Issues (4967)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/wp-admin/about.php (3 issues)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * About This Version administration panel.
4
 *
5
 * @package WordPress
6
 * @subpackage Administration
7
 */
8
9
/** WordPress Administration Bootstrap */
10
require_once( dirname( __FILE__ ) . '/admin.php' );
11
12
if ( ! wp_is_mobile() ) {
13
	wp_enqueue_style( 'wp-mediaelement' );
14
	wp_enqueue_script( 'wp-mediaelement' );
15
	wp_localize_script( 'mediaelement', '_wpmejsSettings', array(
16
		'pluginPath'        => includes_url( 'js/mediaelement/', 'relative' ),
17
		'pauseOtherPlayers' => '',
18
	) );
19
}
20
21
$video_url = 'https://videopress.com/embed/AHz0Ca46?hd=true';
22
$lang_code = str_replace( '_', '-', get_user_locale() );
23
list( $lang_code ) = explode( '-', $lang_code );
24
if ( 'en' !== $lang_code ) {
25
	$video_url = add_query_arg( 'defaultLangCode', $lang_code, $video_url );
26
}
27
28
$title = __( 'About' );
29
30
list( $display_version ) = explode( '-', get_bloginfo( 'version' ) );
31
32
include( ABSPATH . 'wp-admin/admin-header.php' );
33
?>
34
	<div class="wrap about-wrap">
35
		<h1><?php printf( __( 'Welcome to WordPress&nbsp;%s' ), $display_version ); ?></h1>
36
37
		<p class="about-text"><?php printf( __( 'Thank you for updating to the latest version! WordPress %s adds more ways for you to express yourself and represent your brand.' ), $display_version ); ?></p>
38
		<div class="wp-badge"><?php printf( __( 'Version %s' ), $display_version ); ?></div>
39
40
		<h2 class="nav-tab-wrapper wp-clearfix">
41
			<a href="about.php" class="nav-tab nav-tab-active"><?php _e( 'What&#8217;s New' ); ?></a>
42
			<a href="credits.php" class="nav-tab"><?php _e( 'Credits' ); ?></a>
43
			<a href="freedoms.php" class="nav-tab"><?php _e( 'Freedoms' ); ?></a>
44
		</h2>
45
46
		<div class="feature-section one-col">
47
			<div class="col">
48
				<h2><?php _e( 'An Update with You in Mind' ); ?></h2>
49
				<p class="lead-description"><?php _e( 'WordPress 4.8 adds some great new features. Gear up for a more intuitive WordPress!' ); ?></p>
50
				<p><?php _e( 'Though some updates seem minor, they&#8217;ve been built by hundreds of contributors with <em>you</em> in mind. Get ready for new features you&#8217;ll welcome like an old friend: link improvements, <em>three</em> new media widgets covering images, audio, and video, an updated text widget that supports visual editing, and an upgraded news section in your dashboard which brings in nearby and upcoming WordPress events.' ); ?></p>
51
			</div>
52
		</div>
53
54
		<hr />
55
56
		<h2><?php _e( 'Exciting Widget Updates' ); ?></h2>
57
58
		<div class="headline-feature one-col">
59
			<div class="col">
60
				<picture>
61
					<!-- Large image -->
62
					<source media="( min-width: 1050px )"
63
						srcset="
64
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_810.png 810w,
65
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1054.png 1054w,
66
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1266.png 1266w,
67
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1458.png 1458w,
68
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1633.png 1633w,
69
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1797.png 1797w,
70
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_1955.png 1955w,
71
							https://s.w.org/images/core/4.8/widgets-with-all-four-widescreen_w_2100.png 2100w"
72
						sizes="( max-width: 1290px ) calc( 100vw - 240px ), 1050px" />
73
					<!-- Medium image -->
74
					<source media="( min-width: 601px )"
75
						srcset="
76
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_531.png 531w,
77
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_745.png 745w,
78
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_927.png 927w,
79
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_1089.png 1089w,
80
