Issues (4967)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/wp-includes/class-wp-customize-panel.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * WordPress Customize Panel classes
4
 *
5
 * @package WordPress
6
 * @subpackage Customize
7
 * @since 4.0.0
8
 */
9
10
/**
11
 * Customize Panel class.
12
 *
13
 * A UI container for sections, managed by the WP_Customize_Manager.
14
 *
15
 * @since 4.0.0
16
 *
17
 * @see WP_Customize_Manager
18
 */
19
class WP_Customize_Panel {
20
21
	/**
22
	 * Incremented with each new class instantiation, then stored in $instance_number.
23
	 *
24
	 * Used when sorting two instances whose priorities are equal.
25
	 *
26
	 * @since 4.1.0
27
	 *
28
	 * @static
29
	 * @access protected
30
	 * @var int
31
	 */
32
	protected static $instance_count = 0;
33
34
	/**
35
	 * Order in which this instance was created in relation to other instances.
36
	 *
37
	 * @since 4.1.0
38
	 * @access public
39
	 * @var int
40
	 */
41
	public $instance_number;
42
43
	/**
44
	 * WP_Customize_Manager instance.
45
	 *
46
	 * @since 4.0.0
47
	 * @access public
48
	 * @var WP_Customize_Manager
49
	 */
50
	public $manager;
51
52
	/**
53
	 * Unique identifier.
54
	 *
55
	 * @since 4.0.0
56
	 * @access public
57
	 * @var string
58
	 */
59
	public $id;
60
61
	/**
62
	 * Priority of the panel, defining the display order of panels and sections.
63
	 *
64
	 * @since 4.0.0
65
	 * @access public
66
	 * @var integer
67
	 */
68
	public $priority = 160;
69
70
	/**
71
	 * Capability required for the panel.
72
	 *
73
	 * @since 4.0.0
74
	 * @access public
75
	 * @var string
76
	 */
77
	public $capability = 'edit_theme_options';
78
79
	/**
80
	 * Theme feature support for the panel.
81
	 *
82
	 * @since 4.0.0
83
	 * @access public
84
	 * @var string|array
85
	 */
86
	public $theme_supports = '';
87
88
	/**
89
	 * Title of the panel to show in UI.
90
	 *
91
	 * @since 4.0.0
92
	 * @access public
93
	 * @var string
94
	 */
95
	public $title = '';
96
97
	/**
98
	 * Description to show in the UI.
99
	 *
100
	 * @since 4.0.0
101
	 * @access public
102
	 * @var string
103
	 */
104
	public $description = '';
105
106
	/**
107
	 * Auto-expand a section in a panel when the panel is expanded when the panel only has the one section.
108
	 *
109
	 * @since 4.7.4
110
	 * @access public
111
	 * @var bool
112
	 */
113
	public $auto_expand_sole_section = false;
114
115
	/**
116
	 * Customizer sections for this panel.
117
	 *
118
	 * @since 4.0.0
119
	 * @access public
120
	 * @var array
121
	 */
122
	public $sections;
123
124
	/**
125
	 * Type of this panel.
126
	 *
127
	 * @since 4.1.0
128
	 * @access public
129
	 * @var string
130
	 */
131
	public $type = 'default';
132
133
	/**
134
	 * Active callback.
135
	 *
136
	 * @since 4.1.0
137
	 * @access public
138
	 *
139
	 * @see WP_Customize_Section::active()
140
	 *
141
	 * @var callable Callback is called with one argument, the instance of
142
	 *               WP_Customize_Section, and returns bool to indicate whether
143
	 *               the section is active (such as it relates to the URL currently
144
	 *               being previewed).
145
	 */
146
	public $active_callback = '';
147
148
	/**
149
	 * Constructor.
150
	 *
151
	 * Any supplied $args override class property defaults.
152
	 *
153
	 * @since 4.0.0
154
	 *
155
	 * @param WP_Customize_Manager $manager Customizer bootstrap instance.
156
	 * @param string               $id      An specific ID for the panel.
157
	 * @param array                $args    Panel arguments.
