Issues (25)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/Plugin.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * The file that defines the core plugin class
5
 *
6
 * A class definition that includes attributes and functions used across both the
7
 * public-facing side of the site and the dashboard.
8
 *
9
 * @link       http://example.com
10
 * @since      1.0.0
11
 *
12
 * @package    PluginName
13
 * @subpackage PluginName/includes
14
 */
15
16
namespace logoscon\WP\RedmineEmbed;
17
18
/**
19
 * The core plugin class.
20
 *
21
 * This is used to define internationalization, dashboard-specific hooks, and
22
 * public-facing site hooks.
23
 *
24
 * Also maintains the unique identifier of this plugin as well as the current
25
 * version of the plugin.
26
 *
27
 * @since      1.0.0
28
 * @package    PluginName
29
 * @subpackage PluginName/includes
30
 * @author     Your Name <[email protected]>
31
 */
32
class Plugin {
33
34
	/**
35
	 * The loader that's responsible for maintaining and registering all hooks that power
36
	 * the plugin.
37
	 *
38
	 * @since    1.0.0
39
	 * @access   protected
40
	 * @var      PluginName_Loader    $loader    Maintains and registers all hooks for the plugin.
41
	 */
42
	private $loader;
43
44
	/**
45
	 * The unique identifier of this plugin.
46
	 *
47
	 * @since    1.0.0
48
	 * @access   private
49
	 * @var      string    $name    The string used to uniquely identify this plugin.
50
	 */
51
	private $name = 'redmine-embed';
52
53
	/**
54
	 * The current version of the plugin.
55
	 *
56
	 * @since    1.0.0
57
	 * @access   private
58
	 * @var      string    $version    The current version of the plugin.
59
	 */
60
	private $version = '1.0.0';
61
62
	/**
63
	 * Option key for the plugin.
64
	 *
65
	 * @var string
66
	 */
67
	private $option_key = 'redmine-embed';
68
69
	/**
70
	 * Define the core functionality of the plugin.
71
	 *
72
	 * Create an instance of the loader which will be used to register the hooks
73
	 * with WordPress.
74
	 *
75
	 * @since    1.0.0
76
	 */
77
	public function __construct() {
78
		$this->loader = new Loader();
0 ignored issues
show
Documentation Bug introduced by
It seems like new \logoscon\WP\RedmineEmbed\Loader() of type object<logoscon\WP\RedmineEmbed\Loader> is incompatible with the declared type object<logoscon\WP\Redmi...mbed\PluginName_Loader> of property $loader.

Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.

Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..

Loading history...
79
	}
80
81
	/**
82
	 * Define the locale for this plugin for internationalization.
83
	 *
84
	 * Uses the I18n class in order to set the domain and to register the hook
85
	 * with WordPress.
86
	 *
87
	 * @since    1.0.0
88
	 * @access   private
89
	 */
90
	private function set_locale() {
91
92
		$plugin_i18n = new I18n();
93
		$plugin_i18n->set_domain( $this->get_name() );
94
		$plugin_i18n->load_plugin_textdomain();
95
96
	}
97
98
	/**
99
	 * Register all of the hooks related to the dashboard functionality
100
	 * of the plugin.
101
	 *
102
	 * @since    1.0.0
103
	 * @access   private
104
	 */
105
	private function define_admin_hooks() {
106
		$settings      = new Admin\Settings( $this );
107
		$user_settings = new Admin\UserSettings( $this );
108
109
		$this->loader->add_action( 'admin_menu', $settings, 'menu' );
110
		$this->loader->add_action( 'admin_init', $settings, 'add' );
111
112
		$this->loader->add_action( 'show_user_profile', $user_settings, 'show_user_profile' );
113
		$this->loader->add_action( 'edit_user_profile', $user_settings, 'edit_user_profile' );
114
		$this->loader->add_action( 'personal_options_update', $user_settings, 'edit_user_profile_update' );
115
		$this->loader->add_action( 'edit_user_profile_update', $user_settings, 'edit_user_profile_update' );
116
	}
117
118
	/**
119
	 * Register all of the hooks related to the public-facing functionality
120
	 * of the plugin.
121
	 *
122
	 * @since    1.0.0
123
	 * @access   private
124
	 */
125
	private function define_frontend_hooks() {
126
		$frontend = new Frontend( $this );
127
128
		$this->loader->add_action( 'wp_enqueue_scripts', $frontend, 'enqueue_styles' );
129
		$this->loader->add_action( 'init', $frontend, 'register_embed_handlers' );
130
	}
131
132
	/**
133
	 * Run the loader to execute all of the hooks with WordPress.
134
	 *
135
	 * Load the dependencies, define the locale, and set the hooks for the Dashboard and
136
	 * the public-facing side of the site.
137
	 *
138
	 * @since    1.0.0
139
	 */
140
	public function run() {
141
		$this->set_locale();
142
		$this->define_admin_hooks();
143
		$this->define_frontend_hooks();
144
		$this->loader->run();
145
	}
146
147
	/**
148
	 * The name of the plugin used to uniquely identify it within the context of
149
	 * WordPress and to define internationalization functionality.
150
	 *
151
	 * @since     1.0.0
152
	 * @return    string    The name of the plugin.
153
	 */
154
	public function get_name() {
155
		return $this->name;
156
	}
157
158
	/**
159
	 * The reference to the class that orchestrates the hooks with the plugin.
160
	 *
161
	 * @since     1.0.0
162
	 * @return    PluginName_Loader    Orchestrates the hooks of the plugin.
163
	 */
164
	public function get_loader() {
165
		return $this->loader;
166
	}
167
168
	/**
169
	 * Retrieve the version number of the plugin.
170
	 *
171
	 * @since     1.0.0
172
	 * @return    string    The version number of the plugin.
173
	 */
174
	public function get_version() {
175
		return $this->version;
176
	}
177
178
	/**
179
	 * The name of the option key used to uniquely identify it in the database.
180
	 *
181
	 * @since     1.0.0
182
	 * @return    string    The option key name.
183
	 */
184
	public function get_option_key() {
185
		return $this->option_key;
186
	}
187
188
	/**
189
	 * Get a plugin option by name.
190
	 *
191
	 * @param  string $name    Option name.
192
	 * @param  mixed  $default Option default if not set.
193
	 * @return mixed           Option value.
194
	 */
195
	public function get_option( $name = null, $default = null ) {
196
		$options = \get_option( $this->get_option_key(), array() );
197
198
		if ( $name === null ) {
199
			return $options;
200
		}
201
202
		return isset( $options[ $name ] ) ? $options[ $name ] : $default;
203
	}
204
205
	/**
206
	 * Set a plugin option.
207
	 *
208
	 * @param string $name   Option name.
209
	 * @param mixed  $value  Option value.
210
	 */
211
	public function set_option( $name, $value ) {
212
		$options = \get_option( $this->get_option_key(), array() );
213
		$options[ $name ] = $value;
214
		$result = \update_option( $this->get_option_key(), $options, true );
0 ignored issues
show
$result is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
215
	}
216
217
}
218