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_1236.png 1236w,
81
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_1370.png 1370w,
82
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_1498.png 1498w,
83
							https://s.w.org/images/core/4.8/widgets-with-all-four_w_1620.png 1620w"
84
						sizes="( max-width: 782px ) calc( 100vw - 70px ), ( max-width: 960px ) calc( 100vw - 116px ), calc( 100vw - 240px )" />
85
					<!-- Small image -->
86
					<img src="https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_685.png"
87
						srcset="
88
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_300.png 300w,
89
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_451.png 451w,
90
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_575.png 575w,
91
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_685.png 685w,
92
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_784.png 784w,
93
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_873.png 873w,
94
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_959.png 959w,
95
							https://s.w.org/images/core/4.8/widgets-with-all-four-mobile_w_1040.png 1040w"
96
						sizes="( max-width: 500px ) calc( 100vw - 40px ), calc( 100vw - 70px )"
97
						alt="" />
98
				</picture>
99
			</div>
100
		</div>
101
102
		<div class="feature-section two-col">
103
			<div class="col">
104
				<h3><?php _e( 'Image Widget' ); ?></h3>
105
				<p><?php _e( 'Adding an image to a widget is now a simple task that is achievable for any WordPress user without needing to know code. Simply insert your image right within the widget settings. Try adding something like a headshot or a photo of your latest weekend adventure &mdash; and see it appear automatically.' ); ?></p>
106
			</div>
107
			<div class="col">
108
				<h3><?php _e( 'Video Widget' ); ?></h3>
109
				<p><?php _e( 'A welcome video is a great way to humanize the branding of your website. You can now add any video from the Media Library to a sidebar on your site with the new Video widget. Use this to showcase a welcome video to introduce visitors to your site or promote your latest and greatest content.' ); ?></p>
110
			</div>
111
			<div class="col">
112
				<h3><?php _e( 'Audio Widget' ); ?></h3>
113
				<p><?php _e( 'Are you a podcaster, musician, or avid blogger? Adding a widget with your audio file has never been easier. Upload your audio file to the Media Library, go to the widget settings, select your file, and you&#8217;re ready for listeners. This would be a easy way to add a more personal welcome message, too!' );?></p>
114
			</div>
115
			<div class="col">
116
				<h3><?php _e( 'Rich Text Widget' ); ?></h3>
117
				<p><?php _e( 'This feature deserves a parade down the center of town! Rich-text editing capabilities are now native for Text widgets. Add a widget anywhere and format away. Create lists, add emphasis, and quickly and easily insert links. Have fun with your newfound formatting powers, and watch what you can accomplish in a short amount of time.' ); ?></p>
118
			</div>
119
		</div>
120
121
		<hr />
122
123
		<div class="feature-section two-col">
124
			<div class="col">
125
				<h3><?php _e( 'Link Boundaries' ); ?></h3>
126
				<p><?php _e( 'Have you ever tried updating a link, or the text around a link, and found you can&#8217;t seem to edit it correctly? When you edit the text after the link, your new text also ends up linked. Or you edit the text in the link, but your text ends up outside of it. This can be frustrating! With link boundaries, a great new feature, the process is streamlined and your links will work well. You’ll be happier. We promise.' ); ?></p>
127
			</div>
128
			<div class="col">
129
				<?php
130
				echo wp_video_shortcode( array(
131
					'mp4'      => 'https://s.w.org/images/core/4.8/link-boundaries.mp4',
132
					'poster'   => 'https://s.w.org/images/core/4.8/link-boundaries.png',
133
					'width'    => 1140,
134
					'height'   => 624,
135
