jarednova /
timber
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | // Exit if accessed directly |
||
| 3 | if ( !defined( 'ABSPATH' ) ) |
||
| 4 | exit; |
||
| 5 | |||
| 6 | class TimberQueryIterator implements Iterator { |
||
| 7 | |||
| 8 | /** |
||
| 9 | * |
||
| 10 | * |
||
| 11 | * @var WP_Query |
||
| 12 | */ |
||
| 13 | private $_query = null; |
||
| 14 | private $_posts_class = 'TimberPost'; |
||
| 15 | |||
| 16 | public function __construct( $query = false, $posts_class = 'TimberPost' ) { |
||
| 17 | add_action( 'pre_get_posts', array($this, 'fix_number_posts_wp_quirk' )); |
||
| 18 | if ( $posts_class ) |
||
| 19 | $this->_posts_class = $posts_class; |
||
| 20 | |||
| 21 | if ( is_a( $query, 'WP_Query' ) ) { |
||
| 22 | // We got a full-fledged WP Query, look no further! |
||
| 23 | $the_query = $query; |
||
| 24 | |||
| 25 | } elseif ( false === $query ) { |
||
| 26 | // If query is explicitly set to false, use the main loop |
||
| 27 | global $wp_query; |
||
| 28 | $the_query =& $wp_query; |
||
| 29 | //if we're on a custom posts page? |
||
| 30 | $the_query = self::handle_maybe_custom_posts_page($the_query); |
||
| 31 | } elseif ( TimberHelper::is_array_assoc( $query ) || ( is_string( $query ) && strstr( $query, '=' ) ) ) { |
||
|
0 ignored issues
–
show
|
|||
| 32 | // We have a regularly formed WP query string or array to use |
||
| 33 | $the_query = new WP_Query( $query ); |
||
| 34 | |||
| 35 | } elseif ( is_numeric( $query ) || is_string( $query ) ) { |
||
| 36 | // We have what could be a post name or post ID to pull out |
||
| 37 | $the_query = self::get_query_from_string( $query ); |
||
| 38 | |||
| 39 | } elseif ( is_array( $query ) && count( $query ) && ( is_integer( $query[0] ) || is_string( $query[0] ) ) ) { |
||
| 40 | // We have a list of pids (post IDs) to extract from |
||
| 41 | $the_query = self::get_query_from_array_of_ids( $query ); |
||
| 42 | } elseif ( is_array($query) && empty($query)) { |
||
| 43 | // it's an empty array |
||
| 44 | $the_query = array(); |
||
| 45 | } else { |
||
| 46 | TimberHelper::error_log( 'I have failed you! in ' . basename( __FILE__ ) . '::' . __LINE__ ); |
||
| 47 | TimberHelper::error_log( $query ); |
||
| 48 | |||
| 49 | // We have failed hard, at least let get something. |
||
| 50 | $the_query = new WP_Query(); |
||
| 51 | } |
||
| 52 | |||
| 53 | $this->_query = $the_query; |
||
|
0 ignored issues
–
show
It seems like
$the_query can also be of type boolean or array. However, the property $_query is declared as type object<WP_Query>. Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
Loading history...
|
|||
| 54 | |||
| 55 | } |
||
| 56 | |||
| 57 | public function get_posts( $return_collection = false ) { |
||
| 58 | if (isset($this->_query->posts)){ |
||
| 59 | $posts = new TimberPostsCollection( $this->_query->posts, $this->_posts_class ); |
||
| 60 | return ( $return_collection ) ? $posts : $posts->get_posts(); |
||
| 61 | } |
||
| 62 | } |
||
| 63 | |||
| 64 | // |
||
| 65 | // GET POSTS |
||
| 66 | // |
||
| 67 | public static function get_query_from_array_of_ids( $query = array() ) { |
||
| 68 | if ( !is_array( $query ) || !count( $query ) ) |
||
| 69 | return null; |
||
| 70 | |||
| 71 | return new WP_Query( array( |
||
| 72 | 'post_type'=> 'any', |
||
| 73 | 'ignore_sticky_posts' => true, |
||
| 74 | 'post__in' => $query, |
||
| 75 | 'orderby' => 'post__in', |
||
| 76 | 'nopaging' => true |
||
| 77 | ) ); |
||
| 78 | } |
||
| 79 | |||
| 80 | public static function get_query_from_string( $string = '' ) { |
||
| 81 | $post_type = false; |
||
| 82 | |||
| 83 | if ( is_string( $string ) && strstr( $string, '#' ) ) { |
||
| 84 | //we have a post_type directive here |
||
| 85 | list( $post_type, $string ) = explode( '#', $string ); |
||
| 86 | } |
||
| 87 | |||
| 88 | $query = array( |
||
| 89 | 'post_type' => ( $post_type ) ? $post_type : 'any' |
||
| 90 | ); |
||
| 91 | |||
| 92 | if ( is_numeric( $string ) ) { |
||
| 93 | $query['p'] = $string; |
||
| 94 | |||
| 95 | } else { |
||
| 96 | $query['name'] = $string; |
||
| 97 | } |
||
| 98 | |||
| 99 | return new WP_Query( $query ); |
||
| 100 | } |
||
| 101 | |||
| 102 | // |
||
| 103 | // Iterator Interface |
||
| 104 | // |
||
| 105 | |||
| 106 | public function valid() { |
||
| 107 | return $this->_query->have_posts(); |
||
| 108 | } |
||
| 109 | |||
| 110 | public function current() { |
||
| 111 | global $post; |
||
| 112 | |||
| 113 | $this->_query->the_post(); |
||
| 114 | |||
| 115 | // Sets up the global post, but also return the post, for use in Twig template |
||
| 116 | $posts_class = $this->_posts_class; |
||
| 117 | return new $posts_class( $post ); |
||
| 118 | } |
||
| 119 | |||
| 120 | /** |
||
| 121 | * Don't implement next, because current already advances the loop |
||
| 122 | */ |
||
| 123 | final public function next() {} |
||
| 124 | |||
| 125 | public function rewind() { |
||
| 126 | $this->_query->rewind_posts(); |
||
| 127 | } |
||
| 128 | |||
| 129 | public function key() { |
||
| 130 | $this->_query->current_post; |
||
| 131 | } |
||
| 132 | |||
| 133 | //get_posts users numberposts |
||
| 134 | static function fix_number_posts_wp_quirk( $query ) { |
||
|
0 ignored issues
–
show
|
|||
| 135 | if (isset($query->query) && isset($query->query['numberposts']) |
||
| 136 | && !isset($query->query['posts_per_page'])) { |
||
| 137 | $query->set( 'posts_per_page', $query->query['numberposts'] ); |
||
| 138 | } |
||
| 139 | return $query; |
||
| 140 | } |
||
| 141 | |||
| 142 | /** |
||
| 143 | * this will test for whether a custom page to display posts is active, and if so, set the query to the default |
||
| 144 | * @param WP_Query $query the original query recived from WordPress |
||
| 145 | * @return WP_Query |
||
| 146 | */ |
||
| 147 | static function handle_maybe_custom_posts_page( $query ) { |
||
|
0 ignored issues
–
show
|
|||
| 148 | if ($custom_posts_page = get_option('page_for_posts')) { |
||
| 149 | if ( isset($query->query['p']) && $query->query['p'] == $custom_posts_page ) { |
||
| 150 | return new WP_Query(array('post_type' => 'post')); |
||
| 151 | } |
||
| 152 | } |
||
| 153 | return $query; |
||
| 154 | } |
||
| 155 | |||
| 156 | } |
||
| 157 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: