Issues (461)

Branch: master

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/classes/class-lsx-bootstrap-navwalker.php (29 issues)

1
<?php
2
/**
3
 * LSX functions and definitions - Bootstrap Navigation Walker
4
 *
5
 * @package    lsx
6
 * @subpackage navigation
7
 * @category   bootstrap-navigation-walker
8
 */
9
10
if ( ! defined( 'ABSPATH' ) ) {
11
	exit;
12
}
13
14
if ( ! class_exists( 'Walker_Nav_Menu' ) ) {
15
	return;
16
}
17
18
if ( ! class_exists( 'LSX_Bootstrap_Navwalker' ) ) :
19
20
	/**
21
	 * Cleaner Bootstrap walker
22
	 *
23
	 * @package    lsx
24
	 * @subpackage navigation
25
	 * @category   bootstrap-navigation-walker
26
	 */
27
	class LSX_Bootstrap_Navwalker extends Walker_Nav_Menu {
28
29
		/**
0 ignored issues
show
Coding Style Documentation introduced by
Doc comment for parameter "$args" missing
Loading history...
30
		 * Used to append additional content.
31
		 *
32
		 * @see Walker::start_lvl()
33
		 * @since 3.0.0
34
		 *
35
		 * @param string $output Passed by reference. Used to append additional content.
36
		 * @param int    $depth Depth of page. Used for padding.
37
		 */
38
		public function start_lvl( &$output, $depth = 0, $args = array() ) {
39
			$indent  = str_repeat( "\t", $depth );
40
			$output .= "\n$indent<ul role=\"menu\" class=\" dropdown-menu\">\n";
41
		}
42
43
		/**
44
		 * Used to append additional content.
45
		 * @param string $item Passed by reference.
0 ignored issues
show
There must be exactly one blank line before the tags in a doc comment
Loading history...
46
		 */
47
		public function filter_default_pages( &$item ) {
48
			return $item;
49
		}
50
51
		/**
0 ignored issues
show
Missing short description in doc comment
Loading history...
Coding Style Documentation introduced by
Doc comment for parameter "$id" missing
Loading history...
52
		 * @see Walker::start_el()
53
		 * @since 3.0.0
54
		 *
55
		 * @param string $output Passed by reference. Used to append additional content.
56
		 * @param object $item Menu item data object.
57
		 * @param int $depth Depth of menu item. Used for padding.
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
58
		 * @param int $current_page Menu item ID.
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
Doc comment for parameter $current_page does not match actual variable name $args
Loading history...
59
		 * @param object $args
0 ignored issues
show
Coding Style Documentation introduced by
Missing parameter comment
Loading history...
Doc comment for parameter $args does not match actual variable name $id
Loading history...
60
		 */
61
		public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0 ) {
62
			$indent = ( $depth ) ? str_repeat( "\t", $depth ) : '';
63
64
			/**
65
			 * If this is a default menu being called we need to fix
66
			 * the item object thats coming through.
67
			 */
68
			if ( ! isset( $item->title ) ) {
69
				return;
70
			}
71
72
			/**
73
			 * Dividers, Headers or Disabled
74
			 * =============================
75
			 * Determine whether the item is a Divider, Header, Disabled or regular
76
			 * menu item. To prevent errors we use the strcasecmp() function to so a
77
			 * comparison that is not case sensitive. The strcasecmp() function returns
78
			 * a 0 if the strings are equal.
79
			 */
80
			if ( 0 == strcasecmp( $item->attr_title, 'divider' ) && 1 === $depth ) {
0 ignored issues
show
Found: ==. Use strict comparisons (=== or !==).
Loading history...
81
				$output .= $indent . '<li role="presentation" class="divider">';
82
			} elseif ( 0 == strcasecmp( $item->title, 'divider' ) && 1 === $depth ) {
0 ignored issues
show
Found: ==. Use strict comparisons (=== or !==).
Loading history...
83
				$output .= $indent . '<li role="presentation" class="divider">';
84
			} elseif ( 0 == strcasecmp( $item->attr_title, 'dropdown-header' ) && 1 === $depth ) {
0 ignored issues
show
Found: ==. Use strict comparisons (=== or !==).
Loading history...
85
				$output .= $indent . '<li role="presentation" class="dropdown-header">' . esc_attr( $item->title );
86
			} elseif ( 0 == strcasecmp( $item->attr_title, 'disabled' ) ) {
0 ignored issues
show
Found: ==. Use strict comparisons (=== or !==).
Loading history...
87
				$output .= $indent . '<li role="presentation" class="disabled"><a href="#">' . esc_attr( $item->title ) . '</a>';
88
			} else {
89
				$class_names = '';
0 ignored issues
show
The assignment to $class_names is dead and can be removed.
Loading history...
90
				$value       = '';
91
92
				$classes = empty( $item->classes ) ? array() : (array) $item->classes;
93
				$classes[] = 'menu-item-' . $item->ID;
94
95
				$classes = apply_filters( 'lsx_nav_menu_css_class', array_filter( $classes ), $item, $args, $depth );
96
97
				$class_names = join( ' ', $classes );
98
99
				if ( $args->has_children )
0 ignored issues
show
Coding Style Best Practice introduced by
It is generally a best practice to always use braces with control structures.

