Issues (3833)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

shortcodely-admin-form-html.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*
3
 * Backend Class for use in all shortcodely plugins
4
 * Version 0.1
5
 *
6
 * @package Shortcodely
7
 */
8
9
// ------------------------------------------------------------------------------------------------------------------
10
if ( ! class_exists( 'Shortcodely_Saw_Plugin_Admin' ) ) {
11
	/*
12
    * Shortcodely_Saw_Plugin_Admin Class Doc Comment
13
    *
14
    * @ category Class
15
    * @ package	shortcodely
16
    * @ author	 patilswapnilv
17
    * @ license	http://www.gnu.org/copyleft/gpl.html GNU General Public License
18
    * @ link		 http://www.github.com/patilswapnilv/shortcodely
19
    */
20
21
	class Shortcodely_Saw_Plugin_Admin {
22
23
24
25
		public $hook = 'shortcodely_saw';
26
		public $filename        = 'shortcodely_shortcode_any_widget/shortcodely_shortcode_any_widget.php';
27
		public $longname        = 'Shortcode any widget - insert widgets or widget areas into a page.';
28
		public $shortname = 'Shortcode any widget';
29
		public $optionname = '';
30
		/**
31
		 * Homepage variable Doc Comment
32
		 *
33
		 * @category variable
34
		 * @package  shortcodely
35
		 * @author   patilswapnilv
36
		 * @license  http://www.gnu.org/copyleft/gpl.html GNU General Public License
37
		 * @link     http://www.github.com/patilswapnilv/shortcodely
38
		 * /
39
				 /**
40
		 * This is a "Docblock Comment," also known as a "docblock."    The class'
41
		 * docblock, below, contains a complete description of how to write these.
42
		 */
43
		public $homepage = '';
44
		public $parent_slug = 'plugin_listings_menu';
45
		public $accesslvl = 'manage_options';
46
		public function __construct() {
47
				add_action( 'admin_menu', array( &$this, 'register_settings_page' ) );
48
				add_filter( 'plugin_action_links', array( &$this, 'add_action_link' ), 10, 2 );
49
		}
50
		public function register_settings_page() {
51
				add_options_page( $this->longname, $this->shortname, $this->accesslvl, $this->hook, array( &$this, 'config_page' ) );
52
		}
53
		public function plugin_options_url() {
54
				return admin_url( 'options-general.php?page=' . $this->hook );
55
		}
56
		/**
57
		 * Add a link to the settings page to the plugins list
58
		 */
59
		public function add_action_link( $links, $file ) {
60
			static $this_plugin;
61
			if ( empty( $this_plugin ) ) {
62
				$this_plugin = $this->filename;
63
			}
64
			if ( $file == $this_plugin ) {
65
				$settings_link = '<a href="' . $this->plugin_options_url() . '">' . __( 'Settings', 'shortcodely-shortcode-any-widget' ) . '</a>';
66
				array_unshift( $links, $settings_link );
67
			}
68
				return $links;
69
		}
70
71
		/**
72
		 * @param string $title
73
		 */
74
		public function admin_heading( $title ) {
75
				echo '<div class="wrap" >
76
			<div id="icon-options-general" class="icon32"><br />
77
			</div>
78
			<h2>' . $title . ' </h2>';
0 ignored issues
show
Expected next thing to be a escaping function, not '$title'
Loading history...
79
		}
80
81
		public function admin_subheading( $title ) {
82
				echo '<h2>' . $title . '</h2>';
0 ignored issues
show
Expected next thing to be a escaping function, not '$title'
Loading history...
83
		}
84
		public function config_page() {
85
				$this->admin_heading( $this->longname );
86
				echo '<h3>More detailed instructions at the wordpress plugin <a target="_new" href="http://wordpress.org/plugins/shortcodely/installation">installation and faq pages.</a></h3>';
87
				echo '<ol>';
88
				echo '<li>';
89
				_e( 'Test your widget in a normal sidebar first.', 'shortcodely-shortcode-any-widget' );
90
				echo ' <a title="Go to widget area" href="' . get_admin_url( '', 'widgets.php' ) . '">';
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'get_admin_url'
Loading history...
91
				_e( 'Go to widgets', 'shortcodely-shortcode-any-widget' );
92
				echo '</a>';
93
				echo '<li>';
94
				_e( 'Drag the widgets you want to use to the shortcodes sidebar.', 'shortcodely-shortcode-any-widget' );
95
				echo '</li>';
96
				echo '<li>';
97
				_e( 'Add a do_widget or do_widget_area shortcode to a page.', 'shortcodely-shortcode-any-widget' );
98
				echo ' <a title="Create a page" href="'
99
				. get_admin_url( '', 'post-new.php?post_type=page&content=&#91;do_widget Archives &#93;' )
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'get_admin_url'
Loading history...