					// 'class'    => 'wp-video-shortcode feature-video',
136
				) );
137
				?>
138
			</div>
139
		</div>
140
141
		<hr />
142
143
		<div class="feature-section two-col">
144
			<div class="col">
145
				<h3><?php _e( 'Nearby WordPress Events' ); ?></h3>
146
147
				<p><?php _e( 'Did you know that WordPress has a thriving offline community with groups meeting regularly in more than 400 cities around the world? WordPress now draws your attention to the events that help you continue improving your WordPress skills, meet friends, and, of course, publish!' ); ?></p>
148
149
				<p><?php _e( 'This is quickly becoming one of our favorite features. While you are in the dashboard (because you&#8217;re running updates and writing posts, right?) all upcoming WordCamps and WordPress Meetups &mdash; local to you &mdash; will be displayed.' ); ?>
150
151
				<p><?php _e( 'Being part of the community can help you improve your WordPress skills and network with people you wouldn&#8217;t otherwise meet. Now you can easily find your local events just by logging in to your dashboard and looking at the new Events and News dashboard widget.' ); ?>
152
			</div>
153
			<div class="col">
154
				<img
155
					src="https://s.w.org/images/core/4.8/events-widget_w_732.png"
156
					srcset="
157
						https://s.w.org/images/core/4.8/events-widget_w_280.png 280w,
158
						https://s.w.org/images/core/4.8/events-widget_w_420.png 420w,
159
						https://s.w.org/images/core/4.8/events-widget_w_529.png 529w,
160
						https://s.w.org/images/core/4.8/events-widget_w_638.png 638w,
161
						https://s.w.org/images/core/4.8/events-widget_w_732.png 732w,
162
						https://s.w.org/images/core/4.8/events-widget_w_827.png 827w,
163
						https://s.w.org/images/core/4.8/events-widget_w_992.png 992w"
164
					sizes="
165
						( max-width: 500px ) calc( 100vw - 40px ),
166
						( max-width: 782px ) calc( 48vw - 33px ),
167
						( max-width: 960px ) calc( 47vw - 54px ),
168
						( max-width: 1290px ) calc( 47vw - 112px ),
169
						496px"
170
					alt="" />
171
			</div>
172
		</div>
173
174
		<hr />
175
176
		<div class="changelog">
177
			<h2><?php
178
				printf(
179
					/* translators: %s: smiling face with smiling eyes emoji */
180
					__( 'Even More Developer Happiness %s' ),
181
					'&#x1F60A'
182
				);
183
			?></h2>
184
185
			<div class="under-the-hood three-col">
186
				<div class="col">
187
					<h3><a href="https://make.wordpress.org/core/2017/05/17/cleaner-headings-in-the-admin-screens/"><?php _e( 'More Accessible Admin Panel Headings' ); ?></a></h3>
188
					<p><?php _e( 'New CSS rules mean extraneous content (like &ldquo;Add New&rdquo; links) no longer need to be included in admin-area headings. These panel headings improve the experience for people using assistive technologies.' ); ?></p>
189
				</div>
190
				<div class="col">
191
					<h3><a href="https://make.wordpress.org/core/2017/05/22/removal-of-core-embedding-support-for-wmv-and-wma-file-formats/"><?php _e( 'Removal of Core Support for WMV and WMA Files' ); ?></a></h3>
192
					<p><?php _e( 'As fewer and fewer browsers support Silverlight, file formats which require the presence of the Silverlight plugin are being removed from core support. Files will still display as a download link, but will no longer be embedded automatically.' ); ?></p>
193
				</div>
194
				<div class="col">
195
					<h3><a href="https://make.wordpress.org/core/2017/05/22/multisite-focused-changes-in-4-8/"><?php _e( 'Multisite Updates' ); ?></a></h3>
196
					<p><?php _e( 'New capabilities have been introduced to 4.8 with an eye towards removing calls to <code>is_super_admin()</code>. Additionally, new hooks and tweaks to more granularly control site and user counts per network have been added.' ); ?></p>
197
				</div>
198
				<div class="col">
199
					<h3><a href="https://make.wordpress.org/core/2017/05/23/addition-of-tinymce-to-the-text-widget/"><?php _e( 'Text-Editor JavaScript API' ); ?></a></h3>
