This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
0 ignored issues
–
show
|
|||
2 | |||
3 | /** |
||
4 | * Created by PhpStorm. |
||
5 | * User: steve |
||
6 | * Date: 4/17/2018 |
||
7 | * Time: 10:09 PM |
||
8 | */ |
||
9 | |||
10 | if ( !class_exists("FooGallery_Pro_Video_Vimeo") ){ |
||
11 | |||
12 | require_once dirname(__FILE__) . '/class-foogallery-pro-video-base.php'; |
||
13 | |||
14 | class FooGallery_Pro_Video_Vimeo extends FooGallery_Pro_Video_Base { |
||
0 ignored issues
–
show
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.
You can fix this by adding a namespace to your class: namespace YourVendor;
class YourClass { }
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries. ![]() |
|||
15 | |||
16 | // region Properties |
||
17 | |||
18 | /** |
||
19 | * The regular expression used to match a Vimeo video URL. |
||
20 | * @var string |
||
21 | */ |
||
22 | public $regex_pattern; |
||
23 | |||
24 | // endregion |
||
25 | |||
26 | function __construct() { |
||
0 ignored issues
–
show
|
|||
27 | $this->regex_pattern = '/(player\.)?vimeo\.com/i'; |
||
28 | |||
29 | add_action('wp_ajax_fgi_save', array($this, 'ajax')); |
||
30 | } |
||
31 | |||
32 | public function get_args(){ |
||
33 | return array( |
||
34 | "access_token" => !empty($_POST["access_token"]) ? trim($_POST["access_token"]) : null, |
||
35 | "nonce" => !empty($_POST["fgi_nonce"]) ? $_POST["fgi_nonce"] : null |
||
36 | ); |
||
37 | } |
||
38 | |||
39 | /** |
||
40 | * Save the Vimeo Access Token to the foogallery settings |
||
41 | */ |
||
42 | public function ajax() { |
||
43 | |||
44 | $args = $this->get_args(); |
||
45 | if (wp_verify_nonce($args["nonce"], "fgi_nonce")){ |
||
46 | if (empty($args["access_token"]) || mb_strlen($args["access_token"], "UTF-8") < 30) { |
||
47 | wp_send_json_error("The 'access_token' argument is required and must be a minimum of 30 characters in length."); |
||
48 | return; |
||
49 | } |
||
50 | |||
51 | $response = $this->verify_token($args["access_token"]); |
||
52 | |||
53 | if ($response["mode"] == "verified"){ |
||
54 | foogallery_settings_set_vimeo_access_token($args["access_token"]); |
||
55 | } |
||
56 | wp_send_json_success($response); |
||
57 | } |
||
58 | die(); |
||
59 | } |
||
60 | |||
61 | public function verify_token($token){ |
||
62 | |||
63 | $remote = wp_remote_get("https://api.vimeo.com/oauth/verify", array( |
||
64 | "headers" => array( |
||
65 | "Authorization" => "Bearer " . $token |
||
66 | ) |
||
67 | )); |
||
68 | |||
69 | if (is_wp_error($remote)) { |
||
70 | return $this->error_response("Error validating token: " . $remote->get_error_message()); |
||
71 | } |
||
72 | |||
73 | if (wp_remote_retrieve_response_code($remote) == "401"){ |
||
74 | return $this->error_response("Invalid token supplied unable to verify."); |
||
75 | } |
||
76 | |||
77 | return array( |
||
78 | "mode" => "verified", |
||
79 | "message" => __( 'Verified access token.' , 'foogallery' ) |
||
80 | ); |
||
81 | } |
||
82 | |||
83 | /** |
||
84 | * Takes a URL and checks if this class handles it. |
||
85 | * |
||
86 | * @param string $url The URL to check. |
||
87 | * @param array &$matches Optional. If matches is provided, it is passed to the `preg_match` call used to check the URL. |
||
88 | * @return int Returns 1 if the URL is handled, 0 if it is not, or FALSE if an error occurred. |
||
89 | */ |
||
90 | function handles($url, &$matches = array()){ |
||
0 ignored issues
–
show
|
|||
91 | return preg_match($this->regex_pattern, $url, $matches); |
||
92 | } |
||
93 | |||
94 | /** |
||
95 | * Takes the supplied Vimeo url and attempts to fetch its' data. |
||
96 | * |
||
97 | * @description At present this method supports the following url patterns: |
||
98 | * |
||
99 | * Single video urls |
||
100 | * |
||
101 | * - http(s)://vimeo.com/[VIDEO_ID] |
||
102 | * - http(s)://vimeo.com/album/[ALBUM_ID]/video/[VIDEO_ID] |
||
103 | * - http(s)://vimeo.com/channels/[CHANNEL_ID]/[VIDEO_ID] |
||
104 | * |
||
105 | * User urls |
||
106 | * |
||
107 | * - http(s)://vimeo.com/[USER_ID] |
||
108 | * - http(s)://vimeo.com/[USER_ID]/videos |
||
109 | * |
||
110 | * Album url |
||
111 | * |
||
112 | * - http(s)://vimeo.com/album/[ALBUM_ID] |
||
113 | * |
||
114 | * @param string $url The url to fetch the data for. |
||
115 | * @param int [$page=1] If this is a album or user url the page number could also be supplied. |
||
116 | * @param int [$offset=0] The number of items already retrieved for the query. |
||
117 | * @return array |
||
118 | */ |
||
119 | public function fetch($url, $page = 1, $offset = 0) { |
||
120 | if ($this->handles($url)) { |
||
121 | $matches = array(); |
||
122 | |||
123 | // check if we are dealing with an album |
||
124 | if (preg_match('/vimeo\.com\/album\/(?<id>[0-9]*?)$/i', $url, $matches)) { |
||
125 | // for albums the id is the last part of the url |
||
126 | return $this->fetch_stream("album", $matches["id"], $page, $offset); |
||
127 | } |
||
128 | |||
129 | // check if we are dealing with a channel |
||
130 | if (preg_match('/vimeo\.com\/channels\/(?<id>[a-zA-Z0-9]*?)$/i', $url, $matches)) { |
||
131 | // for albums the id is the last part of the url |
||
132 | return $this->fetch_stream("channel", $matches["id"], $page, $offset); |
||
133 | } |
||
134 | |||
135 | // check if we are dealing with a video |
||
136 | if (preg_match('/vimeo\.com\/(?:.*?\/)?(?<id>[0-9]*?)(?:\/)?$/i', $url, $matches)) { |
||
137 | return $this->fetch_video($matches["id"]); |
||
138 | } |
||
139 | |||
140 | // check if we are dealing with a user url |
||
141 | if (preg_match('/vimeo\.com\/(?<id>[a-zA-Z0-9]*?)(?:\/)?$/i', $url, $matches) || preg_match('/vimeo\.com\/(?<id>[a-zA-Z0-9]*?)\/videos(?:\/)?$/i', $url, $matches)) { |
||
142 | return $this->fetch_stream("user", $matches["id"], $page, $offset); |
||
143 | } |
||
144 | } |
||
145 | return $this->error_response("Unrecognized Vimeo url."); |
||
146 | } |
||
147 | |||
148 | public function fetch_video($id) { |
||
149 | if (!is_numeric($id)) { |
||
150 | return $this->error_response("Invalid video id supplied."); |
||
151 | } |
||
152 | |||
153 | // we have as valid an id as we can hope for until we make the actual request so request it |
||
154 | $url = "https://vimeo.com/api/oembed.json?url=" . urlencode("https://vimeo.com/" . $id); |
||
155 | // get the json object from the supplied url |
||
156 | $json = $this->json_get($url); |
||
157 | |||
158 | // if an error occurred return it |
||
159 | if ($this->is_error($json)) { |
||
160 | return $json; |
||
161 | } |
||
162 | |||
163 | // do basic validation on the parsed object |
||
164 | if (empty($json) || empty($json->thumbnail_url) || empty($json->title)) { |
||
165 | return $this->error_response("No video in response."); |
||
166 | } |
||
167 | |||
168 | $response = array( |
||
169 | "mode" => "single", |
||
170 | "videos" => array() |
||
171 | ); |
||
172 | |||
173 | $response["videos"][] = array( |
||
174 | "provider" => "vimeo", |
||
175 | "id" => $id, |
||
176 | "url" => "https://player.vimeo.com/video/" . $id, |
||
177 | "thumbnail" => $json->thumbnail_url, |
||
178 | "title" => $json->title, |
||
179 | "description" => !empty($json->description) ? $json->description : "" |
||
180 | ); |
||
181 | |||
182 | return $response; |
||
183 | } |
||
184 | |||
185 | public function fetch_stream($type, $id, $page = 1, $offset = 0) { |
