Issues (1282)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/currency-functions.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Currency Functions
4
 *
5
 * @package     Give
6
 * @subpackage  Functions
7
 * @copyright   Copyright (c) 2017, GiveWP
8
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
9
 * @since       1.8.17
10
 */
11
12
/**
13
 * Get the set currency
14
 *
15
 * @since 1.0
16
 * @since 1.8.15 Upgrade function to handle dynamic currency
17
 *
18
 * @param int          $donation_or_form_id Donation or Form ID
19
 * @param array|object $args                Additional data
20
 *
21
 * @return string The currency code
22
 */
23
function give_get_currency( $donation_or_form_id = null, $args = array() ) {
24
25
	// Get currency from donation
26
	if ( is_numeric( $donation_or_form_id ) && 'give_payment' === get_post_type( $donation_or_form_id ) ) {
27
		$currency = give_get_meta( $donation_or_form_id, '_give_payment_currency', true );
28
29
		if ( empty( $currency ) ) {
30
			$currency = give_get_option( 'currency', 'USD' );
31
		}
32
	} else {
33
		$currency = give_get_option( 'currency', 'USD' );
34
	}
35
36
	/**
37
	 * Filter the currency on basis of donation, form id, or additional data.
38
	 *
39
	 * @since 1.0
40
	 */
41
	return apply_filters( 'give_currency', $currency, $donation_or_form_id, $args );
42
}
43
44
/**
45
 * Get the set currency position
46
 *
47
 * @since 1.3.6
48
 *
49
 * @return string The currency code
50
 */
51
function give_get_currency_position() {
52
53
	$currency_pos = give_get_option( 'currency_position', 'before' );
54
55
	return apply_filters( 'give_currency_position', $currency_pos );
56
}
57
58
/**
59
 * Get Currencies List
60
 *
61
 * @since 1.8.17
62
 *
63
 * @return array $currencies A list of the available currencies
64
 */
65
function give_get_currencies_list() {
66
	$currencies = Give_Cache_Setting::get_option( 'currencies' );
67
68
	/**
69
	 * Filter the currencies
70
	 * Note: you can register new currency by using this filter
71
	 * array(
72
	 *     'admin_label' => '',  // required
73
	 *     'symbol'      => '',  // required
74
	 *     'setting'     => ''   // required
75
	 *     ....
76
	 * )
77
	 *
78
	 * @since 1.8.15
79
	 *
80
	 * @param array $currencies
81
	 */
82
	return (array) apply_filters( 'give_currencies', $currencies );
83
}
84
85
/**
86
 * Get Currencies
87
 *
88
 * @since 1.0
89
 *
90
 * @param string $info Specify currency info
91
 *
92
 * @return array $currencies A list of the available currencies
93
 */
94
function give_get_currencies( $info = 'admin_label' ) {
95
96
	$currencies = give_get_currencies_list();
97
98
	// Backward compatibility: handle old way of currency registration.
99
	// Backward compatibility: Return desired result.
100
	if ( ! empty( $currencies ) ) {
101
		foreach ( $currencies as $currency_code => $currency_setting ) {
102
			if ( is_string( $currency_setting ) ) {
103
				$currencies[ $currency_code ] = array(
104
					'admin_label' => $currency_setting,
105
				);
106
			}
107
108
			$currencies[ $currency_code ] = wp_parse_args(
109
				$currencies[ $currency_code ],
110
				array(
111
					'admin_label' => '',
112
					'symbol'      => $currency_code,
113
					'setting'     => array(),
114
				)
115
			);
116
		}
117
118
		if ( ! empty( $info ) && is_string( $info ) && 'all' !== $info ) {
119
			$currencies = wp_list_pluck( $currencies, $info );
120
		}
121
	}
122
123
	return $currencies;
124
}
125
126
127
/**
128
 * Get all currency symbols
129
 *
130
 * @since 1.8.14
131
 *
132
 * @param bool $decode_currencies
133
 *
134
 * @return array
135
 */
136
function give_currency_symbols( $decode_currencies = false ) {
137
	$currencies = give_get_currencies( 'symbol' );
138
139
	if ( $decode_currencies ) {
140
		array_walk( $currencies, function ( &$currency_symbol ) {
141
			$currency_symbol = html_entity_decode( $currency_symbol, ENT_COMPAT, 'UTF-8' );
142
		} );
143
	}
144
145
	/**
146
	 * Filter the currency symbols
147
	 *
148
	 * @since 1.8.14
149
	 *
150
	 * @param array $currencies
151
	 */
152
	return apply_filters( 'give_currency_symbols', $currencies );
153
}
154
155
156
/**
157
 * Give Currency Symbol
158
 *
159
 * Given a currency determine the symbol to use. If no currency given, site default is used. If no symbol is determine,
160
 * the currency string is returned.
161
 *
162
 * @since      1.0
163
 *
164
 * @param  string $currency        The currency string.
165
 * @param  bool   $decode_currency Option to HTML decode the currency symbol.
166
 *
167
 * @return string           The symbol to use for the currency
168
 */
169 View Code Duplication
function give_currency_symbol( $currency = '', $decode_currency = false ) {
0 ignored issues
show
This function seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
170
171
	if ( empty( $currency ) ) {
172
		$currency = give_get_currency();
173
	}
174
175
	$currencies = give_currency_symbols( $decode_currency );
176
	$symbol     = array_key_exists( $currency, $currencies ) ? $currencies[ $currency ] : $currency;
177
178
	/**
179
	 * Filter the currency symbol
180
	 *
181
	 * @since 1.0
182
	 *
183
	 * @param string $symbol
184
	 * @param string $currency
185
	 */
186
	return apply_filters( 'give_currency_symbol', $symbol, $currency );
187
}
188
189
190
/**
191
 * Get currency name.
192
 *
193
 * @since 1.8.8
194
 *
195
 * @param string $currency_code
196
 *
197
 * @return string
198
 */
199
function give_get_currency_name( $currency_code ) {
200
	$currency_name  = '';
201
	$currency_names = give_get_currencies();
202
203
	if ( $currency_code && array_key_exists( $currency_code, $currency_names ) ) {
204
		$currency_name = explode( '(', $currency_names[ $currency_code ] );
205
		$currency_name = trim( current( $currency_name ) );
206
	}
207
208
	/**
209
	 * Filter the currency name
210
	 *
211
	 * @since 1.8.8
212
	 *
213
	 * @param string $currency_name
214
	 * @param string $currency_code
215
	 */
216
	return apply_filters( 'give_currency_name', $currency_name, $currency_code );
217
}
218
219
/**
220
 * Formats the currency displayed.
221
 *
222
 * @since 1.0
223
 *
224
 * @param string $price The donation amount.
225
 * @param array  $args  It accepts 'currency_code', 'decode_currency' and 'form_id'.
226
 *
227
 * @return mixed|string
228
 */
229
function give_currency_filter( $price = '', $args = array() ) {
230
231
	// Get functions arguments.
232
	$func_args = func_get_args();
233
234
	// Backward compatibility: modify second param to array
235
	if ( isset( $func_args[1] ) && is_string( $func_args[1] ) ) {
236
		$args = array(
237
			'currency_code'   => isset( $func_args[1] ) ? $func_args[1] : '',
238
			'decode_currency' => isset( $func_args[2] ) ? $func_args[2] : false,
239
			'form_id'         => isset( $func_args[3] ) ? $func_args[3] : '',
240
		);
241
242
		give_doing_it_wrong( __FUNCTION__, 'Pass second argument as Array.', GIVE_VERSION );
243
	}
244
245
	// Set default values.
246
	$args = wp_parse_args(
247
		$args,
248
		array(
249
			'currency_code'   => '',
250
			'decode_currency' => false,
251
			'form_id'         => '',
252
		)
253
	);
254
255
	if ( empty( $args['currency_code'] ) || ! array_key_exists( (string) $args['currency_code'], give_get_currencies() ) ) {
256
		$args['currency_code'] = give_get_currency( $args['form_id'] );
257
	}
258
259
	$args['position'] = give_get_option( 'currency_position', 'before' );
260
261
	$negative = $price < 0;
262
263
	if ( $negative ) {
264
		// Remove proceeding "-".
265
		$price = substr( $price, 1 );
266
	}
267
268
	$args['symbol'] = give_currency_symbol( $args['currency_code'], $args['decode_currency'] );
269
270
	switch ( $args['currency_code'] ) :
271
		case 'GBP' :
272
		case 'BRL' :
273
		case 'EUR' :
274
		case 'USD' :
275
		case 'AUD' :
276
		case 'CAD' :
277
		case 'HKD' :
278
		case 'MXN' :
279
		case 'NZD' :
280
		case 'SGD' :
281
		case 'JPY' :
282
		case 'THB' :
283
		case 'INR' :
284
		case 'IDR' :
285
		case 'IRR' :
286
		case 'TRY' :
287
		case 'RUB' :
288
		case 'SEK' :
289
		case 'PLN' :
290
		case 'PHP' :
291
		case 'TWD' :
292
		case 'MYR' :
293
		case 'CZK' :
294
		case 'DKK' :
295
		case 'HUF' :
296
		case 'ILS' :
297
		case 'MAD' :
298
		case 'KRW' :
299 View Code Duplication
		case 'ZAR' :
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
300
			$formatted = ( 'before' === $args['position'] ? $args['symbol'] . $price : $price . $args['symbol'] );
301
			break;
302 View Code Duplication
		case 'NOK':
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
303
			$formatted = ( 'before' === $args['position'] ? $args['symbol'] . ' ' . $price : $price . ' ' . $args['symbol'] );
304
			break;
305 View Code Duplication
		default:
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
306
			$formatted = ( 'before' === $args['position'] ? $args['symbol'] . ' ' . $price : $price . ' ' . $args['symbol'] );
307
			break;
308
	endswitch;
309
310
	/**
311
	 * Filter formatted amount
312
	 *
313
	 * @since 1.8.17
314
	 */
315
	$formatted = apply_filters( 'give_currency_filter', $formatted, $args, $price );
316
317
	/**
318
	 * Filter formatted amount with currency
319
	 *
320
	 * Filter name depends upon current value of currency and currency position.
