Issues (311)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/timber-twig.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
class TimberTwig {
4
5
	public static $dir_name;
6
7
	/**
8
	 * @codeCoverageIgnore
9
	 */
10
	public static function init() {
11
		new TimberTwig();
12
	}
13
14
	/**
15
	 * @codeCoverageIgnore
16
	 */
17
	function __construct() {
18
		add_action( 'timber/twig/filters', array( $this, 'add_timber_filters_deprecated' ) );
19
		add_action( 'timber/twig/filters', array( $this, 'add_timber_filters' ) );
20
	}
21
22
	/**
23
	 * These are all deprecated and will be removed in 0.21.0
24
	 *
25
	 * @param Twig_Environment $twig
26
	 * @deprecated since 0.20.7
27
	 * @return Twig_Environment
28
	 */
29
	function add_timber_filters_deprecated( $twig ) {
30
		$twig->addFilter( new Twig_SimpleFilter( 'get_src_from_attachment_id', 'twig_get_src_from_attachment_id' ) );
31
		$twig->addFilter( new Twig_SimpleFilter( 'wp_body_class', array( $this, 'body_class' ) ) );
32
		$twig->addFilter( new Twig_SimpleFilter( 'twitterify', array( 'TimberHelper', 'twitterify' ) ) );
33
		$twig->addFilter( new Twig_SimpleFilter( 'twitterfy', array( 'TimberHelper', 'twitterify' ) ) );
34
		$twig->addFilter( new Twig_SimpleFilter( 'string', function($arr, $glue = ' '){
35
			return twig_join_filter($arr, $glue);
36
		} ) );
37
		return $twig;
38
	}
39
40
	/**
41
	 *
42
	 *
43
	 * @param Twig_Environment $twig
44
	 * @return Twig_Environment
45
	 */
46
	function add_timber_filters( $twig ) {
47
		/* image filters */
48
		$twig->addFilter( new Twig_SimpleFilter( 'resize', array( 'TimberImageHelper', 'resize' ) ) );
49
		$twig->addFilter( new Twig_SimpleFilter( 'retina', array( 'TimberImageHelper', 'retina_resize' ) ) );
50
		$twig->addFilter( new Twig_SimpleFilter( 'letterbox', array( 'TimberImageHelper', 'letterbox' ) ) );
51
		$twig->addFilter( new Twig_SimpleFilter( 'tojpg', array( 'TimberImageHelper', 'img_to_jpg' ) ) );
52
53
		/* debugging filters */
54
		$twig->addFilter( new Twig_SimpleFilter( 'docs', 'twig_object_docs' ) );
55
		$twig->addFilter( new Twig_SimpleFilter( 'get_class',  'get_class' ) );
56
		$twig->addFilter( new Twig_SimpleFilter( 'get_type', 'get_type' ) );
57
		$twig->addFilter( new Twig_SimpleFilter( 'print_r', function( $arr ) {
58
					return print_r( $arr, true );
59
				} ) );
60
		$twig->addFilter( new Twig_SimpleFilter( 'print_a', function( $arr ) {
61
					return '<pre>' . self::object_docs( $arr, true ) . '</pre>';
62
				} ) );
63
64
		/* other filters */
65
		$twig->addFilter( new Twig_SimpleFilter( 'stripshortcodes', 'strip_shortcodes' ) );
66
		$twig->addFilter( new Twig_SimpleFilter( 'array', array( $this, 'to_array' ) ) );
67
		$twig->addFilter( new Twig_SimpleFilter( 'excerpt', 'wp_trim_words' ) );
68
		$twig->addFilter( new Twig_SimpleFilter( 'function', array( $this, 'exec_function' ) ) );
69
		$twig->addFilter( new Twig_SimpleFilter( 'pretags', array( $this, 'twig_pretags' ) ) );
70
		$twig->addFilter( new Twig_SimpleFilter( 'sanitize', 'sanitize_title' ) );
71
		$twig->addFilter( new Twig_SimpleFilter( 'shortcodes', 'do_shortcode' ) );
72
		$twig->addFilter( new Twig_SimpleFilter( 'time_ago', array( $this, 'time_ago' ) ) );
73
		$twig->addFilter( new Twig_SimpleFilter( 'wpautop', 'wpautop' ) );
74
		$twig->addFilter( new Twig_SimpleFilter( 'list', array( $this, 'add_list_separators' ) ) );
75
76
		$twig->addFilter( new Twig_SimpleFilter( 'relative', function ( $link ) {
77
					return TimberURLHelper::get_rel_url( $link, true );
78
				} ) );
79
80
		$twig->addFilter( new Twig_SimpleFilter( 'date', array( $this, 'intl_date' ) ) );
81
82
		$twig->addFilter( new Twig_SimpleFilter( 'truncate', function ( $text, $len ) {
83
					return TimberHelper::trim_words( $text, $len );
84
				} ) );
85
86
		/* actions and filters */
87
		$twig->addFunction( new Twig_SimpleFunction( 'action', function ( $context ) {
88
					$args = func_get_args();
89
					array_shift( $args );
90
					$args[] = $context;
91
					call_user_func_array( 'do_action', $args );
92
				}, array( 'needs_context' => true ) ) );
93
94
		$twig->addFilter( new Twig_SimpleFilter( 'apply_filters', function () {
95
					$args = func_get_args();
96
					$tag = current( array_splice( $args, 1, 1 ) );
97
98
					return apply_filters_ref_array( $tag, $args );
99
				} ) );
100
		$twig->addFunction( new Twig_SimpleFunction( 'function', array( &$this, 'exec_function' ) ) );
101
		$twig->addFunction( new Twig_SimpleFunction( 'fn', array( &$this, 'exec_function' ) ) );
102
103
		$twig->addFunction( new Twig_SimpleFunction( 'shortcode', 'do_shortcode' ) );
104
105
		/* TimberObjects */
106 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'TimberPost', function ( $pid, $PostClass = 'TimberPost' ) {
107
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
108
						foreach ( $pid as &$p ) {
109
							$p = new $PostClass( $p );
110
						}
111
						return $pid;
112
					}
113
					return new $PostClass( $pid );
114
				} ) );
115 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'TimberImage', function ( $pid, $ImageClass = 'TimberImage' ) {
116
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
117
						foreach ( $pid as &$p ) {
118
							$p = new $ImageClass( $p );
119
						}
120
						return $pid;
121
					}
122
					return new $ImageClass( $pid );
123
				} ) );
124 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'TimberTerm', function ( $pid, $TermClass = 'TimberTerm' ) {
125
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
126
						foreach ( $pid as &$p ) {
127
							$p = new $TermClass( $p );
128
						}
129
						return $pid;
130
					}
131
					return new $TermClass( $pid );
132
				} ) );
133 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'TimberUser', function ( $pid, $UserClass = 'TimberUser' ) {
134
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
135
						foreach ( $pid as &$p ) {
136
							$p = new $UserClass( $p );
137
						}
138
						return $pid;
139
					}
140
					return new $UserClass( $pid );
141
				} ) );
142
143
		/* TimberObjects Alias */
144 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'Post', function ( $pid, $PostClass = 'TimberPost' ) {
145
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
146
						foreach ( $pid as &$p ) {
147
							$p = new $PostClass( $p );
148
						}
149
						return $pid;
150
					}
151
					return new $PostClass( $pid );
152
				} ) );
153 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'Image', function ( $pid, $ImageClass = 'TimberImage' ) {
154
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
155
						foreach ( $pid as &$p ) {
156
							$p = new $ImageClass( $p );
157
						}
158
						return $pid;
159
					}
160
					return new $ImageClass( $pid );
161
				} ) );
162 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'Term', function ( $pid, $TermClass = 'TimberTerm' ) {
163
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
164
						foreach ( $pid as &$p ) {
165
							$p = new $TermClass( $p );
166
						}
167
						return $pid;
168
					}
169
					return new $TermClass( $pid );
170
				} ) );
171 View Code Duplication
		$twig->addFunction( new Twig_SimpleFunction( 'User', function ( $pid, $UserClass = 'TimberUser' ) {
172
					if ( is_array( $pid ) && !TimberHelper::is_array_assoc( $pid ) ) {
173
						foreach ( $pid as &$p ) {
174
							$p = new $UserClass( $p );
175
						}
176
						return $pid;
177
					}
178
					return new $UserClass( $pid );
179
				} ) );
180
181
		/* bloginfo and translate */
182
		$twig->addFunction( 'bloginfo', new Twig_SimpleFunction( 'bloginfo', function ( $show = '', $filter = 'raw' ) {
183
					return get_bloginfo( $show, $filter );
184
				} ) );
185
		$twig->addFunction( '__', new Twig_SimpleFunction( '__', function ( $text, $domain = 'default' ) {
186
					return __( $text, $domain );
187
				} ) );
188
		/* get_twig is deprecated, use timber/twig */
189
		$twig = apply_filters( 'get_twig', $twig );
190
		$twig = apply_filters( 'timber/twig', $twig );
191
		return $twig;
192
	}
193
194
	/**