158
	 */
159 View Code Duplication
	public function __construct( $manager, $id, $args = array() ) {
160
		$keys = array_keys( get_object_vars( $this ) );
161
		foreach ( $keys as $key ) {
162
			if ( isset( $args[ $key ] ) ) {
163
				$this->$key = $args[ $key ];
164
			}
165
		}
166
167
		$this->manager = $manager;
168
		$this->id = $id;
169
		if ( empty( $this->active_callback ) ) {
170
			$this->active_callback = array( $this, 'active_callback' );
171
		}
172
		self::$instance_count += 1;
173
		$this->instance_number = self::$instance_count;
174
175
		$this->sections = array(); // Users cannot customize the $sections array.
176
	}
177
178
	/**
179
	 * Check whether panel is active to current Customizer preview.
180
	 *
181
	 * @since 4.1.0
182
	 * @access public
183
	 *
184
	 * @return bool Whether the panel is active to the current preview.
185
	 */
186
	final public function active() {
187
		$panel = $this;
188
		$active = call_user_func( $this->active_callback, $this );
189
190
		/**
191
		 * Filters response of WP_Customize_Panel::active().
192
		 *
193
		 * @since 4.1.0
194
		 *
195
		 * @param bool               $active Whether the Customizer panel is active.
196
		 * @param WP_Customize_Panel $panel  WP_Customize_Panel instance.
197
		 */
198
		$active = apply_filters( 'customize_panel_active', $active, $panel );
199
200
		return $active;
201
	}
202
203
	/**
204
	 * Default callback used when invoking WP_Customize_Panel::active().
205
	 *
206
	 * Subclasses can override this with their specific logic, or they may
207
	 * provide an 'active_callback' argument to the constructor.
208
	 *
209
	 * @since 4.1.0
210
	 * @access public
211
	 *
212
	 * @return bool Always true.
213
	 */
214
	public function active_callback() {
215
		return true;
216
	}
217
218
	/**
219
	 * Gather the parameters passed to client JavaScript via JSON.
220
	 *
221
	 * @since 4.1.0
222
	 *
223
	 * @return array The array to be exported to the client as JSON.
0 ignored issues
show
Consider making the return type a bit more specific; maybe use array<string,string|boolean|integer>.

This check looks for the generic type array as a return type and suggests a more specific type. This type is inferred from the actual code.

Loading history...
224
	 */
225
	public function json() {
226
		$array = wp_array_slice_assoc( (array) $this, array( 'id', 'description', 'priority', 'type' ) );
227
		$array['title'] = html_entity_decode( $this->title, ENT_QUOTES, get_bloginfo( 'charset' ) );
228
		$array['content'] = $this->get_content();
229
		$array['active'] = $this->active();
230
		$array['instanceNumber'] = $this->instance_number;
231
		$array['autoExpandSoleSection'] = $this->auto_expand_sole_section;
232
		return $array;
233
	}
234
235
	/**
236
	 * Checks required user capabilities and whether the theme has the
237
	 * feature support required by the panel.
238
	 *
239
	 * @since 4.0.0
240
	 *
241
	 * @return bool False if theme doesn't support the panel or the user doesn't have the capability.
242
	 */
243 View Code Duplication
	final public function check_capabilities() {
244
		if ( $this->capability && ! call_user_func_array( 'current_user_can', (array) $this->capability ) ) {
245
			return false;
246
		}
247
248
		if ( $this->theme_supports && ! call_user_func_array( 'current_theme_supports', (array) $this->theme_supports ) ) {
0 ignored issues
show
This if statement, and the following return statement can be replaced with return !($this->theme_su...this->theme_supports));.
Loading history...
249
			return false;
250
		}
251
252
		return true;
253
	}
254
255
	/**
256
	 * Get the panel's content template for insertion into the Customizer pane.
257
	 *
258
	 * @since 4.1.0
259
	 *
260
	 * @return string Content for the panel.
261
	 */
262
	final public function get_content() {
263
		ob_start();
264
		$this->maybe_render();
265
		return trim( ob_get_clean() );
266
	}
267
268
	/**
269
	 * Check capabilities and render the panel.
270
	 *
271
	 * @since 4.0.0
272
	 */
273
	final public function maybe_render() {
274
		if ( ! $this->check_capabilities() ) {
275
			return;
276
		}
277
278
		/**
279
		 * Fires before rendering a Customizer panel.
280
		 *
281
		 * @since 4.0.0
282
		 *
283
		 * @param WP_Customize_Panel $this WP_Customize_Panel instance.
284
		 */
285
		do_action( 'customize_render_panel', $this );
286
287
		/**
288
		 * Fires before rendering a specific Customizer panel.
