GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (217)

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/class-service.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace HM\BackUpWordPress;
4
5
/**
6
 * An abstract service class, individual services should
7
 * extend this class
8
 */
9
abstract class Service {
10
11
	/**
12
	 * Human readable name for this service
13
	 * @var string
14
	 */
15
	public $name;
16
17
	/**
18
	 * The instance Backup_Schedule that this service is
19
	 * is currently working with
20
	 *
21
	 * @var Scheduled_Backup
22
	 */
23
	protected $schedule;
24
25
	public function __construct( Scheduled_Backup $schedule ) {
26
		$this->set_schedule( $schedule );
27
	}
28
29
	/**
30
	 * Used to determine if the service is in use or not
31
	 *
32
	 * @return boolean
33
	 */
34
	abstract public function is_service_active();
35
36
	/**
37
	 * The form to output as part of the schedule settings
38
	 *
39
	 * If you don't want a whole form return ''; here and use @field instead
40
	 *
41
	 * @return string    The raw HTML for the form you want to output
42
	 */
43
	abstract public function form();
44
45
	/**
46
	 * The field to output as part of the schedule settings
47
	 *
48
	 * If you don't want a field return ''; here and use @form instead
49
	 *
50
	 * @return string    The raw HTML for the field you want to output
51
	 */
52
	abstract public function field();
53
54
	/**
55
	 * Help text that should be output in the Constants help tab
56
	 *
57
	 * @return string    The raw HTML for the Constant help text you want to output
0 ignored issues
show
Should the return type not be string|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
58
	 */
59
	public static function constant() {}
60
61
	/**
62
	 * Validate and sanitize data before it's saved.
63
	 *
64
	 * @param  array &$new_data An array or data from $_GET, passed by reference so it can be modified,
65
	 * @param  array $old_data  The old data thats going to be overwritten
66
	 * @return array $error     Array of validation errors e.g. return array( 'email' => 'not valid' );
67
	 */
68
	abstract public function update( &$new_data, $old_data );
69
70
	/**
71
	 * The string to be output as part of the schedule sentence
72
	 *
73
	 * @return string
74
	 */
75
	abstract public function display();
76
77
	/**
78
	 * Receives actions from the backup
79
	 *
80
	 * This is where the service should do it's thing
81
	 *
82
	 * @see  Backup::do_action for a list of the actions
83
	 *
84
	 * @param $action
85
	 * @param Backup $backup
86
	 *
87
	 * @return mixed
88
	 */
89
	public function action( $action, Backup $backup ) {}
90
91
	public function get_slug() {
0 ignored issues
show
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
92
		return sanitize_key( $this->name );
93
	}
94
95
	/**
96
	 * Utility for getting a formated html input name attribute
97
	 *
98
	 * @param  string $name The name of the field
99
	 * @return string       The formated name
100
	 */
101
	protected function get_field_name( $name ) {
102
		return esc_attr( $this->get_slug() . '[' . $name . ']' );
103
	}
104
105
	/**
106
	 * Get the value of a field
107
	 *
108
	 * @param string $name The name of the field
109
	 * @param string $esc  The escaping function that should be used
110
	 * @return string
111
	 */
112
	protected function get_field_value( $name, $esc = 'esc_attr' ) {
113
114
		if ( $name && $this->schedule->get_service_options( $this->get_slug(), $name ) ) {
115
			return $esc( $this->schedule->get_service_options( $this->get_slug(), $name ) );
116
		}
117
118
		return '';
119
120
	}
121
122
	/**
123
	 * Save the settings for this service
124
	 *
125
	 * @return null|array returns null on success, array of errors on failure
126
	 */
127
	public function save() {
128
129
		$classname = $this->get_slug();
130
131
		$old_data = $this->schedule->get_service_options( $classname );
132
133
		$new_data = isset( $_POST[ $classname ] ) ? $_POST[ $classname ] : array();
134
135
		// $new_data is passed by ref, so it is clean after this method call.
136
		$errors = $this->update( $new_data, $old_data );
137
138
		if ( $errors && $errors = array_flip( $errors ) ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $errors of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
139
140
			foreach ( $errors as $error => &$field ) {
141
				$field = $this->get_slug() . '[' . $field . ']';
142
			}
143
144
			return array_flip( $errors );
145
146
		}
147
148
		// Only overwrite settings if they changed
149
		if ( ! empty( $new_data ) ) {
150
			$this->schedule->set_service_options( $classname, $new_data );
151
		}
152
153
		return array();
154
155
	}
156
157
	/**
158
	 * Set the current schedule object
159
	 *
160
	 * @param Scheduled_Backup $schedule An instantiated schedule object
161
	 */
162
	public function set_schedule( Scheduled_Backup $schedule ) {
163
		$this->schedule = $schedule;
164
	}
165
166
	/**
167
	 * Gets the settings for a similar destination from the existing schedules
168
	 * so that we can copy them into the form to avoid having to type them again
169
	 *
170
	 * @return array
171
	 */
172
	protected function fetch_destination_settings() {
173
174
		$service = $this->get_slug();
175
176
		$schedules_obj = Schedules::get_instance();
177
178
		$schedules = $schedules_obj->get_schedules();
179
180
		foreach ( $schedules as $schedule ) {
181
182
			if ( $schedule->get_id() != $this->schedule->get_id() ) {
183
184
				$options = $schedule->get_service_options( $service );
185
186
				if ( ! empty( $options ) ) {
187
					return $options;
188
				}
189
			}
190
		}
191
192
		return array();
193
194
	}
195
196
	/**
197
	 * @return boolean
198
	 */
199
	public function has_form() {
200
201
		ob_start();
202
203
		$this->form();
204
205
		return (bool) ob_get_clean();
206
207
	}
208
209
	/**
210
	 * Handles passing service specific data to Intercom
211
	 */
212
	public static function intercom_data() {}
213
214
	public static function intercom_data_html() {}
215
}
216