Issues (311)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/timber-term.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Terms: WordPress has got 'em, you want 'em. Categories. Tags. Custom Taxonomies. You don't care, you're a fiend. Well let's get this under control
4
 * @example
5
 * ```php
6
 * //Get a term by its ID
7
 * $context['term'] = new TimberTerm(6);
8
 * //Get a term when on a term archive page
9
 * $context['term_page'] = new TimberTerm();
10
 * //Get a term with a slug
11
 * $context['team'] = new TimberTerm('patriots');
12
 * //Get a team with a slug from a specific taxonomy
13
 * $context['st_louis'] = new TimberTerm('cardinals', 'baseball');
14
 * Timber::render('index.twig', $context);
15
 * ```
16
 * ```twig
17
 * <h2>{{term_page.name}} Archives</h2>
18
 * <h3>Teams</h3>
19
 * <ul>
20
 *     <li>{{st_louis.name}} - {{st_louis.description}}</li>
21
 *     <li>{{team.name}} - {{team.description}}</li>
22
 * </ul>
23
 * ```
24
 * ```html
25
 * <h2>Team Archives</h2>
26
 * <h3>Teams</h3>
27
 * <ul>
28
 *     <li>St. Louis Cardinals - Winner of 11 World Series</li>
29
 *     <li>New England Patriots - Winner of 4 Super Bowls</li>
30
 * </ul>
31
 * ```
32
 */
33
class TimberTerm extends TimberCore implements TimberCoreInterface {
34
35
	public $PostClass = 'TimberPost';
36
	public $TermClass = 'TimberTerm';
37
38
	public $object_type = 'term';
39
	public static $representation = 'term';
40
41
	public $_children;
42
	/**
43
	 * @api
44
	 * @var string the human-friendly name of the term (ex: French Cuisine)
45
	 */
46
	public $name;
47
	/**
48
	 * @api
49
	 * @var strng the WordPress taxonomy slug (ex: `post_tag` or `actors`)
50
	 */
51
	public $taxonomy;
52
53
	/**
54
	 * @param int $tid
55
	 * @param string $tax
56
	 */
57
	public function __construct( $tid = null, $tax = '' ) {
58
		if ($tid === null) {
59
			$tid = $this->get_term_from_query();
60
		}
61
		if (strlen($tax)) {
62
			$this->taxonomy = $tax;
0 ignored issues
show
Documentation Bug introduced by
It seems like $tax of type string is incompatible with the declared type object<strng> of property $taxonomy.

Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.

Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..

Loading history...
63
		}
64
		$this->init($tid);
65
	}
66
67
	/**
68
	 * @return string
69
	 */
70
	public function __toString() {
71
		return $this->name;
72
	}
73
74
	/**
75
	 * @param $tid
76
	 * @param $taxonomy
77
	 *
78
	 * @return static
79
	 */
80
	public static function from( $tid, $taxonomy ) {
81
		return new static($tid, $taxonomy);
82
	}
83
84
85
	/* Setup
86
	===================== */
87
88
	/**
89
	 * @internal
90
	 * @return integer
91
	 */
92
	protected function get_term_from_query() {
93
		global $wp_query;
94
		if ( isset($wp_query->queried_object) ) {
95
			$qo = $wp_query->queried_object;
96
			if (isset($qo->term_id)) {
97
				return $qo->term_id;
98
			}
99
		}
100
		if ( isset($wp_query->tax_query->queries[0]['terms'][0]) ) {
101
			return $wp_query->tax_query->queries[0]['terms'][0];
102
		}
103
	}
104
105
	/**
106
	 * @internal
107
	 * @param int $tid
108
	 */
109
	protected function init( $tid ) {
110
		$term = $this->get_term($tid);
111
		if ( isset($term->id) ) {
112
			$term->ID = $term->id;
113
		} else if ( isset($term->term_id) ) {
114
			$term->ID = $term->term_id;
115
		} else if ( is_string($tid) ) {
116
			//echo 'bad call using '.$tid;
117
			//TimberHelper::error_log(debug_backtrace());
118
		}
119
		if ( isset($term->ID) ){
120
			$term->id = $term->ID;
121
			$this->import($term);
122
			if ( isset($term->term_id) ) {
123
				$custom = $this->get_term_meta($term->term_id);
124
				$this->import($custom);
125
			}
126
		}
127
	}
128
129
	/**
130
	 * @internal
131
	 * @param int $tid
132
	 * @return array
133
	 */
134