100
				. '">';
101
				_e( 'Create a page with example do_widget shortcode', 'shortcodely-shortcode-any-widget' );
102
				echo '</a>';
103
				echo '</li>';
104
				echo '</ol>';
105
106
				echo '<h2>';
107
				_e( 'To add a single widget to a page', 'shortcodely-shortcode-any-widget' );
108
				echo '</h2>';
109
				echo '<ul>';
110
				echo '<li>';
111
				_e( 'Add the shortcode [do_widget widgetname] to a page:', 'shortcodely-shortcode-any-widget' );
112
				echo '</li>';
113
				echo '<li>';
114
				echo '<li>';
115
				echo '[do_widget categories] or [do_widget name=categories] ';
116
				echo '</li>';
117
				echo '<li>';
118
				_e( '[do_widget "tag cloud"] or [do_widget id=widgetid]', 'shortcodely-shortcode-any-widget' );
119
				echo '</li>';
120
				echo '<li>';
121
				echo 'To see a list of your widgets in their sidebars, add <b>?do_widget_debug</b> to the url of page with the do_widget shortcode.';
122
				echo '</li>';
123
				echo '</ul>';
124
125
				echo '<br />';
126
				echo '<h2>';
127
				_e( 'More advanced options:', 'shortcodely-shortcode-any-widget' );
128
				echo '</h2>';
129
				echo '<ul><li>';
130
				echo 'Use title=false to hide a widget title. ';
131
				echo '</li>';
132
				echo '<li>';
133
				echo '[do_widget pages title=false]	will hide the widget title';
134
				echo '</li></ul>';
135
				echo '<h3>';
136
				_e( 'To change the style, change the html:', 'shortcodely-shortcode-any-widget' );
137
				echo '</h3>';
138
				echo '<ul>';
139
140
				echo '<li>';
141
				echo 'Use title=somehtmltag and wrap=somehtmltag	to change the html used.	This may change how your theme\'s css affects the widget when it is in	page.	It all depends what what html selectors your theme uses.';
142
				echo '</li>';
143
				echo '<li>';
144
				echo ' Use class=yourclassname to add a class - maybe to override your themes widget styling?	Obviously you must have css that applies to that class.';
145
				echo '</li>';
146
147
				echo '<li>';
148
				echo '[do_widget pages title=h3]	give the title a heading 3 html tag.';
149
				echo '</li>';
150
				echo '<li>';
151
				echo '[do_widget "tag cloud" wrap=aside]	 will wrap the widget in an "aside" html tag.';
152
				echo '</li>';
153
154
				echo '</ul>';
155
156
				echo '<h4>';
157
				echo 'Valid title html tags are : </h4><ul>';
158
				echo '<li>h1</li>';
159
				echo '<li>h2</li>';
160
				echo '<li>h3</li>';
161
				echo '<li>h4</li>';
162
				echo '<li>h5</li>';
163
				echo '<li>header</li>';
164
				echo '<li>strong</li>';
165
				echo '<li>em</li>';
166
				echo '</ul>';
167
168
				echo '<h4>Valid html wrap tags are :</h4><ul>';
169
				echo '<li>div</li>';
170
				echo '<li>p</li>';
171
				echo '<li>aside</li>';
172
				echo '<li>section</li>';
173
				echo '</ul>';
174
175
				echo '<h2>';
176
				_e( 'To add multiple instances of the same widget:', 'shortcodely-shortcode-any-widget' );
177
178
				echo '</h2>';
179
				echo '<ul>';
180
				echo '<li>';
181
				echo '[do_widget id=widgetid1] [do_widget id=widgetid2]';
182
				echo '</li>';
183
				echo '</ul>';
184
185
				echo '<h2>';
186
				_e( 'To add a widget area - all widgets in the widget area:', 'shortcodely-shortcode-any-widget' );
187
188
				echo '</h2>';
189
				echo '<ul>';
190
				echo '<li>';
191
				echo '<a title="Create a page" href="'
192
				. get_admin_url( '', 'post-new.php?post_type=page&content=&#91;do_widget_area&#93;' )
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'get_admin_url'
Loading history...
193
				. '"> ';
194
				_e( 'Create a page with do_widget_area shortcode', 'shortcodely-shortcode-any-widget' );
195
				echo '</a> Hoping to use theme styling.';
196
				echo '</li>';
197
				echo '<li>';
198
				echo '<a title="Create a page" href="'
199
				. get_admin_url(
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'get_admin_url'
Loading history...
200
					'',
201
					'post-new.php?post_type=page&content=&#91;do_widget_area widget_area_class=none&#93;'
202
				)
203
				. '"> ';
204
				_e( 'Create a page with do_widget_area shortcode	without the widget_area class', 'shortcodely-shortcode-any-widget' );
205
				echo '</a> Hoping to avoid theme sidebar styling.';
206
				echo '</li>';
207
				echo '<li>';
208
				_e( 'Examples:', 'shortcodely-shortcode-any-widget' );
209
				echo '</li>';
210
				echo '<li>';
211
				_e( '[do_widget_area] or [do_widget_area widget_area=sidebar-1]', 'shortcodely-shortcode-any-widget' );
212
				echo '</li>';
213
				echo '<li>';
214
				_e( 'NB: Using something like the twenty-fourteen theme? you might end up with white text on a white background.	Tweak the widget classes or the html of the wrap or title. If that fails, adjust your css.', 'shortcodely-shortcode-any-widget' );
215
				echo '</li>';
216
				echo '</ul>';
217
				echo '<br />';
218
		}
219
220
221
		/**
222
		 * Info box with link to the support forums.
223
		 */
224
		public function plugin_support() {
225
				$content = '<p>' . __( 'If you have any problems with this plugin or good ideas for improvements or new features, please talk about them in the', 'shortcodely-shortcode-any-widget' ) . ' <a href="http://wordpress.org/tags/' . $this->hook . '">' . __( 'Support forums', 'shortcodely-shortcode-any-widget' ) . '</a>.</p>';
0 ignored issues
show
Expected next thing to be a escaping function, not '$this'
Loading history...
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw '__'
Loading history...
226
				$this->postbox( $this->hook . 'support', 'Need support?', $content );
0 ignored issues
show
The method postbox() does not seem to exist on object<Shortcodely_Saw_Plugin_Admin>.

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
227
		}
228
229
		public function text_limit( $text, $limit, $finish = ' [&hellip;]' ) {
230
			if ( strlen( $text ) > $limit ) {
231
				$text = substr( $text, 0, $limit );
232
				$text = substr( $text, 0, - (strlen( strrchr( $text, ' ' ) )) );
233
				$text .= $finish;
234
			}
235
				return $text;
236
		}
237
	}
238
}
239