Issues (1282)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/actions.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Front-end Actions
4
 *
5
 * @package     Give
6
 * @subpackage  Functions
7
 * @copyright   Copyright (c) 2016, GiveWP
8
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
9
 * @since       1.0
10
 */
11
12
// Exit if accessed directly.
13
if ( ! defined( 'ABSPATH' ) ) {
14
	exit;
15
}
16
17
Give_Cron::add_monthly_event( 'give_refresh_licenses' );
18
19
/**
20
 * Hooks Give actions, when present in the $_GET superglobal. Every give_action
21
 * present in $_GET is called using WordPress's do_action function. These
22
 * functions are called on init.
23
 *
24
 * @since  1.0
25
 *
26
 * @return void
27
 */
28 View Code Duplication
function give_get_actions() {
0 ignored issues
show
This function seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
29
30
	$get_data = give_clean( $_GET ); // WPCS: input var ok, sanitization ok, CSRF ok.
31
32
	$_get_action = ! empty( $get_data['give_action'] ) ? $get_data['give_action'] : null;
33
34
	// Add backward compatibility to give-action param ( $_GET ).
35
	if ( empty( $_get_action ) ) {
36
		$_get_action = ! empty( $get_data['give-action'] ) ? $get_data['give-action'] : null;
37
	}
38
39
	if ( isset( $_get_action ) ) {
40
		/**
41
		 * Fires in WordPress init or admin init, when give_action is present in $_GET.
42
		 *
43
		 * @since 1.0
44
		 *
45
		 * @param array $_GET Array of HTTP GET variables.
46
		 */
47
		do_action( "give_{$_get_action}", $get_data );
48
	}
49
50
}
51
52
add_action( 'init', 'give_get_actions' );
53
54
/**
55
 * Hooks Give actions, when present in the $_POST super global. Every give_action
56
 * present in $_POST is called using WordPress's do_action function. These
57
 * functions are called on init.
58
 *
59
 * @since  1.0
60
 *
61
 * @return void
62
 */
63 View Code Duplication
function give_post_actions() {
0 ignored issues
show
This function seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
64
65
	$post_data = give_clean( $_POST ); // WPCS: input var ok, sanitization ok, CSRF ok.
66
67
	$_post_action = ! empty( $post_data['give_action'] ) ? $post_data['give_action'] : null;
68
69
	// Add backward compatibility to give-action param ( $_POST ).
70
	if ( empty( $_post_action ) ) {
71
		$_post_action = ! empty( $post_data['give-action'] ) ? $post_data['give-action'] : null;
72
	}
73
74
	if ( isset( $_post_action ) ) {
75
		/**
76
		 * Fires in WordPress init or admin init, when give_action is present in $_POST.
77
		 *
78
		 * @since 1.0
79
		 *
80
		 * @param array $_POST Array of HTTP POST variables.
81
		 */
82
		do_action( "give_{$_post_action}", $post_data );
83
	}
84
85
}
86
87
add_action( 'init', 'give_post_actions' );
88
89
/**
90
 * Connect WordPress user with Donor.
91
 *
92
 * @param  int   $user_id   User ID.
93
 * @param  array $user_data User Data.
94
 *
95
 * @since  1.7
96
 *
97
 * @return void
98
 */
99
function give_connect_donor_to_wpuser( $user_id, $user_data ) {
100
	/* @var Give_Donor $donor */
101
	$donor = new Give_Donor( $user_data['user_email'] );
102
103
	// Validate donor id and check if do nor is already connect to wp user or not.
104
	if ( $donor->id && ! $donor->user_id ) {
105
106
		// Update donor user_id.
107
		if ( $donor->update( array( 'user_id' => $user_id ) ) ) {
108
			$donor_note = sprintf( esc_html__( 'WordPress user #%d is connected to #%d', 'give' ), $user_id, $donor->id );
109
			$donor->add_note( $donor_note );
110
111
			// Update user_id meta in payments.
112
			// if( ! empty( $donor->payment_ids ) && ( $donations = explode( ',', $donor->payment_ids ) ) ) {
113
			// 	foreach ( $donations as $donation  ) {
114
			// 		give_update_meta( $donation, '_give_payment_user_id', $user_id );
115
			// 	}
116
			// }
117
			// Do not need to update user_id in payment because we will get user id from donor id now.
118
		}
119
	}
120
}
121
122
add_action( 'give_insert_user', 'give_connect_donor_to_wpuser', 10, 2 );
123
124
125
/**
126
 * Processing after donor batch export complete
127
 *
128
 * @since 1.8
129
 *
130
 * @param $data
131
 */
132
function give_donor_batch_export_complete( $data ) {
133
	// Remove donor ids cache.
