This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | // Exit if accessed directly |
||
3 | if ( !defined( 'ABSPATH' ) ) |
||
4 | exit; |
||
5 | |||
6 | class TimberQueryIterator implements Iterator { |
||
7 | |||
8 | /** |
||
9 | * |
||
10 | * |
||
11 | * @var WP_Query |
||
12 | */ |
||
13 | private $_query = null; |
||
14 | private $_posts_class = 'TimberPost'; |
||
15 | |||
16 | public function __construct( $query = false, $posts_class = 'TimberPost' ) { |
||
17 | add_action( 'pre_get_posts', array($this, 'fix_number_posts_wp_quirk' )); |
||
18 | if ( $posts_class ) |
||
19 | $this->_posts_class = $posts_class; |
||
20 | |||
21 | if ( is_a( $query, 'WP_Query' ) ) { |
||
22 | // We got a full-fledged WP Query, look no further! |
||
23 | $the_query = $query; |
||
24 | |||
25 | } elseif ( false === $query ) { |
||
26 | // If query is explicitly set to false, use the main loop |
||
27 | global $wp_query; |
||
28 | $the_query =& $wp_query; |
||
29 | //if we're on a custom posts page? |
||
30 | $the_query = self::handle_maybe_custom_posts_page($the_query); |
||
31 | } elseif ( TimberHelper::is_array_assoc( $query ) || ( is_string( $query ) && strstr( $query, '=' ) ) ) { |
||
0 ignored issues
–
show
|
|||
32 | // We have a regularly formed WP query string or array to use |
||
33 | $the_query = new WP_Query( $query ); |
||
34 | |||
35 | } elseif ( is_numeric( $query ) || is_string( $query ) ) { |
||
36 | // We have what could be a post name or post ID to pull out |
||
37 | $the_query = self::get_query_from_string( $query ); |
||
38 | |||
39 | } elseif ( is_array( $query ) && count( $query ) && ( is_integer( $query[0] ) || is_string( $query[0] ) ) ) { |
||
40 | // We have a list of pids (post IDs) to extract from |
||
41 | $the_query = self::get_query_from_array_of_ids( $query ); |
||
42 | } elseif ( is_array($query) && empty($query)) { |
||
43 | // it's an empty array |
||
44 | $the_query = array(); |
||
45 | } else { |
||
46 | TimberHelper::error_log( 'I have failed you! in ' . basename( __FILE__ ) . '::' . __LINE__ ); |
||
47 | TimberHelper::error_log( $query ); |
||
48 | |||
49 | // We have failed hard, at least let get something. |
||
50 | $the_query = new WP_Query(); |
||
51 | } |
||
52 | |||
53 | $this->_query = $the_query; |
||
0 ignored issues
–
show
It seems like
$the_query can also be of type boolean or array . However, the property $_query is declared as type object<WP_Query> . Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
![]() |
|||
54 | |||
55 | } |
||
56 | |||
57 | public function get_posts( $return_collection = false ) { |
||
58 | if (isset($this->_query->posts)){ |
||
59 | $posts = new TimberPostsCollection( $this->_query->posts, $this->_posts_class ); |
||
60 | return ( $return_collection ) ? $posts : $posts->get_posts(); |
||
61 | } |
||
62 | } |
||
63 | |||
64 | // |
||
65 | // GET POSTS |
||
66 | // |
||
67 | public static function get_query_from_array_of_ids( $query = array() ) { |
||
68 | if ( !is_array( $query ) || !count( $query ) ) |
||
69 | return null; |
||
70 | |||
71 | return new WP_Query( array( |
||
72 | 'post_type'=> 'any', |
||
73 | 'ignore_sticky_posts' => true, |
||
74 | 'post__in' => $query, |
||
75 | 'orderby' => 'post__in', |
||
76 | 'nopaging' => true |
||
77 | ) ); |
||
78 | } |
||
79 | |||
80 | public static function get_query_from_string( $string = '' ) { |
||
81 | $post_type = false; |
||
82 | |||
83 | if ( is_string( $string ) && strstr( $string, '#' ) ) { |
||
84 | //we have a post_type directive here |
||
85 | list( $post_type, $string ) = explode( '#', $string ); |
||
86 | } |
||
87 | |||
88 | $query = array( |
||
89 | 'post_type' => ( $post_type ) ? $post_type : 'any' |
||
90 | ); |
||
91 | |||
92 | if ( is_numeric( $string ) ) { |
||
93 | $query['p'] = $string; |
||
94 | |||
95 | } else { |
||
96 | $query['name'] = $string; |
||
97 | } |
||
98 | |||
99 | return new WP_Query( $query ); |
||
100 | } |
||
101 | |||
102 | // |
||
103 | // Iterator Interface |
||
104 | // |
||
105 | |||
106 | public function valid() { |
||
107 | return $this->_query->have_posts(); |
||
108 | } |
||
109 | |||
110 | public function current() { |
||
111 | global $post; |
||
112 | |||
113 | $this->_query->the_post(); |
||
114 | |||
115 | // Sets up the global post, but also return the post, for use in Twig template |
||
116 | $posts_class = $this->_posts_class; |
||
117 | return new $posts_class( $post ); |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * Don't implement next, because current already advances the loop |
||
122 | */ |
||
123 | final public function next() {} |
||
124 | |||
125 | public function rewind() { |
||
126 | $this->_query->rewind_posts(); |
||
127 | } |
||
128 | |||
129 | public function key() { |
||
130 | $this->_query->current_post; |
||
131 | } |
||
132 | |||
133 | //get_posts users numberposts |
||
134 | static function fix_number_posts_wp_quirk( $query ) { |
||
0 ignored issues
–
show
|
|||
135 | if (isset($query->query) && isset($query->query['numberposts']) |
||
136 | && !isset($query->query['posts_per_page'])) { |
||
137 | $query->set( 'posts_per_page', $query->query['numberposts'] ); |
||
138 | } |
||
139 | return $query; |
||
140 | } |
||
141 | |||
142 | /** |
||
143 | * this will test for whether a custom page to display posts is active, and if so, set the query to the default |
||
144 | * @param WP_Query $query the original query recived from WordPress |
||
145 | * @return WP_Query |
||
146 | */ |
||
147 | static function handle_maybe_custom_posts_page( $query ) { |
||
0 ignored issues
–
show
|
|||
148 | if ($custom_posts_page = get_option('page_for_posts')) { |
||
149 | if ( isset($query->query['p']) && $query->query['p'] == $custom_posts_page ) { |
||
150 | return new WP_Query(array('post_type' => 'post')); |
||
151 | } |
||
152 | } |
||
153 | return $query; |
||
154 | } |
||
155 | |||
156 | } |
||
157 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: