This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * Template loader for FooGallery |
||
5 | * |
||
6 | * @package FooGallery |
||
7 | * @author Brad vincent |
||
8 | */ |
||
9 | class FooGallery_Template_Loader { |
||
10 | |||
11 | /** |
||
12 | * Locates and renders the gallery based on the template |
||
13 | * Will look in the following locations |
||
14 | * wp-content/themes/{child-theme}/foogallery/gallery-{template}.php |
||
15 | * wp-content/themes/{theme}/foogallery/gallery-{template}.php |
||
16 | * wp-content/plugins/foogallery/templates/gallery-{template}.php |
||
17 | * |
||
18 | * @param $args array Arguments passed in from the shortcode |
||
19 | */ |
||
20 | public function render_template( $args ) { |
||
21 | //do some work before we locate the template |
||
22 | global $current_foogallery; |
||
23 | global $current_foogallery_arguments; |
||
0 ignored issues
–
show
|
|||
24 | global $current_foogallery_template; |
||
0 ignored issues
–
show
Compatibility
Best Practice
introduced
by
Use of
global functionality is not recommended; it makes your code harder to test, and less reusable.
Instead of relying on 1. Pass all data via parametersfunction myFunction($a, $b) {
// Do something
}
2. Create a class that maintains your stateclass MyClass {
private $a;
private $b;
public function __construct($a, $b) {
$this->a = $a;
$this->b = $b;
}
public function myFunction() {
// Do something
}
}
![]() |
|||
25 | |||
26 | //set the arguments |
||
27 | $current_foogallery_arguments = $args; |
||
28 | |||
29 | //load our gallery |
||
30 | $current_foogallery = $this->find_gallery( $args ); |
||
31 | |||
32 | if ( false === $current_foogallery ) { |
||
33 | //we could not find the gallery! |
||
34 | _e( 'The gallery was not found!', 'foogallery' ); |
||
35 | return; |
||
36 | } |
||
37 | |||
38 | //check if the gallery is password protected |
||
39 | if ( post_password_required( $current_foogallery->_post ) ) { |
||
40 | echo get_the_password_form( $current_foogallery->_post ); |
||
41 | return; |
||
42 | } |
||
43 | |||
44 | //find the gallery template we will use to render the gallery |
||
45 | $current_foogallery_template = $this->get_arg( $args, 'template', $current_foogallery->gallery_template ); |
||
46 | //set a default if we have no gallery template |
||
47 | if ( empty( $current_foogallery_template ) ) { |
||
48 | $current_foogallery_template = foogallery_get_default( 'gallery_template' ); |
||
49 | } |
||
50 | |||
51 | //override the template if needed |
||
52 | if ( $current_foogallery->gallery_template !== $current_foogallery_template ) { |
||
53 | $current_foogallery->gallery_template = $current_foogallery_template; |
||
54 | } |
||
55 | |||
56 | //potentially override attachment_ids from arguments |
||
57 | $attachment_ids = $this->get_arg( $args, 'attachment_ids', false ); |
||
0 ignored issues
–
show
false is of type boolean , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
58 | if ( $attachment_ids ) { |
||
59 | if ( !is_array( $attachment_ids ) ) { |
||
60 | $attachment_ids = explode( ',', $attachment_ids); |
||
61 | } |
||
62 | $current_foogallery->attachment_ids = $attachment_ids; |
||
63 | } |
||
64 | |||
65 | //check if we have any attachments |
||
66 | if ( ! $current_foogallery->has_attachments() ) { |
||
67 | //no attachments! |
||
68 | do_action( "foogallery_template_no_attachments-($current_foogallery_template)", $current_foogallery ); |
||
69 | do_action( "foogallery_template_no_attachments", $current_foogallery ); |
||
70 | } else { |
||
71 | |||
72 | //create locator instance |
||
73 | $loader = $this->create_locator_instance(); |
||
74 | |||
75 | if ( false !== ( $template_location = $loader->locate_file( "gallery-{$current_foogallery_template}.php" ) ) ) { |
||
76 | |||
77 | //we have found a template! |
||
78 | do_action( 'foogallery_located_template', $current_foogallery ); |
||
79 | do_action( "foogallery_located_template-{$current_foogallery_template}", $current_foogallery ); |
||
80 | |||
81 | //try to include some JS, but allow template to opt-out based on some condition |
||
