Issues (1282)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/template-functions.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Template Functions
4
 *
5
 * @package     Give
6
 * @subpackage  Functions/Templates
7
 * @copyright   Copyright (c) 2016, GiveWP
8
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
9
 * @since       1.0
10
 */
11
12
// Exit if accessed directly.
13
if ( ! defined( 'ABSPATH' ) ) {
14
	exit;
15
}
16
17
/**
18
 * Returns the path to the Give templates directory
19
 *
20
 * @since 1.0
21
 * @return string
22
 */
23
function give_get_templates_dir() {
24
	return GIVE_PLUGIN_DIR . 'templates';
25
}
26
27
/**
28
 * Returns the URL to the Give templates directory
29
 *
30
 * @since 1.0
31
 * @return string
32
 */
33
function give_get_templates_url() {
34
	return GIVE_PLUGIN_URL . 'templates';
35
}
36
37
/**
38
 * Get other templates, passing attributes and including the file.
39
 *
40
 * @since 1.6
41
 *
42
 * @param string $template_name Template file name.
43
 * @param array  $args          Passed arguments. Default is empty array().
44
 * @param string $template_path Template file path. Default is empty.
45
 * @param string $default_path  Default path. Default is empty.
46
 */
47
function give_get_template( $template_name, $args = array(), $template_path = '', $default_path = '' ) {
48
	if ( ! empty( $args ) && is_array( $args ) ) {
49
		extract( $args );
50
	}
51
52
	$template_names = "{$template_name}.php";
53
54
	$located = give_get_locate_template( $template_names, $template_path, $default_path );
55
56
	if ( ! file_exists( $located ) ) {
57
		/* translators: %s: the template */
58
		Give_Notices::print_frontend_notice( sprintf( __( 'The %s template was not found.', 'give' ), $located ), true );
59
60
		return;
61
	}
62
63
	// Allow 3rd party plugin filter template file from their plugin.
64
	$located = apply_filters( 'give_get_template', $located, $template_name, $args, $template_path, $default_path );
65
66
	/**
67
	 * Fires in give template, before the file is included.
68
	 *
69
	 * Allows you to execute code before the file is included.
70
	 *
71
	 * @since 1.6
72
	 *
73
	 * @param string $template_name Template file name.
74
	 * @param string $template_path Template file path.
75
	 * @param string $located       Template file filter by 3rd party plugin.
76
	 * @param array  $args          Passed arguments.
77
	 */
78
	do_action( 'give_before_template_part', $template_name, $template_path, $located, $args );
79
80
	include( $located );
81
82
	/**
83
	 * Fires in give template, after the file is included.
84
	 *
85
	 * Allows you to execute code after the file is included.
86
	 *
87
	 * @since 1.6
88
	 *
89
	 * @param string $template_name Template file name.
90
	 * @param string $template_path Template file path.
91
	 * @param string $located       Template file filter by 3rd party plugin.
92
	 * @param array  $args          Passed arguments.
93
	 */
94
	do_action( 'give_after_template_part', $template_name, $template_path, $located, $args );
95
}
96
97
/**
98
 * Retrieves a template part
99
 *
100
 * Taken from bbPress.
101
 *
102
 * @since 1.0
103
 *
104
 * @param string $slug Template part file slug {slug}.php.
105
 * @param string $name Optional. Template part file name {slug}-{name}.php. Default is null.
106
 * @param bool   $load If true the template file will be loaded, if it is found.
107
 *
108
 * @return string
109
 */
110
function give_get_template_part( $slug, $name = null, $load = true ) {
111
112
	/**
113
	 * Fires in give template part, before the template part is retrieved.
114
	 *
115
	 * Allows you to execute code before retrieving the template part.
116
	 *
117
	 * @since 1.0
118
	 *
119
	 * @param string $slug Template part file slug {slug}.php.
120
	 * @param string $name Template part file name {slug}-{name}.php.