Adding braces to control structures avoids accidental mistakes as your code changes:

// Without braces (not recommended)
if (true)
    doSomething();

// Recommended
if (true) {
    doSomething();
}
Loading history...
100
					$class_names .= ' dropdown';
101
102
				if ( in_array( 'current-menu-item', $classes ) )
0 ignored issues
show
Coding Style Best Practice introduced by
It is generally a best practice to always use braces with control structures.

Adding braces to control structures avoids accidental mistakes as your code changes:

// Without braces (not recommended)
if (true)
    doSomething();

// Recommended
if (true) {
    doSomething();
}
Loading history...
Not using strict comparison for in_array; supply true for third argument.
Loading history...
103
					$class_names .= ' active';
104
105
				if ( in_array( 'current-menu-parent', $classes ) )
0 ignored issues
show
Coding Style Best Practice introduced by
It is generally a best practice to always use braces with control structures.

Adding braces to control structures avoids accidental mistakes as your code changes:

// Without braces (not recommended)
if (true)
    doSomething();

// Recommended
if (true) {
    doSomething();
}
Loading history...
Not using strict comparison for in_array; supply true for third argument.
Loading history...
106
					$class_names .= ' active';
107
108
				//Check if this is ment to be a "social" type menu
0 ignored issues
show
No space found before comment text; expected "// Check if this is ment to be a "social" type menu" but found "//Check if this is ment to be a "social" type menu"
Loading history...
Inline comments must end in full-stops, exclamation marks, or question marks
Loading history...
109
				$class_names = $class_names ? ' class="' . esc_attr( $class_names ) . '"' : '';
110
111
				$id = apply_filters( 'nav_menu_item_id', 'menu-item-' . $item->ID, $item, $args );
112
				$id = $id ? ' id="' . esc_attr( $id ) . '"' : '';
113
114
				$output .= $indent . '<li' . $id . $value . $class_names . '>';
115
116
				$atts = array();
117
				$atts['title']  = ! empty( $item->attr_title ) ? $item->attr_title : $item->title;
118
				$atts['target'] = ! empty( $item->target ) ? $item->target : '';
119
				$atts['rel']    = ! empty( $item->xfn ) ? $item->xfn : '';
120
121
				// If item has_children add atts to a.
122
				if ( $args->has_children ) {
123
					$atts['href']          = ! empty( $item->url ) ? $item->url : '';
124
					$atts['data-toggle']   = 'dropdown';
125
					$atts['class']         = 'dropdown-toggle';
126
					$atts['aria-haspopup'] = 'true';
127
				} else {
128
					$atts['href'] = ! empty( $item->url ) ? $item->url : '';
129
				}
130
131
				$atts = apply_filters( 'nav_menu_link_attributes', $atts, $item, $args );
132
133
				$attributes = '';
134
				foreach ( $atts as $attr => $value ) {
135
					if ( ! empty( $value ) ) {
136
						$value = ( 'href' === $attr ) ? esc_url( $value ) : esc_attr( $value );
137
						$attributes .= ' ' . $attr . '="' . $value . '"';
138
					}
139
				}
140
141
				$item_output = $args->before;
142
143
				$item_output .= '<a' . $attributes . '>';
144
				$item_output .= $args->link_before . apply_filters( 'the_title', $item->title, $item->ID ) . $args->link_after;
145
				$item_output .= ( $args->has_children && 0 === $depth ) ? ' <span class="caret"></span></a>' : '</a>';
146
				$item_output .= $args->after;
147
148
				$output .= apply_filters( 'walker_nav_menu_start_el', $item_output, $item, $depth, $args );
149
			}
150
		}
151
152
		/**
153
		 * Traverse elements to create list from elements.