	protected function get_term_meta($tid) {
135
		$customs = array();
136
		$customs = apply_filters('timber_term_get_meta', $customs, $tid, $this);
137
		return apply_filters('timber/term/meta', $customs, $tid, $this);
138
	}
139
140
	/**
141
	 * @internal
142
	 * @param int $tid
143
	 * @return mixed
144
	 */
145
	protected function get_term( $tid ) {
146
		if ( is_object($tid) || is_array($tid) ) {
147
			return $tid;
148
		}
149
		$tid = self::get_tid($tid);
150
151
		if ( isset($this->taxonomy) && strlen($this->taxonomy) ) {
152
			return get_term($tid, $this->taxonomy);
153
		} else {
154
			global $wpdb;
155
			$query = $wpdb->prepare("SELECT taxonomy FROM $wpdb->term_taxonomy WHERE term_id = %d LIMIT 1", $tid);
156
			$tax = $wpdb->get_var($query);
157
			if (isset($tax) && strlen($tax)) {
158
				$this->taxonomy = $tax;
159
				return get_term($tid, $tax);
160
			}
161
		}
162
		return null;
163
	}
164
165
	/**
166
	 * @internal
167
	 * @param int $tid
168
	 * @return int
169
	 */
170
	protected function get_tid( $tid ) {
171
		global $wpdb;
172
		if ( is_numeric($tid) ) {
173
			return $tid;
174
		}
175
		if ( gettype($tid) == 'object' ) {
176
			$tid = $tid->term_id;
177
		}
178
		if ( is_numeric($tid) ) {
179
			$query = $wpdb->prepare("SELECT * FROM $wpdb->terms WHERE term_id = %d", $tid);
180
		} else {
181
			$query = $wpdb->prepare("SELECT * FROM $wpdb->terms WHERE slug = %s", $tid);
182
		}
183
		$result = $wpdb->get_row($query);
184
		if ( isset($result->term_id) ) {
185
			$result->ID = $result->term_id;
186
			$result->id = $result->term_id;
187
			return $result->ID;
188
		}
189
		return 0;
190
	}
191
192
	/* Public methods
193
	===================== */
194
195
	/**
196
	 * @internal
197
	 * @return string
198
	 */
199
	public function get_edit_url() {
200
		return get_edit_term_link($this->ID, $this->taxonomy);
201
	}
202
203
	/**
204
	 * @internal
205
	 * @param string $field_name
206
	 * @return string
207
	 */
208
	public function get_meta_field( $field_name ) {
209
		if (!isset($this->$field_name)) {
210
			$field_value = '';
211
			$field_value = apply_filters('timber_term_get_meta_field', $field_value, $this->ID, $field_name, $this);
212
			$field_value = apply_filters('timber/term/meta/field', $field_value, $this->ID, $field_name, $this);
213
			$this->$field_name = $field_value;
214
		}
215
		return $this->$field_name;
216
	}
217
218
	/**
219
	 * @internal
220
	 * @return string
221
	 */
222
	public function get_path() {
223
		$link = $this->get_link();
224
		$rel = TimberURLHelper::get_rel_url($link, true);
225
		$rel = apply_filters('timber_term_path', $rel, $this);
226
		return apply_filters('timber/term/path', $rel, $this);
227
	}
228
229
	/**
230
	 * @internal
231
	 * @return string
232
	 */
233
	public function get_link() {
234
		$link = get_term_link($this);
235
		$link = apply_filters('timber_term_link', $link, $this);
236
		return apply_filters('timber/term/link', $link, $this);
237
	}
238
239
	/**
240
	 * Get Posts that have been "tagged" with the particular term
241
	 * @internal
242
	 * @param int $numberposts
243
	 * @param string $post_type
244
	 * @param string $PostClass
245
	 * @return array|bool|null
246
	 */
247
	public function get_posts( $numberposts = 10, $post_type = 'any', $PostClass = '' ) {
248
		if (!strlen($PostClass)) {
249
			$PostClass = $this->PostClass;
250
		}
251
		$default_tax_query = array(array(
252
			'field' => 'id',
253
			'terms' => $this->ID,
254
			'taxonomy' => $this->taxonomy,
255
		));
256
		if ( is_string($numberposts) && strstr($numberposts, '=') ) {
257
			$args = $numberposts;
258
			$new_args = array();
259
			parse_str($args, $new_args);
260
			$args = $new_args;
261
			$args['tax_query'] = $default_tax_query;
262
			if (!isset($args['post_type'])) {
263
				$args['post_type'] = 'any';
264
			}
265