121
	 */
122
	do_action( "get_template_part_{$slug}", $slug, $name );
123
124
	// Setup possible parts
125
	$templates = array();
126
	if ( isset( $name ) ) {
127
		$templates[] = $slug . '-' . $name . '.php';
128
	}
129
	$templates[] = $slug . '.php';
130
131
	// Allow template parts to be filtered
132
	$templates = apply_filters( 'give_get_template_part', $templates, $slug, $name );
133
134
	// Return the part that is found
135
	return give_locate_template( $templates, $load, false );
136
}
137
138
/**
139
 * Retrieve the name of the highest priority template file that exists.
140
 *
141
 * Searches in the STYLESHEETPATH before TEMPLATEPATH so that themes which
142
 * inherit from a parent theme can just overload one file. If the template is
143
 * not found in either of those, it looks in the theme-compat folder last.
144
 *
145
 * Forked from bbPress
146
 *
147
 * @since 1.0
148
 *
149
 * @param string|array $template_names Template file(s) to search for, in order.
150
 * @param bool         $load           If true the template file will be loaded if it is found.
151
 * @param bool         $require_once   Whether to require_once or require. Default true.
152
 *                                     Has no effect if $load is false.
153
 *
154
 * @return string The template filename if one is located.
155
 */
156
function give_locate_template( $template_names, $load = false, $require_once = true ) {
157
	// No file found yet
158
	$located = false;
159
160
	$theme_template_paths = give_get_theme_template_paths();
161
162
	// Try to find a template file
163
	foreach ( (array) $template_names as $template_name ) {
164
165
		// Continue if template is empty
166
		if ( empty( $template_name ) ) {
167
			continue;
168
		}
169
170
		// Trim off any slashes from the template name
171
		$template_name = ltrim( $template_name, '/' );
172
173
		// try locating this template file by looping through the template paths
174
		foreach ( $theme_template_paths as $template_path ) {
175
176
			if ( file_exists( $template_path . $template_name ) ) {
177
				$located = $template_path . $template_name;
178
				break;
179
			}
180
		}
181
182
		if ( $located ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $located of type string|false is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
183
			break;
184
		}
185
	}
186
187
	if ( ( true == $load ) && ! empty( $located ) ) {
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
188
		load_template( $located, $require_once );
189
	}
190
191
	return $located;
192
}
193
194
/**
195
 * Locate a template and return the path for inclusion.
196
 *
197
 * This is the load order:
198
 *
199
 *        yourtheme        /    $template_path    /    $template_name
200
 *        yourtheme        /    $template_name
201
 *        $default_path    /    $template_name
202
 *
203
 * @since  2.0.3
204
 * @access public
205
 *
206
 * @param string $template_name
207
 * @param string $template_path (default: '')
208
 * @param string $default_path  (default: '')
209
 *
210
 * @return string
211
 */
212
function give_get_locate_template( $template_name, $template_path = '', $default_path = '' ) {
213
	if ( ! $template_path ) {
214
		$template_path = give_get_theme_template_dir_name() . '/';
215
	}
216
217
	if ( ! $default_path ) {
218
		$default_path = GIVE_PLUGIN_DIR . 'templates/';
219
	}
220
221
	// Look within passed path within the theme - this is priority.
222
	$template = locate_template(
223
		array(
224
			trailingslashit( $template_path ) . $template_name,
225
			$template_name,
226
		)
227
	);
228
229
	// Get default template/
230
	if ( ! $template ) {
231
		$template = $default_path . $template_name;
232
	}
233
234
	/**
235
	 * Filter the template
236
	 *
237
	 * @since 2.0.3
238
	 */
239
	return apply_filters( 'give_get_locate_template', $template, $template_name, $template_path );
240
}
241
242
/**
243
 * Returns a list of paths to check for template locations
244
 *
245
 * @since 1.0
246
 * @return array
247
 */
248
function give_get_theme_template_paths() {
249
250
	$template_dir = give_get_theme_template_dir_name();
251
252
	$file_paths = array(
253
		1   => trailingslashit( get_stylesheet_directory() ) . $template_dir,
254
		10  => trailingslashit( get_template_directory() ) . $template_dir,
255
		100 => give_get_templates_dir(),
256
	);
257
258
	$file_paths = apply_filters( 'give_template_paths', $file_paths );
259
260
	// sort the file paths based on priority
261
	ksort( $file_paths, SORT_NUMERIC );
262
263
	return array_map( 'trailingslashit', $file_paths );
264
}
265
266
/**
267
 * Returns the template directory name.
268
 *
269
 * Themes can filter this by using the give_templates_dir filter.
270
 *
271
 * @since 1.0
272
 * @return string
273
 */
274
function give_get_theme_template_dir_name() {
275
	return trailingslashit( apply_filters( 'give_templates_dir', 'give' ) );
276
}
277
278
/**
279
 * Adds Give Version to the <head> tag
280
 *
281
 * @since 1.0
282
 * @return void
283
 */
284
function give_version_in_header() {
285
	echo '<meta name="generator" content="Give v' . GIVE_VERSION . '" />' . "\n";
286
}
287
288
add_action( 'wp_head', 'give_version_in_header' );
289
290
/**
291
 * Determines if we're currently on the Donations History page.
292
 *
293
 * @since 1.0
294
 * @return bool True if on the Donations History page, false otherwise.
295
 */
296
function give_is_donation_history_page() {
297
298
	$ret = is_page( give_get_option( 'history_page' ) );
299
300
	return apply_filters( 'give_is_donation_history_page', $ret );
301
}
302
303
/**
304
 * Adds body classes for Give pages
305
 *
306
 * @since 1.0
307
 *
308
 * @param array $class current classes
309
 *
310
 * @return array Modified array of classes
311
 */
312
function give_add_body_classes( $class ) {
313
	$classes = (array) $class;
314
315
	if ( give_is_success_page() ) {
316
		$classes[] = 'give-success';
317
		$classes[] = 'give-page';
318
	}
319
320
	if ( give_is_failed_transaction_page() ) {
321
		$classes[] = 'give-failed-transaction';
322
		$classes[] = 'give-page';
323
	}
324
325
	if ( give_is_donation_history_page() ) {
326
		$classes[] = 'give-donation-history';
327
		$classes[] = 'give-page';
328
	}
329
330
	if ( give_is_test_mode() ) {
331
		$classes[] = 'give-test-mode';
332
		$classes[] = 'give-page';
333
	}
334
335
	// Theme-specific Classes used to prevent conflicts via CSS
336
	/* @var WP_Theme $current_theme */
337
	$current_theme = wp_get_theme();
338
339
	switch ( $current_theme->get_template() ) {
340
341
		case 'Divi':
342
			$classes[] = 'give-divi';
343
			break;
344
		case 'Avada':
345
			$classes[] = 'give-avada';
346
			break;
347
		case 'twentysixteen':
348
			$classes[] = 'give-twentysixteen';
349
			break;
350
		case 'twentyseventeen':
351
			$classes[] = 'give-twentyseventeen';
352
			break;
353
		case 'twentynineteen':
354
			$classes[] = 'give-twentynineteen';
355
			break;
356
357
	}
358
359
	return array_unique( $classes );
360
}
361
362
add_filter( 'body_class', 'give_add_body_classes' );
363
364
365
/**
366
 * Add Post Class Filter
367
 *
368
 * Adds extra post classes for forms
369
 *
370
 * @since       1.0
371
 *
372
 * @param array        $classes
373
 * @param string|array $class
374
 * @param int|string   $post_id
375
 *
376
 * @return array
377
 */
378
function give_add_post_class( $classes, $class = '', $post_id = '' ) {
0 ignored issues
show
The parameter $class is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
379
	if ( ! $post_id || 'give_forms' !== get_post_type( $post_id ) ) {
380
		return $classes;
381
	}
382
383
	//@TODO: Add classes for custom taxonomy and form configurations (multi vs single donations, etc).
384
385
	if ( false !== ( $key = array_search( 'hentry', $classes ) ) ) {
386
		unset( $classes[ $key ] );
387
	}
388
389
	return $classes;
390
}
391
392
393
add_filter( 'post_class', 'give_add_post_class', 20, 3 );
394
395
/**
396
 * Get the placeholder image URL for forms etc
397
 *
398
 * @access public
399
 * @return string
400
 */
401
function give_get_placeholder_img_src() {
402
403
	$placeholder_url = '//placehold.it/600x600&text=' . urlencode( esc_attr__( 'Give Placeholder Image', 'give' ) );
404
405
	return apply_filters( 'give_placeholder_img_src', $placeholder_url );
406
}
407
408
409
/**
410
 * Global
411
 */
412
if ( ! function_exists( 'give_output_content_wrapper' ) ) {
413
414
	/**
415
	 * Output the start of the page wrapper.