321
	 * For example :
322
	 *           if currency is USD and currency position is before then
323
	 *           filter name will be give_usd_currency_filter_before
324
	 *
325
	 *           and if currency is USD and currency position is after then
326
	 *           filter name will be give_usd_currency_filter_after
327
	 */
328
	$formatted = apply_filters(
329
		'give_' . strtolower( $args['currency_code'] ) . "_currency_filter_{$args['position']}",
330
		$formatted,
331
		$args['currency_code'],
332
		$price,
333
		$args
334
	);
335
336
	if ( $negative ) {
337
		// Prepend the minus sign before the currency sign.
338
		$formatted = '-' . $formatted;
339
	}
340
341
	return $formatted;
342
}
343
344
/**
345
 * This function is used to fetch list of zero based currencies.
346
 *
347
 * @since 2.3.0
348
 *
349
 * @return array
350
 */
351
function give_get_zero_based_currencies() {
352
353
	$zero_based_currencies = array(
354
		'JPY', // Japanese Yen.
355
		'KRW', // South Korean Won.
356
		'CLP', // Chilean peso.
357
		'ISK', // Icelandic króna.
358
		'BIF', // Burundian franc.
359
		'DJF', // Djiboutian franc.
360
		'GNF', // Guinean franc.
361
		'KHR', // Cambodian riel.
362
		'KPW', // North Korean won.
363
		'LAK', // Lao kip.
364
		'LKR', // Sri Lankan rupee.
365
		'MGA', // Malagasy ariary.
366
		'MZN', // Mozambican metical.
367
		'VUV', // Vanuatu vatu.
368
	);
369
370
	/**
371
	 * This filter hook can be used to update the list of zero based currencies.
372
	 *
373
	 * @since 2.3.0
374
	 */
375
	return apply_filters( 'give_get_zero_based_currencies', $zero_based_currencies );
376
}
377
378
/**
379
 * Zero Decimal based Currency.
380
 *
381
 * @since 1.8.14
382
 * @since 2.2.0 Modified list.
383
 * @see   https://github.com/impress-org/give/issues/2191
384
 *
385
 * @param string $currency Currency code
386
 *
387
 * @return bool
388
 */
389
function give_is_zero_based_currency( $currency = '' ) {
390
391
	$zero_based_currency = give_get_zero_based_currencies();
392
393
	// Set default currency.
394
	if ( empty( $currency ) ) {
395
		$currency = give_get_currency();
396
	}
397
398
	// Check for Zero Based Currency.
399
	if ( in_array( $currency, $zero_based_currency ) ) {
400
		return true;
401
	}
402
403
	return false;
404
}
405
406
407
/**
408
 * Check if currency support right to left direction or not.
409
 *
410
 * @param string $currency
411
 *
412
 * @return bool
413
 */
414
function give_is_right_to_left_supported_currency( $currency = '' ) {
415
	$zero_based_currency = apply_filters(
416
		'give_right_to_left_supported_currency',
417
		array(
418
			'IRR',
419
			'RIAL',
420
			'MAD',
421
			'AED',
422
			'BHD',
423
			'KWD',
424
			'OMR',
425
			'SAR',
426
			'TND', //https://en.wikipedia.org/wiki/Tunisian_dinar
427
			'QAR', //https://en.wikipedia.org/wiki/Qatari_riyal
428
			'LYD', //https://en.wikipedia.org/wiki/Libyan_dinar
429
			'LBP', //https://en.wikipedia.org/wiki/Lebanese_pound
430
			'IRT', //https://en.wikipedia.org/wiki/Iranian_toman
431
			'IQD', //https://en.wikipedia.org/wiki/Iraqi_dinar
432
			'DZD', //https://en.wikipedia.org/wiki/Algerian_dinar
433
			'AFN', //https://en.wikipedia.org/wiki/Afghan_afghani
434
		)
435
	);
436
437
	// Set default currency.
438
	if ( empty( $currency ) ) {
439
		$currency = give_get_currency();
440
	}
441
442
	// Check for Zero Based Currency.
443
	if ( in_array( $currency, $zero_based_currency ) ) {
444
		return true;
445
	}
446
447
	return false;
448
}
449