134
	if (
135
		isset( $data['class'] )
136
		&& 'Give_Batch_Donors_Export' === $data['class']
137
		&& ! empty( $data['forms'] )
138
		&& isset( $data['give_export_option']['query_id'] )
139
	) {
140
		Give_Cache::delete( Give_Cache::get_key( $data['give_export_option']['query_id'] ) );
141
	}
142
}
143
144
add_action( 'give_file_export_complete', 'give_donor_batch_export_complete' );
145
146
147
/**
148
 * Set Donation Amount for Multi Level Donation Forms
149
 *
150
 * @param int $form_id Donation Form ID.
151
 *
152
 * @since 1.8.9
153
 *
154
 * @return void
155
 */
156
function give_set_donation_levels_max_min_amount( $form_id ) {
157
	if (
158
		( 'set' === $_POST['_give_price_option'] ) ||
159
		( in_array( '_give_donation_levels', $_POST ) && count( $_POST['_give_donation_levels'] ) <= 0 ) ||
160
		! ( $donation_levels_amounts = wp_list_pluck( $_POST['_give_donation_levels'], '_give_amount' ) )
161
	) {
162
		// Delete old meta.
163
		give_delete_meta( $form_id, '_give_levels_minimum_amount' );
164
		give_delete_meta( $form_id, '_give_levels_maximum_amount' );
165
166
		return;
167
	}
168
169
	// Sanitize donation level amounts.
170
	$donation_levels_amounts = array_map( 'give_maybe_sanitize_amount', $donation_levels_amounts );
171
172
	$min_amount = min( $donation_levels_amounts );
173
	$max_amount = max( $donation_levels_amounts );
174
175
	// Set Minimum and Maximum amount for Multi Level Donation Forms.
176
	give_update_meta( $form_id, '_give_levels_minimum_amount', $min_amount ? give_sanitize_amount_for_db( $min_amount ) : 0 );
177
	give_update_meta( $form_id, '_give_levels_maximum_amount', $max_amount ? give_sanitize_amount_for_db( $max_amount ) : 0 );
178
}
179
180
add_action( 'give_pre_process_give_forms_meta', 'give_set_donation_levels_max_min_amount', 30 );
181
182
183
/**
184
 * Save donor address when donation complete
185
 *
186
 * @since 2.0
187
 *
188
 * @param int $payment_id
189
 */
190
function _give_save_donor_billing_address( $payment_id ) {
191
	$donor_id  = absint( give_get_payment_donor_id( $payment_id ));
192
193
	// Bailout
194
	if ( ! $donor_id ) {
195
		return;
196
	}
197
198
199
	/* @var Give_Donor $donor */
200
	$donor = new Give_Donor( $donor_id );
201
202
	// Save address.
203
	$donor->add_address( 'billing[]', give_get_donation_address( $payment_id ) );
204
}
205
206
add_action( 'give_complete_donation', '_give_save_donor_billing_address', 9999 );
207
208
209
/**
210
 * Update form id in payment logs
211
 *
212
 * @since 2.0
213
 *
214
 * @param array $args
215
 */
216
function give_update_log_form_id( $args ) {
217
	$new_form_id = absint( $args[0] );
218
	$payment_id  = absint( $args[1] );
219
	$logs        = Give()->logs->get_logs( $payment_id );
220
221
	// Bailout.
222
	if ( empty( $logs ) ) {
223
		return;
224
	}
225
226
	/* @var object $log */
227
	foreach ( $logs as $log ) {
228
		Give()->logs->logmeta_db->update_meta( $log->ID, '_give_log_form_id', $new_form_id );
229
	}
230
231
	// Delete cache.
232
	Give()->logs->delete_cache();
233
}
234
235
add_action( 'give_update_log_form_id', 'give_update_log_form_id' );
236
237
/**
238
 * Verify addon dependency before addon update
239
 *
240
 * @since 2.1.4
241
 *
242
 * @param $error
243
 * @param $hook_extra
244
 *
245
 * @return WP_Error
246
 */
247
function __give_verify_addon_dependency_before_update( $error, $hook_extra ) {
248
	// Bailout.
249
	if (
250
		is_wp_error( $error )
251
		|| ! array_key_exists( 'plugin', $hook_extra )
252
	) {
253
		return $error;
254
	}
255
256
	$plugin_base    = strtolower( $hook_extra['plugin'] );
257
	$licensed_addon = array_map( 'strtolower', Give_License::get_licensed_addons() );
258
259
	// Skip if not a Give addon.