154
		 *
155
		 * Display one element if the element doesn't have any children otherwise,
156
		 * display the element and its children. Will only traverse up to the max
157
		 * depth and no ignore elements under that depth.
158
		 *
159
		 * This method shouldn't be called directly, use the walk() method instead.
160
		 *
161
		 * @see Walker::start_el()
162
		 * @since 2.5.0
163
		 *
164
		 * @param object $element Data object
0 ignored issues
show
Coding Style Documentation introduced by
Parameter comment must end with a full stop
Loading history...
165
		 * @param array $children_elements List of elements to continue traversing.
0 ignored issues
show
Expected 2 spaces after parameter type; 1 found
Loading history...
166
		 * @param int $max_depth Max depth to traverse.
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
167
		 * @param int $depth Depth of current element.
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
168
		 * @param array $args
0 ignored issues
show
Coding Style Documentation introduced by
Missing parameter comment
Loading history...
Expected 2 spaces after parameter type; 1 found
Loading history...
169
		 * @param string $output Passed by reference. Used to append additional content.
170
		 * @return null Null on failure with no changes to parameters.
171
		 */
172
		public function display_element( $element, &$children_elements, $max_depth, $depth, $args, &$output ) {
173
			if ( ! $element ) {
0 ignored issues
show
$element is of type object, thus it always evaluated to true.
Loading history...
174
				return;
175
			}
176
177
			$id_field = $this->db_fields['id'];
178
179
			if ( is_object( $args[0] ) ) {
180
				$args[0]->has_children = ! empty( $children_elements[ $element->$id_field ] );
181
			}
182
183
			parent::display_element( $element, $children_elements, $max_depth, $depth, $args, $output );
184
		}
185
186
		/**
187
		 * Menu Fallback
188
		 * =============
189
		 * If this function is assigned to the wp_nav_menu's fallback_cb variable
190
		 * and a manu has not been assigned to the theme location in the WordPress
191
		 * menu manager the function with display nothing to a non-logged in user,
192
		 * and will add a link to the WordPress menu manager if logged in as an admin.
193
		 *
194
		 * @param array $args passed from the wp_nav_menu function.
195
		 *
196
		 */
0 ignored issues
show
Additional blank lines found at end of doc comment
Loading history...
197
		public static function fallback( $args ) {
198
			if ( current_user_can( 'manage_options' ) ) {
199
				$fb_output = null;
200
201
				if ( $args['container'] ) {
202
					$fb_output = '<' . $args['container'];
203
204
					if ( $args['container_id'] ) {
205
						$fb_output .= ' id="' . $args['container_id'] . '"';
206
					}
207
208
					if ( $args['container_class'] ) {
209
						$fb_output .= ' class="' . $args['container_class'] . '"';
210
					}
211
212
					$fb_output .= '>';
213
				}
214
215
				$fb_output .= '<ul';
216
217
				if ( $args['menu_id'] ) {
218
					$fb_output .= ' id="' . $args['menu_id'] . '"';
219
				}
220
221
				if ( $args['menu_class'] ) {
222
					$fb_output .= ' class="' . $args['menu_class'] . '"';
223
				}
224
225
				$fb_output .= '>';
226
				$fb_output .= '<li><a href="' . esc_url( admin_url( 'nav-menus.php' ) ) . '">' . esc_html__( 'Add a menu', 'lsx' ) . '</a></li>';
227
				$fb_output .= '</ul>';
228
229
				if ( $args['container'] ) {
230
					$fb_output .= '</' . $args['container'] . '>';
231
				}
232
233
				echo wp_kses_post( $fb_output );
234
			}
235
		}
236
237
	}
238
239
endif;
240