416
	 */
417
	function give_output_content_wrapper() {
418
		give_get_template_part( 'global/wrapper-start' );
419
	}
420
}
421
if ( ! function_exists( 'give_output_content_wrapper_end' ) ) {
422
423
	/**
424
	 * Output the end of the page wrapper.
425
	 */
426
	function give_output_content_wrapper_end() {
427
		give_get_template_part( 'global/wrapper-end' );
428
	}
429
}
430
431
/**
432
 * Single Give Form
433
 */
434
if ( ! function_exists( 'give_left_sidebar_pre_wrap' ) ) {
435
	function give_left_sidebar_pre_wrap() {
436
		echo apply_filters( 'give_left_sidebar_pre_wrap', '<div id="give-sidebar-left" class="give-sidebar give-single-form-sidebar-left">' );
437
	}
438
}
439
440
if ( ! function_exists( 'give_left_sidebar_post_wrap' ) ) {
441
	function give_left_sidebar_post_wrap() {
442
		echo apply_filters( 'give_left_sidebar_post_wrap', '</div>' );
443
	}
444
}
445
446
if ( ! function_exists( 'give_get_forms_sidebar' ) ) {
447
	function give_get_forms_sidebar() {
448
		give_get_template_part( 'single-give-form/sidebar' );
449
	}
450
}
451
452
if ( ! function_exists( 'give_show_form_images' ) ) {
453
454
	/**
455
	 * Output the donation form featured image.
456
	 */
457
	function give_show_form_images() {
458
		if ( give_is_setting_enabled( give_get_option( 'form_featured_img' ) ) ) {
459
			give_get_template_part( 'single-give-form/featured-image' );
460
		}
461
	}
462
}
463
464
if ( ! function_exists( 'give_template_single_title' ) ) {
465
466
	/**
467
	 * Output the form title.
468
	 */
469
	function give_template_single_title() {
470
		give_get_template_part( 'single-give-form/title' );
471
	}
472
}
473
474
/**
475
 * Conditional Functions
476
 */
477
478
if ( ! function_exists( 'is_give_form' ) ) {
479
480
	/**
481
	 * is_give_form
482
	 *
483
	 * Returns true when viewing a single form.
484
	 *
485
	 * @since 1.6
486
	 *
487
	 * @return bool
488
	 */
489
	function is_give_form() {
490
		return is_singular( array( 'give_form' ) );
491
	}
492
}
493
494
if ( ! function_exists( 'is_give_category' ) ) {
495
496
	/**
497
	 * is_give_category
498
	 *
499
	 * Returns true when viewing give form category archive.
500
	 *
501
	 * @since 1.6
502
	 *
503
	 * @param string $term The term slug your checking for.
504
	 *                     Leave blank to return true on any.
505
	 *                     Default is blank.
506
	 *
507
	 * @return bool
508
	 */
509
	function is_give_category( $term = '' ) {
510
		return is_tax( 'give_forms_category', $term );
511
	}
512
}
513
514
if ( ! function_exists( 'is_give_tag' ) ) {
515
516
	/**
517
	 * is_give_tag
518
	 *
519
	 * Returns true when viewing give form tag archive.
520
	 *
521
	 * @since 1.6
522
	 *
523
	 * @param string $term The term slug your checking for.
524
	 *                     Leave blank to return true on any.
525
	 *                     Default is blank.
526
	 *
527
	 * @return bool
528
	 */
529
	function is_give_tag( $term = '' ) {
530
		return is_tax( 'give_forms_tag', $term );
531
	}
532
}
533
534
if ( ! function_exists( 'is_give_taxonomy' ) ) {
535
536
	/**
537
	 * is_give_taxonomy
538
	 *
539
	 * Returns true when viewing a give form taxonomy archive.
540
	 *
541
	 * @since 1.6
542
	 *
543
	 * @return bool
544
	 */
545
	function is_give_taxonomy() {
546
		return is_tax( get_object_taxonomies( 'give_form' ) );
547
	}
548
}
549