260
	if ( ! in_array( $plugin_base, $licensed_addon ) ) {
261
		return $error;
262
	}
263
264
	// Load file.
265
	if( ! class_exists( 'Give_Readme_Parser' ) ) {
266
		require_once GIVE_PLUGIN_DIR . 'includes/class-give-readme-parser.php';
267
	}
268
269
	$plugin_base = strtolower( $plugin_base );
270
	$plugin_slug = str_replace( '.php', '', basename( $plugin_base ) );
271
272
	$url = give_get_addon_readme_url( $plugin_slug );
273
274
	$parser           = new Give_Readme_Parser( $url );
275
	$give_min_version = $parser->requires_at_least();
276
277
278
	if ( version_compare( GIVE_VERSION, $give_min_version, '<' ) ) {
279
		return new WP_Error(
280
			'Give_Addon_Update_Error',
281
			sprintf(
282
				__( 'Give version %s is required to update this add-on.', 'give' ),
283
				$give_min_version
284
			)
285
		);
286
	}
287
288
	return $error;
289
}
290
291
add_filter( 'upgrader_pre_install', '__give_verify_addon_dependency_before_update', 10, 2 );
292
293
/**
294
 * Function to add suppress_filters param if WPML add-on is activated.
295
 *
296
 * @since 2.1.4
297
 *
298
 * @param array WP query argument for Total Goal.
299
 *
300
 * @return array WP query argument for Total Goal.
301
 */
302
function __give_wpml_total_goal_shortcode_agrs( $args ) {
303
	$args['suppress_filters'] = true;
304
305
	return $args;
306
}
307
308
/**
309
 * Function to remove WPML post where filter in goal total amount shortcode.
310
 *
311
 * @since 2.1.4
312
 * @global SitePress $sitepress
313
 */
314
function __give_remove_wpml_parse_query_filter() {
315
	global $sitepress;
316
	remove_action('parse_query', array($sitepress, 'parse_query'));
317
}
318
319
320
/**
321
 * Function to add WPML post where filter in goal total amount shortcode.
322
 *
323
 * @since 2.1.4
324
 * @global SitePress $sitepress
325
 */
326
function __give_add_wpml_parse_query_filter() {
327
	global $sitepress;
328
	add_action('parse_query', array($sitepress, 'parse_query'));
329
}
330
331
/**
332
 * Action all the hook that add support for WPML.
333
 *
334
 * @since 2.1.4
335
 */
336
function give_add_support_for_wpml() {
337
	if ( ! function_exists( 'is_plugin_active' ) ) {
338
		include_once( ABSPATH . 'wp-admin/includes/plugin.php' );
339
	}
340
341
342
	if ( is_plugin_active( 'sitepress-multilingual-cms/sitepress.php' ) ) {
343
344
		add_filter( 'give_totals_goal_shortcode_query_args', '__give_wpml_total_goal_shortcode_agrs' );
345
346
		// @see https://wpml.org/forums/topic/problem-with-query-filter-in-get_posts-function/#post-271309
347
		add_action( 'give_totals_goal_shortcode_before_render', '__give_remove_wpml_parse_query_filter', 99 );
348
		add_action( 'give_totals_goal_shortcode_after_render', '__give_add_wpml_parse_query_filter', 99 );
349
	}
350
}
351
352
add_action( 'give_init', 'give_add_support_for_wpml', 1000 );
353
354
/**
355
 * Backward compatibility for email_access property
356
 * Note: only for internal purpose
357
 *
358
 * @todo: Need to decide when to remove this backward compatibility.
359
 *        We decided to load Give()->email_access on for frontend but some of email tags is still using this. Since we have option to resend email in admin then
360
 *        this cause of fatal error because that property does not load in backend. This is a temporary solution to prevent fatal error when resend receipt.
361
 *        ref: https://github.com/impress-org/give/issues/4068
362
 *
363
 * @since 2.4.5
364
 */
365
function give_set_email_access_property(){
366
	if( ! ( Give()->email_access instanceof Give_Email_Access )  ){
367
		require_once GIVE_PLUGIN_DIR . 'includes/class-give-email-access.php';
368
		Give()->email_access =  new Give_Email_Access();
369
	}
370
}
371
add_action( 'give_email_links', 'give_set_email_access_property', -1 );
372
add_action( 'give_donation-receipt_email_notification', 'give_set_email_access_property', -1 );
373