			if (class_exists($post_type)) {
266
				$PostClass = $post_type;
267
			}
268
		} else if ( is_array($numberposts) ) {
269
			//they sent us an array already baked
270
			$args = $numberposts;
271
			if ( !isset($args['tax_query']) ) {
272
				$args['tax_query'] = $default_tax_query;
273
			}
274
			if ( class_exists($post_type) ) {
275
				$PostClass = $post_type;
276
			}
277
			if ( !isset($args['post_type']) ) {
278
				$args['post_type'] = 'any';
279
			}
280
		} else {
281
			$args = array(
282
				'numberposts' => $numberposts,
283
				'tax_query' => $default_tax_query,
284
				'post_type' => $post_type
285
			);
286
		}
287
		return Timber::get_posts($args, $PostClass);
288
	}
289
290
	/**
291
	 * @internal
292
	 * @return array
293
	 */
294
	public function get_children() {
295
		if ( !isset($this->_children) ) {
296
			$children = get_term_children($this->ID, $this->taxonomy);
297
			foreach ($children as &$child) {
298
				$child = new TimberTerm($child);
299
			}
300
			$this->_children = $children;
301
		}
302
		return $this->_children;
303
	}
304
305
	/**
306
	 *
307
	 *
308
	 * @param string  $key
309
	 * @param mixed   $value
310
	 */
311
	function update( $key, $value ) {
312
		$value = apply_filters( 'timber_term_set_meta', $value, $key, $this->ID, $this );
313
		$this->$key = $value;
314
	}
315
316
	/* Alias
317
	====================== */
318
319
	/**
320
	 * @api
321
	 * @return array
322
	 */
323
	public function children() {
324
		return $this->get_children();
325
	}
326
327
	/**
328
	 * @api
329
	 * @return string
330
	 */
331
	public function description() {
332
		$prefix = '<p>';
333
		$suffix = '</p>';
334
		$desc = term_description( $this->ID, $this->taxonomy );
335
		if (substr($desc, 0, strlen($prefix)) == $prefix) {
336
    		$desc = substr($desc, strlen($prefix));
337
		}
338
		$desc = preg_replace('/'. preg_quote('</p>', '/') . '$/', '', $desc);
339
		return trim($desc);
340
	}
341
342
	/**
343
	 * @api
344
	 * @return string
345
	 */
346
	public function edit_link() {
347
		return $this->get_edit_url();
348
	}
349
350
	/**
351
	 * @internal
352
	 * @deprecated 0.21.8 use TimberTerm::link() instead
353
	 * @return string
354
	 */
355
	public function get_url() {
356
		return $this->get_link();
357
	}
358
359
	/**
360
	 * @api
361
	 * @return string
362
	 */
363
	public function link() {
364
		return $this->get_link();
365
	}
366
367
	/**
368
	 * @api
369
	 * @param string $field_name
370
	 * @return string
371
	 */
372
	public function meta( $field_name ) {
373
		return $this->get_meta_field($field_name);
374
	}
375
376
	/**
377
	 * @api
378
	 * @return string
379
	 */
380
	public function path() {
381
		return $this->get_path();
382
	}
383
384
	/**
385
	 * @api
386
	 * @param int $numberposts_or_args
387
	 * @param string $post_type_or_class
388
	 * @param string $post_class
389
	 * @example
390
	 * ```twig
391
	 * <h4>Recent posts in {{term.name}}</h4>
392
	 * <ul>
393
	 * {% for post in term.posts(3, 'post') %}
394
	 *     <li><a href="{{post.link}}">{{post.title}}</a></li>
395
	 * {% endfor %}
396
	 * </ul>
397
	 * ```
398
	 * @return array|bool|null
399
	 */
400
	public function posts( $numberposts_or_args = 10, $post_type_or_class = 'any', $post_class = '' ) {
401
		return $this->get_posts($numberposts_or_args, $post_type_or_class, $post_class);
402
	}
403
404
	/**
405
	 * @api
406
	 * @return string
407
	 */
408
	public function title() {
409
		return $this->name;
410
	}
411
412
	/**
413
	 * @deprecated 0.21.9 use TimberTerm::link() instead
414
	 * @return string
415
	 */
416
	public function url() {
417
		return $this->get_url();
418
	}
419
420
	/**
421
	 * @deprecated 0.20.0 this was a dumb idea
422
	 * @param int $i
423
	 * @return string
424
	 */
425
	function get_page( $i ) {
426
		return $this->get_path() . '/page/' . $i;
427
	}
428
429
}
430