289
		 *
290
		 * The dynamic portion of the hook name, `$this->id`, refers to
291
		 * the ID of the specific Customizer panel to be rendered.
292
		 *
293
		 * @since 4.0.0
294
		 */
295
		do_action( "customize_render_panel_{$this->id}" );
296
297
		$this->render();
298
	}
299
300
	/**
301
	 * Render the panel container, and then its contents (via `this->render_content()`) in a subclass.
302
	 *
303
	 * Panel containers are now rendered in JS by default, see WP_Customize_Panel::print_template().
304
	 *
305
	 * @since 4.0.0
306
	 * @access protected
307
	 */
308
	protected function render() {}
309
310
	/**
311
	 * Render the panel UI in a subclass.
312
	 *
313
	 * Panel contents are now rendered in JS by default, see WP_Customize_Panel::print_template().
314
	 *
315
	 * @since 4.1.0
316
	 * @access protected
317
	 */
318
	protected function render_content() {}
319
320
	/**
321
	 * Render the panel's JS templates.
322
	 *
323
	 * This function is only run for panel types that have been registered with
324
	 * WP_Customize_Manager::register_panel_type().
325
	 *
326
	 * @since 4.3.0
327
	 *
328
	 * @see WP_Customize_Manager::register_panel_type()
329
	 */
330
	public function print_template() {
331
		?>
332
		<script type="text/html" id="tmpl-customize-panel-<?php echo esc_attr( $this->type ); ?>-content">
333
			<?php $this->content_template(); ?>
334
		</script>
335
		<script type="text/html" id="tmpl-customize-panel-<?php echo esc_attr( $this->type ); ?>">
336
			<?php $this->render_template(); ?>
337
		</script>
338
        <?php
339
	}
340
341
	/**
342
	 * An Underscore (JS) template for rendering this panel's container.
343
	 *
344
	 * Class variables for this panel class are available in the `data` JS object;
345
	 * export custom variables by overriding WP_Customize_Panel::json().
346
	 *
347
	 * @see WP_Customize_Panel::print_template()
348
	 *
349
	 * @since 4.3.0
350
	 * @access protected
351
	 */
352
	protected function render_template() {
353
		?>
354
		<li id="accordion-panel-{{ data.id }}" class="accordion-section control-section control-panel control-panel-{{ data.type }}">
355
			<h3 class="accordion-section-title" tabindex="0">
356
				{{ data.title }}
357
				<span class="screen-reader-text"><?php _e( 'Press return or enter to open this panel' ); ?></span>
358
			</h3>
359
			<ul class="accordion-sub-container control-panel-content"></ul>
360
		</li>
361
		<?php
362
	}
363
364
	/**
365
	 * An Underscore (JS) template for this panel's content (but not its container).
366
	 *
367
	 * Class variables for this panel class are available in the `data` JS object;
368
	 * export custom variables by overriding WP_Customize_Panel::json().
369
	 *
370
	 * @see WP_Customize_Panel::print_template()
371
	 *
372
	 * @since 4.3.0
373
	 * @access protected
374
	 */
375
	protected function content_template() {
376
		?>
377
		<li class="panel-meta customize-info accordion-section <# if ( ! data.description ) { #> cannot-expand<# } #>">
378
			<button class="customize-panel-back" tabindex="-1"><span class="screen-reader-text"><?php _e( 'Back' ); ?></span></button>
379
			<div class="accordion-section-title">
380
				<span class="preview-notice"><?php
381
					/* translators: %s: the site/panel title in the Customizer */
382
					echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title">{{ data.title }}</strong>' );
383
				?></span>
384
				<# if ( data.description ) { #>
385
					<button class="customize-help-toggle dashicons dashicons-editor-help" tabindex="0" aria-expanded="false"><span class="screen-reader-text"><?php _e( 'Help' ); ?></span></button>
386
				<# } #>
387
			</div>
388
			<# if ( data.description ) { #>
389
				<div class="description customize-panel-description">
390
					{{{ data.description }}}
391
				</div>
392
			<# } #>
393
		</li>
394
		<?php
395
	}
396
}
397
398
/** WP_Customize_Nav_Menus_Panel class */
399
require_once( ABSPATH . WPINC . '/customize/class-wp-customize-nav-menus-panel.php' );
400