textarea': |
||
188 | case 'select': |
||
189 | case 'radio': |
||
190 | case 'checkbox': |
||
191 | // If this field has been submitted (is present in the $attachment variable) |
||
192 | if ( isset( $attachment[$field] ) ) { |
||
193 | // If submitted field is empty |
||
194 | // We add errors to the post object with the "error_text" parameter if set in the options |
||
195 | if ( strlen( trim( $attachment[$field] ) ) == 0 && isset( $values['error_text'] ) ) { |
||
196 | $post['errors'][ $field ]['errors'][] = __( $values['error_text'] ); |
||
197 | // Otherwise we update the custom field |
||
198 | } else { |
||
199 | update_post_meta( $post['ID'], '_' . $field, $attachment[ $field ] ); |
||
200 | } |
||
201 | } |
||
202 | // Otherwise, we delete it if it already existed |
||
203 | else { |
||
204 | delete_post_meta( $post['ID'], $field ); |
||
205 | } |
||
206 | break; |
||
207 | |||
208 | default: |
||
209 | do_action( 'foogallery_attachment_save_field_' . $values['input'], $field, $values, $post, $attachment); |
||
210 | } |
||
211 | } |
||
212 | } |
||
213 | |||
214 | return $post; |
||
215 | } |
||
216 | } |
||
217 | } |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.