195
	 *
196
	 *
197
	 * @param mixed   $arr
198
	 * @return array
199
	 */
200
	function to_array( $arr ) {
201
		if ( is_array( $arr ) ) {
202
			return $arr;
203
		}
204
		$arr = array( $arr );
205
		return $arr;
206
	}
207
208
	/**
209
	 *
210
	 *
211
	 * @param string  $function_name
212
	 * @return mixed
213
	 */
214
	function exec_function( $function_name ) {
215
		$args = func_get_args();
216
		array_shift( $args );
217
		if ( is_string($function_name) ) {
218
			$function_name = trim( $function_name );
219
		}
220
		return call_user_func_array( $function_name, ( $args ) );
221
	}
222
223
	/**
224
	 *
225
	 *
226
	 * @param string  $content
227
	 * @return string
228
	 */
229
	function twig_pretags( $content ) {
230
		return preg_replace_callback( '|<pre.*>(.*)</pre|isU', array( &$this, 'convert_pre_entities' ), $content );
231
	}
232
233
	/**
234
	 *
235
	 *
236
	 * @param array   $matches
237
	 * @return string
238
	 */
239
	function convert_pre_entities( $matches ) {
240
		return str_replace( $matches[1], htmlentities( $matches[1] ), $matches[0] );
241
	}
242
243
	/**
244
	 * @param mixed   $body_classes
245
	 * @deprecated 0.20.7
246
	 * @return string
247
	 */
248
	function body_class( $body_classes ) {
249
		ob_start();
250
		if ( is_array( $body_classes ) ) {
251
			$body_classes = explode( ' ', $body_classes );
252
		}
253
		body_class( $body_classes );
254
		$return = ob_get_contents();
255
		ob_end_clean();
256
		return $return;
257
	}
258
259
	/**
260
	 *
261
	 *
262
	 * @param string  $date
263
	 * @param string  $format (optional)
264
	 * @return string
265
	 */
266
	function intl_date( $date, $format = null ) {
267
		if ( $format === null ) {
268
			$format = get_option( 'date_format' );
269
		}
270
271
		if ( $date instanceof DateTime ) {
272
			$timestamp = $date->getTimestamp() + $date->getOffset();
273
		} else if (is_numeric( $date ) && strtotime( $date ) === false ) {
274
			$timestamp = intval( $date );
275
		} else {
276
			$timestamp = strtotime( $date );
277
		}
278
279
		return date_i18n( $format, $timestamp );
280
	}
281
282
	//debug
283
284
	/**
285
	 *
286
	 *
287
	 * @param mixed   $obj
288
	 * @param bool    $methods
289
	 * @deprecated since 0.20.7
290
	 * @return string
291
	 */
292
	function object_docs( $obj, $methods = true ) {
293
		$class = get_class( $obj );
294
		$properties = (array)$obj;
295
		if ( $methods ) {
296
			/** @var array $methods */
297
			$methods = $obj->get_method_values();
298
		}
299
		$rets = array_merge( $properties, $methods );
300
		ksort( $rets );
301
		$str = print_r( $rets, true );
302
		$str = str_replace( 'Array', $class . ' Object', $str );
303
		return $str;
304
	}
305
306
	/**
307
	 * @param int|string $from
308
	 * @param int|string $to
309
	 * @param string $format_past
310
	 * @param string $format_future
311
	 * @return string
312
	 */
313
	function time_ago( $from, $to = null, $format_past = '%s ago', $format_future = '%s from now' ) {
314
		$to = $to === null ? time() : $to;
315
		$to = is_int( $to ) ? $to : strtotime( $to );
316
		$from = is_int( $from ) ? $from : strtotime( $from );
317
318
		if ( $from < $to ) {
319
			return sprintf( $format_past, human_time_diff( $from, $to ) );
320
		} else {
321
			return sprintf( $format_future, human_time_diff( $to, $from ) );
322
		}
323
	}
324
325
	/**
326
	 * @param array $arr
327
	 * @param string $first_delimiter
328
	 * @param string $second_delimiter
329
	 * @return string
330
	 */
331
	function add_list_separators( $arr, $first_delimiter = ',', $second_delimiter = 'and' ) {
0 ignored issues
show
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
332
		$length = count( $arr );
333
		$list = '';
334
		foreach( $arr as $index => $item ) {
335
			if ( $index < $length - 2 ) {
336
				$delimiter = $first_delimiter.' ';
337
			} elseif ( $index == $length - 2 ) {
338
				$delimiter = ' '.$second_delimiter.' ';
339
			} else {
340
				$delimiter = '';
341
			}
342
			$list = $list.$item.$delimiter;
343
		}
344
		return $list;
345
	}
346
347
}
348