82 | if ( false !== apply_filters( "foogallery_template_load_js-{$current_foogallery_template}", true, $current_foogallery ) ) { |
||
83 | if ( false !== ( $js_location = $loader->locate_file( "gallery-{$current_foogallery_template}.js" ) ) ) { |
||
84 | $js_deps = apply_filters( "foogallery_template_js_deps-{$current_foogallery_template}", array(), $current_foogallery ); |
||
85 | $js_ver = apply_filters( "foogallery_template_js_ver-{$current_foogallery_template}", FOOGALLERY_VERSION, $current_foogallery ); |
||
86 | wp_enqueue_script( "foogallery-template-{$current_foogallery_template}", $js_location['url'], $js_deps, $js_ver ); |
||
87 | do_action( 'foogallery_template_enqueue_script', $current_foogallery_template, $js_location['url'] ); |
||
88 | } |
||
89 | } |
||
90 | |||
91 | //try to include some CSS, but allow template to opt-out based on some condition |
||
92 | if ( false !== apply_filters( "foogallery_template_load_css-{$current_foogallery_template}", true, $current_foogallery ) ) { |
||
93 | if ( false !== ( $css_location = $loader->locate_file( "gallery-{$current_foogallery_template}.css" ) ) ) { |
||
94 | $css_deps = apply_filters( "foogallery_template_css_deps-{$current_foogallery_template}", array(), $current_foogallery ); |
||
95 | $css_ver = apply_filters( "foogallery_template_css_ver-{$current_foogallery_template}", FOOGALLERY_VERSION, $current_foogallery ); |
||
96 | foogallery_enqueue_style( "foogallery-template-{$current_foogallery_template}", $css_location['url'], $css_deps, $css_ver ); |
||
97 | } |
||
98 | } |
||
99 | |||
100 | //finally include the actual php template! |
||
101 | if ( $template_location ) { |
||
102 | $this->load_gallery_template( $current_foogallery, $template_location['path'] ); |
||
103 | } |
||
104 | |||
105 | //cater for lightbox extensions needing to add styles and javascript |
||
106 | $lightbox = foogallery_gallery_template_setting( 'lightbox' ); |
||
107 | if ( !empty( $lightbox ) ) { |
||
108 | do_action( "foogallery_template_lightbox-{$lightbox}", $current_foogallery ); |
||
109 | } |
||
110 | |||
111 | //we have loaded all files, now let extensions do some stuff |
||
112 | do_action( "foogallery_loaded_template", $current_foogallery ); |
||
113 | do_action( "foogallery_loaded_template-($current_foogallery_template)", $current_foogallery ); |
||
114 | } else { |
||
115 | //we could not find a template! |
||
116 | _e( 'No gallery template found!', 'foogallery' ); |
||
117 | } |
||
118 | } |
||
119 | |||
120 | if ( apply_filters( 'foogallery_render_template_clear_globals', true ) ) { |
||
121 | //cleanup globals in case there are multiple galleries on a page |
||
122 | $current_foogallery = null; |
||
123 | $current_foogallery_arguments = null; |
||
124 | $current_foogallery_template = null; |
||
125 | } |
||
126 | } |
||
127 | |||
128 | /*** |
||
129 | * Loads a gallery template location and wraps the calls so that it can be intercepted |
||
130 | * |
||
131 | * @param FooGallery $gallery |
||
132 | * @param string $template_location |
||
133 | */ |
||
134 | function load_gallery_template($gallery, $template_location) { |
||
0 ignored issues
–
show
|
|||
135 | |||
136 | $override_load_template = apply_filters( 'foogallery_load_gallery_template', false, $gallery, $template_location ); |
||
137 | |||
138 | if ( $override_load_template ) { |
||
139 | //if we have overridden the loading of the template, then we can exit without doing anything further |
||
140 | return; |
||
141 | } |
||
142 | |||
143 | //if we get to this point, then we need to load the template as per normal |
||
144 | load_template( $template_location, false ); |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * Creates a locator instance used for including template files |
||
149 | * |
||
150 | * |
||
151 | */ |
||
152 | public function create_locator_instance() { |
||
153 | $instance_name = FOOGALLERY_SLUG . '_gallery_templates'; |
||
154 | $loader = new Foo_Plugin_File_Locator_v1( $instance_name, FOOGALLERY_FILE, 'templates', FOOGALLERY_SLUG ); |
||
155 | |||
156 | //allow extensions to very easily add pickup locations for their files |
||
