Issues (161)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/settings/wsl.compatibilities.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*!
3
* WordPress Social Login
4
*
5
* https://miled.github.io/wordpress-social-login/ | https://github.com/miled/wordpress-social-login
6
*   (c) 2011-2020 Mohamed Mrassi and contributors | https://wordpress.org/plugins/wordpress-social-login/
7
*/
8
9
/**
10
* Check and upgrade compatibilities from old WSL versions
11
*
12
* Here we attempt to:
13
*	- set to default all settings when WSL is installed
14
*	- make WSL compatible when updating from older versions, by registering new options
15
*
16
* Side note: Over time, the number of options have become too long, and as you can notice
17
*            things are not optimal. If you have any better idea on how to tackle this issue,
18
*            please don't hesitate to share it.
19
*/
20
21
// Exit if accessed directly
22
if ( !defined( 'ABSPATH' ) ) exit;
23
24
// --------------------------------------------------------------------
25
26
/**
27
* Check and upgrade compatibilities from old WSL versions
28
*/
29
function wsl_update_compatibilities()
30
{
31
	delete_option( 'wsl_settings_development_mode_enabled' );
32
	delete_option( 'wsl_settings_migration_notice_is_read' );
33
	delete_option( 'wsl_settings_debug_mode_enabled' );
34
35
	update_option( 'wsl_settings_welcome_panel_enabled', 1 );
36
37
	if( ! get_option( 'wsl_settings_redirect_url' ) )
38
	{
39
		update_option( 'wsl_settings_redirect_url', home_url() );
40
	}
41
42
	if( ! get_option( 'wsl_settings_force_redirect_url' ) )
43
	{
44
		update_option( 'wsl_settings_force_redirect_url', 2 );
45
	}
46
47
	if( ! get_option( 'wsl_settings_connect_with_label' ) )
48
	{
49
		update_option( 'wsl_settings_connect_with_label', _wsl__("Connect with:", 'wordpress-social-login') );
50
	}
51
52
	if( ! get_option( 'wsl_settings_users_avatars' ) )
53
	{
54
		update_option( 'wsl_settings_users_avatars', 1 );
55
	}
56
57
	if( ! get_option( 'wsl_settings_use_popup' ) )
58
	{
59
		update_option( 'wsl_settings_use_popup', 2 );
60
	}
61
62
	if( ! get_option( 'wsl_settings_widget_display' ) )
63
	{
64
		update_option( 'wsl_settings_widget_display', 1 );
65
	}
66
67
	if( ! get_option( 'wsl_settings_authentication_widget_css' ) )
68
	{
69
		update_option( 'wsl_settings_authentication_widget_css', ".wp-social-login-connect-with {}\n.wp-social-login-provider-list {}\n.wp-social-login-provider-list a {}\n.wp-social-login-provider-list img {}\n.wsl_connect_with_provider {}" );
70
	}
71
72
	# bouncer settings
73
	if( ! get_option( 'wsl_settings_bouncer_registration_enabled' ) )
74
	{
75
		update_option( 'wsl_settings_bouncer_registration_enabled', 1 );
76
	}
77
78
	if( ! get_option( 'wsl_settings_bouncer_authentication_enabled' ) )
79
	{
80
		update_option( 'wsl_settings_bouncer_authentication_enabled', 1 );
81
	}
82
83
	if( ! get_option( 'wsl_settings_bouncer_accounts_linking_enabled' ) )
84
	{
85
		update_option( 'wsl_settings_bouncer_accounts_linking_enabled', 1 );
86
	}
87
88
	if( ! get_option( 'wsl_settings_bouncer_profile_completion_require_email' ) )
89
	{
90
		update_option( 'wsl_settings_bouncer_profile_completion_require_email', 2 );
91
	}
92
93
	if( ! get_option( 'wsl_settings_bouncer_profile_completion_change_username' ) )
94
	{
95
		update_option( 'wsl_settings_bouncer_profile_completion_change_username', 2 );
96
	}
97
98
	if( ! get_option( 'wsl_settings_bouncer_profile_completion_hook_extra_fields' ) )
99
	{
100
		update_option( 'wsl_settings_bouncer_profile_completion_hook_extra_fields', 2 );
101
	}
102
103
	if( ! get_option( 'wsl_settings_bouncer_new_users_moderation_level' ) )
104
	{
105
		update_option( 'wsl_settings_bouncer_new_users_moderation_level', 1 );
106
	}
107
108
	if( ! get_option( 'wsl_settings_bouncer_new_users_membership_default_role' ) )
109
	{
110
		update_option( 'wsl_settings_bouncer_new_users_membership_default_role', "default" );
111
	}
112
113
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_domain_enabled' ) )
114
	{
115
		update_option( 'wsl_settings_bouncer_new_users_restrict_domain_enabled', 2 );
116
	}
117
118
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_domain_text_bounce' ) )
119
	{
120
		update_option( 'wsl_settings_bouncer_new_users_restrict_domain_text_bounce', _wsl__("<strong>This website is restricted to invited readers only.</strong><p>It doesn't look like you have been invited to access this site. If you think this is a mistake, you might want to contact the website owner and request an invitation.<p>", 'wordpress-social-login') );
121
	}
122
123
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_email_enabled' ) )
124
	{
125
		update_option( 'wsl_settings_bouncer_new_users_restrict_email_enabled', 2 );
126
	}
127
128
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_email_text_bounce' ) )
129
	{
130
		update_option( 'wsl_settings_bouncer_new_users_restrict_email_text_bounce', _wsl__("<strong>This website is restricted to invited readers only.</strong><p>It doesn't look like you have been invited to access this site. If you think this is a mistake, you might want to contact the website owner and request an invitation.<p>", 'wordpress-social-login') );
131
	}
132
133