200
					<p><?php _e( 'With the addition of TinyMCE to the text widget in 4.8 comes a new JavaScript API for instantiating the editor after page load. This can be used to add an editor instance to any text area, and customize it with buttons and functions. Great for plugin authors!' ); ?></p>
201
				</div>
202
				<div class="col">
203
					<h3><a href="https://make.wordpress.org/core/2017/05/26/media-widgets-for-images-video-and-audio/"><?php _e( 'Media Widgets API' ); ?></a></h3>
204
					<p><?php _e( 'The introduction of a new base media widget REST API schema to 4.8 opens up possibilities for even more media widgets (like galleries or playlists) in the future. The three new media widgets are powered by a shared base class that covers most of the interactions with the media modal. That class also makes it easier to create new media widgets and paves the way for more to come.' ); ?></p>
205
				</div>
206
				<div class="col">
207
					<h3><a href="https://make.wordpress.org/core/2017/05/16/customizer-sidebar-width-is-now-variable/"><?php _e( 'Customizer Width Variable' ); ?></a></h3>
208
					<p><?php _e( 'Rejoice! New responsive breakpoints have been added to the customizer sidebar to make it wider on high-resolution screens. Customizer controls should use percentage-based widths instead of pixels.' ); ?></p>
209
				</div>
210
			</div>
211
		</div>
212
213
		<hr />
214
215
		<div class="return-to-dashboard">
216
			<?php if ( current_user_can( 'update_core' ) && isset( $_GET['updated'] ) ) : ?>
217
				<a href="<?php echo esc_url( self_admin_url( 'update-core.php' ) ); ?>">
218
					<?php is_multisite() ? _e( 'Return to Updates' ) : _e( 'Return to Dashboard &rarr; Updates' ); ?>
219
				</a> |
220
			<?php endif; ?>
221
			<a href="<?php echo esc_url( self_admin_url() ); ?>"><?php is_blog_admin() ? _e( 'Go to Dashboard &rarr; Home' ) : _e( 'Go to Dashboard' ); ?></a>
222
		</div>
223
224
	</div>
225
<?php
226
227
include( ABSPATH . 'wp-admin/admin-footer.php' );
228
229
// These are strings we may use to describe maintenance/security releases, where we aim for no new strings.
230
return;
231
232
__( 'Maintenance Release' );
233
__( 'Maintenance Releases' );
234
235
__( 'Security Release' );
236
__( 'Security Releases' );
237
238
__( 'Maintenance and Security Release' );
239
__( 'Maintenance and Security Releases' );
240
241
/* translators: %s: WordPress version number */
242
__( '<strong>Version %s</strong> addressed one security issue.' );
243
/* translators: %s: WordPress version number */
244
__( '<strong>Version %s</strong> addressed some security issues.' );
245
246
/* translators: 1: WordPress version number, 2: plural number of bugs. */
247
_n_noop( '<strong>Version %1$s</strong> addressed %2$s bug.',
0 ignored issues
show
The call to the function _n_noop() seems unnecessary as the function has no side-effects.
Loading history...
248
         '<strong>Version %1$s</strong> addressed %2$s bugs.' );
249
250
/* translators: 1: WordPress version number, 2: plural number of bugs. Singular security issue. */
251
_n_noop( '<strong>Version %1$s</strong> addressed a security issue and fixed %2$s bug.',
0 ignored issues
show
The call to the function _n_noop() seems unnecessary as the function has no side-effects.
Loading history...
252
         '<strong>Version %1$s</strong> addressed a security issue and fixed %2$s bugs.' );
253
254
/* translators: 1: WordPress version number, 2: plural number of bugs. More than one security issue. */
255
_n_noop( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
0 ignored issues
show
The call to the function _n_noop() seems unnecessary as the function has no side-effects.
Loading history...
256
         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.' );
257
258
/* translators: %s: Codex URL */
259
__( 'For more information, see <a href="%s">the release notes</a>.' );
260