||
186 | $supports = array("album", "channel", "user"); |
||
187 | |||
188 | if (empty($type) || !is_string($type) || !in_array($type, $supports)) { |
||
189 | return $this->error_response("Invalid type supplied."); |
||
190 | } |
||
191 | |||
192 | if (empty($id)) { |
||
193 | return $this->error_response("Invalid id supplied."); |
||
194 | } |
||
195 | |||
196 | $access_token = foogallery_settings_get_vimeo_access_token(); |
||
197 | if (empty($access_token)){ |
||
198 | return array( |
||
199 | "mode" => "vimeo", |
||
200 | "access_token" => "" |
||
201 | ); |
||
202 | } |
||
203 | |||
204 | $endpoint = "https://api.vimeo.com/{$type}s/{$id}/videos?page={$page}&fields=uri,name,description,pictures.sizes.width,pictures.sizes.link"; |
||
205 | |||
206 | // get the json object from the supplied url |
||
207 | $json = $this->json_get($endpoint, array( |
||
208 | "headers" => array( |
||
209 | "Authorization" => "Bearer " . $access_token |
||
210 | ) |
||
211 | )); |
||
212 | |||
213 | // if an error occurred return it |
||
214 | if ($this->is_error($json)) { |
||
215 | return $json; |
||
216 | } |
||
217 | |||
218 | // do basic validation on the json object |
||
219 | if (empty($json) || !is_array($json->data)) { |
||
220 | return $this->error_response("Invalid response."); |
||
221 | } |
||
222 | |||
223 | // if we get here we need to build a response to return to the frontend |
||
224 | $response = array( |
||
225 | "mode" => $type, |
||
226 | "id" => $id, |
||
227 | "total" => $json->total, |
||
228 | "offset" => $offset, |
||
229 | "page" => $page, |
||
230 | "nextPage" => 0, |
||
231 | "videos" => array() |
||
232 | ); |
||
233 | |||
234 | $has_valid = false; |
||
235 | // iterate each of the returned videos and add them to the response in our desired format |
||
236 | foreach ($json->data as $video) { |
||
237 | $video_id = $this->get_video_id($video); |
||
238 | $thumbnail = $this->get_video_thumbnail($video); |
||
239 | if (!empty($video_id) && !empty($thumbnail) && !empty($video->name)) { |
||
240 | if (!$has_valid) $has_valid = true; |
||
241 | $response["videos"][] = array( |
||
242 | "provider" => "vimeo", |
||
243 | "id" => $video_id, |
||
244 | "url" => "https://player.vimeo.com/video/" . $video_id, |
||
245 | "thumbnail" => $thumbnail, |
||
246 | "title" => $video->name, |
||
247 | "description" => !empty($video->description) ? $video->description : "" |
||
248 | ); |
||
249 | } |
||
250 | } |
||
251 | |||
252 | if (!$has_valid) { |
||
253 | return $this->error_response("No valid videos in response."); |
||
254 | } |
||
255 | |||
256 | $response["offset"] = $response["offset"] + count($response["videos"]); |
||
257 | if ($response["total"] > $response["offset"]){ |
||
258 | $response["nextPage"] = $response["page"] + 1; |
||
259 | } |
||
260 | |||
261 | return $response; |
||
262 | } |
||
263 | |||
264 | private function get_video_id($video){ |
||
265 | if (!is_object($video) || !is_string($video->uri)) return false; |
||
266 | $exploded = explode("/", $video->uri); |
||
267 | return $exploded[count($exploded) - 1]; |
||
268 | } |
||
269 | |||
270 | private function get_video_thumbnail($video){ |
||
271 | if (!is_object($video) || !is_object($video->pictures) || !is_array($sizes = $video->pictures->sizes)) return false; |
||
272 | $image = false; |
||
273 | foreach ($sizes as $size){ |
||
274 | if ($image == false || $size->width > $image->width ){ |
||
275 | $image = $size; |
||
276 | } |
||
277 | } |
||
278 | if ($image == false || !is_string($image->link)) return false; |
||
279 | return $image->link; |
||
280 | } |
||
281 | } |
||
282 | |||
283 | } |
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.