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_profile_enabled' ) )
134
	{
135
		update_option( 'wsl_settings_bouncer_new_users_restrict_profile_enabled', 2 );
136
	}
137
138
	if( ! get_option( 'wsl_settings_bouncer_new_users_restrict_profile_text_bounce' ) )
139
	{
140
		update_option( 'wsl_settings_bouncer_new_users_restrict_profile_text_bounce', _wsl__("<strong>This website is restricted to invited readers only.</strong><p>It doesn't look like you have been invited to access this site. If you think this is a mistake, you might want to contact the website owner and request an invitation.<p>", 'wordpress-social-login') );
141
	}
142
143
	# contacts import
144
	if( ! get_option( 'wsl_settings_contacts_import_facebook' ) )
145
	{
146
		update_option( 'wsl_settings_contacts_import_facebook', 2 );
147
	}
148
149
	if( ! get_option( 'wsl_settings_contacts_import_google' ) )
150
	{
151
		update_option( 'wsl_settings_contacts_import_google', 2 );
152
	}
153
154
	if( ! get_option( 'wsl_settings_contacts_import_twitter' ) )
155
	{
156
		update_option( 'wsl_settings_contacts_import_twitter', 2 );
157
	}
158
159
	if( ! get_option( 'wsl_settings_contacts_import_live' ) )
160
	{
161
		update_option( 'wsl_settings_contacts_import_live', 2 );
162
	}
163
164
	if( ! get_option( 'wsl_settings_contacts_import_linkedin' ) )
165
	{
166
		update_option( 'wsl_settings_contacts_import_linkedin', 2 );
167
	}
168
169
	if( ! get_option( 'wsl_settings_buddypress_enable_mapping' ) )
170
	{
171
		update_option( 'wsl_settings_buddypress_enable_mapping', 2 );
172
	}
173
174
	# buddypress profile mapping
175
	if( ! get_option( 'wsl_settings_buddypress_xprofile_map' ) )
176
	{
177
		update_option( 'wsl_settings_buddypress_xprofile_map', '' );
178
	}
179
180
	# if no idp is enabled then we enable the default providers (facebook, google, twitter)
181
	global $WORDPRESS_SOCIAL_LOGIN_PROVIDERS_CONFIG;
182
	$nok = true;
183
	foreach( $WORDPRESS_SOCIAL_LOGIN_PROVIDERS_CONFIG AS $item )
184
	{
185
		$provider_id = $item["provider_id"];
186
187
		if( get_option( 'wsl_settings_' . $provider_id . '_enabled' ) )
188
		{
189
			$nok = false;
190
		}
191
	}
192
193
	if( $nok )
194
	{
195
		foreach( $WORDPRESS_SOCIAL_LOGIN_PROVIDERS_CONFIG AS $item )
196
		{
197
			$provider_id = $item["provider_id"];
198
199 View Code Duplication
			if( isset( $item["default_network"] ) && $item["default_network"] ){
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
200
				update_option( 'wsl_settings_' . $provider_id . '_enabled', 1 );
201
			}
202
		}
203
	}
204
205
	global $wpdb;
206
207
	# migrate steam users id to id64. Prior to 2.2
208
	$sql = "UPDATE {$wpdb->prefix}wslusersprofiles
209
		SET identifier = REPLACE( identifier, 'http://steamcommunity.com/openid/id/', '' )
210
		WHERE provider = 'Steam' AND identifier like 'http://steamcommunity.com/openid/id/%' ";
211
	$wpdb->query( $sql );
212
}
213
214
// --------------------------------------------------------------------
215
216
/**
217
* Old junk
218
*
219
* Seems like some people are using WSL _internal_ functions for some reason...
220
*
221
* Here we keep few of those old/depreciated/undocumented/internal functions, so their websites
222
* doesn't break when updating to newer versions.
223
*
224
* TO BE REMOVED AS OF WSL 3.0
225
**
226
* Ref: http://miled.github.io/wordpress-social-login/developer-api-migrating-2.2.html
227
*/
228
229
// 2.1.6
230
function wsl_render_login_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); return wsl_render_auth_widget(); }
231
function wsl_render_comment_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
232
function wsl_render_login_form_login_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
233
function wsl_render_login_form_login_on_register_and_login(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
234
function wsl_render_login_form_login(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
235
function wsl_shortcode_handler(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); return wsl_shortcode_wordpress_social_login(); }
236
237
// 2.2.2
238
function wsl_render_wsl_widget_in_comment_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
239
function wsl_render_wsl_widget_in_wp_login_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
240
function wsl_render_wsl_widget_in_wp_register_form(){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); wsl_action_wordpress_social_login(); }
241
function wsl_user_custom_avatar($avatar, $mixed, $size, $default, $alt){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); return wsl_get_wp_user_custom_avatar($avatar, $mixed, $size, $default, $alt); }
242
function wsl_bp_user_custom_avatar($html, $args){ wsl_deprecated_function( __FUNCTION__, '2.2.3' ); return wsl_get_bp_user_custom_avatar($html, $args); }
243
244
// nag about it
245
function wsl_deprecated_function( $function, $version )
246
{
247
	// user should be admin and logged in
248
	if( current_user_can('manage_options') )
249
	{
250
		trigger_error( sprintf( __('%1$s is <strong>deprecated</strong> since WordPress Social Login %2$s! For more information, check WSL Developer API - Migration.'), $function, $version ), E_USER_NOTICE );
251
	}
252
}
253
254
// --------------------------------------------------------------------
255