157 | $this->add_extension_pickup_locations( $loader, apply_filters( $instance_name . '_files', array() ) ); |
||
158 | |||
159 | return $loader; |
||
160 | } |
||
161 | |||
162 | /** |
||
163 | * Add pickup locations to the loader to make it easier for extensions |
||
164 | * |
||
165 | * @param $loader Foo_Plugin_File_Locator_v1 |
||
166 | * @param $extension_files array |
||
167 | */ |
||
168 | function add_extension_pickup_locations( $loader, $extension_files ) { |
||
169 | if ( count( $extension_files ) > 0 ) { |
||
170 | $position = 120; |
||
171 | foreach ( $extension_files as $file ) { |
||
172 | |||
173 | //add pickup location for php template |
||
174 | $loader->add_location( $position, array( |
||
175 | 'path' => trailingslashit( plugin_dir_path( $file ) ), |
||
176 | 'url' => trailingslashit( plugin_dir_url( $file ) ) |
||
177 | ) ); |
||
178 | |||
179 | $position++; |
||
180 | |||
181 | //add pickup location for extensions js folder |
||
182 | $loader->add_location( $position, array( |
||
183 | 'path' => trailingslashit( plugin_dir_path( $file ) . 'js' ), |
||
184 | 'url' => trailingslashit( plugin_dir_url( $file ) . 'js' ) |
||
185 | ) ); |
||
186 | |||
187 | $position++; |
||
188 | |||
189 | //add pickup location for extension css folder |
||
190 | $loader->add_location( $position, array( |
||
191 | 'path' => trailingslashit( plugin_dir_path( $file ) . 'css' ), |
||
192 | 'url' => trailingslashit( plugin_dir_url( $file ) . 'css' ) |
||
193 | ) ); |
||
194 | |||
195 | $position++; |
||
196 | |||
197 | } |
||
198 | } |
||
199 | } |
||
200 | |||
201 | /** |
||
202 | * load the gallery based on either the id or slug, passed in via arguments |
||
203 | * |
||
204 | * @param $args array Arguments passed in from the shortcode |
||
205 | * |
||
206 | * @return bool|FooGallery The gallery object we want to render |
||
207 | */ |
||
208 | function find_gallery( $args ) { |
||
209 | |||
210 | $id = intval( $this->get_arg( $args, 'id' ), 0 ); |
||
211 | $gallery = $this->get_arg( $args, 'gallery', 0 ); |
||
212 | |||
213 | if ( $id > 0 ) { |
||
214 | //load gallery by ID |
||
215 | return FooGallery::get_by_id( $id ); |
||
216 | } |
||
217 | |||
218 | //take into account the cases where id is passed in via the 'gallery' attribute |
||
219 | if ( intval( $gallery ) > 0 ) { |
||
220 | //we have an id, so load |
||
221 | return FooGallery::get_by_id( intval( $gallery ) ); |
||
222 | } else if ( !empty( $gallery ) ) { |
||
223 | //we are dealing with a slug |
||
224 | return FooGallery::get_by_slug( $gallery ); |
||
225 | } |
||
226 | |||
227 | //if we get here then we have no id or gallery attribute, so try to build a dynamic gallery |
||
228 | |||
229 | //we can only build up a dynamic gallery if attachment_ids are passed in |
||
230 | $attachment_ids = $this->get_arg( $args, 'attachment_ids', false ); |
||
0 ignored issues
–
show
false is of type boolean , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
231 | |||
232 | if ( $attachment_ids ) { |
||
233 | $template = $this->get_arg( $args, 'template', foogallery_get_default( 'gallery_template' ) ); |
||
234 | |||
235 | if ( !is_array( $attachment_ids ) ) { |
||
236 | $attachment_ids = explode( ',', $attachment_ids); |
||
237 | } |
||
238 | return FooGallery::dynamic( $template, $attachment_ids ); |
||
239 | } |
||
240 | |||
241 | return false; |
||
242 | } |
||
243 | |||
244 | /** |
||
245 | * Helper to get an argument value from an array arguments |
||
246 | * |
||
247 | * @param $args Array the array of arguments to search |
||
248 | * @param $key string the key of the argument you are looking for |
||
249 | * @param $default string a default value if the argument is not found |
||
250 | * |
||
251 | * @return string |
||
252 | */ |
||
253 | function get_arg( $args, $key, $default = '' ) { |
||
254 | if ( empty($args) || ! array_key_exists( $key, $args ) ) { |
||
255 | return $default; |
||
256 | } |
||
257 | |||
258 | return $args[ $key ]; |
||
259 | } |
||
260 | } |
||
261 |
Instead of relying on
global
state, we recommend one of these alternatives:1. Pass all data via parameters
2. Create a class that maintains your state