Issues (2873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/PodsI18n.php (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * @package Pods
5
 * @since   2.7
6
 */
7
final class PodsI18n {
8
9
	/**
10
	 * @var PodsI18n Singleton instance
11
	 */
12
	private static $instance = null;
13
14
	/**
15
	 * @var array Key/value pairs with label/translation
16
	 */
17
	private static $strings = array();
18
19
	/**
20
	 * @var mixed Current language locale
21
	 */
22
	private static $current_language = null;
23
24
	/**
25
	 * @var mixed Current language data
26
	 */
27
	private static $current_language_data = null;
28
29
	/**
30
	 * Singleton handling for a basic pods_i18n() request
31
	 *
32
	 * @since 2.7
33
	 */
34
	private function __construct() {
35
36
		self::$instance = $this;
37
38
		// Hook all enqueue scripts actions
39
		add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_scripts' ) );
40
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_scripts' ) );
41
		add_action( 'login_enqueue_scripts', array( $this, 'enqueue_scripts' ) );
42
43
		// Polylang
44
		add_filter( 'pll_get_post_types', array( $this, 'pll_get_post_types' ), 10, 2 );
45
	}
46
47
	/**
48
	 * Singleton handling for a basic pods_i18n() request
49
	 *
50
	 * @return \PodsI18n
51
	 *
52
	 * @since 2.7
53
	 */
54
	public static function get_instance() {
55
56
		// Initialize if the class hasn't been setup yet for some reason
57
		if ( ! is_object( self::$instance ) ) {
58
			self::$instance = new self();
59
		}
60
61
		return self::$instance;
62
	}
63
64
	/**
65
	 * @since 2.7
66
	 */
67
	public function enqueue_scripts() {
68
69
		// Register our i18n script for JS
70
		wp_register_script( 'sprintf', PODS_URL . 'ui/js/sprintf/sprintf.min.js', array(), '1.1.0', true );
71
		wp_register_script( 'pods-i18n', PODS_URL . 'ui/js/pods-i18n.js', array( 'sprintf' ), PODS_VERSION, true );
72
73
		self::localize_assets();
74
	}
75
76
	/**
77
	 * Localize assets:
78
	 *     * Build localizations strings from the defaults and those provided via filter
79
	 *     * Provide a global JavaScript object with the assembled localization strings via `wp_localize_script`
80
	 *
81
	 * @since 2.7
82
	 */
83
	private static function localize_assets() {
84
85
		/**
86
		 * Add strings to the localization
87
		 * Setting the key of your string to the original (non translated) value is mandatory
88
		 * Note: Existing keys in this class will overwrite the ones of this filter!
89
		 *
90
		 * @since 2.7
91
		 * @see   default_strings()
92
		 *
93
		 * @param array
94
		 *
95
		 * @return array format: 'Untranslated string' => 'Translated string with use of WP translate functions'
96
		 */
97
		$strings_extra = apply_filters( 'pods_localized_strings', array() );
98
99
		self::$strings = array_merge( $strings_extra, self::default_strings() );
100
101
		foreach ( self::$strings as $key => $str ) {
102
			self::register( $key, $str );
103
		}
104
105
		// Some other stuff we need to pass through
106
		$i18n_base = array(
107
			'debug' => ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG == true ) ? true : false,
108
		);
109
		// Add localization to our i18n script
110
		wp_localize_script( 'pods-i18n', 'podsLocalizedStrings', array_merge( self::$strings, $i18n_base ) );
111
	}
112
113
	/**
114
	 * Register function that creates the references and combines these with the translated strings
115
	 *
116
	 * @param string $string_key
117
	 * @param string $translation
118
	 *
119
	 * @since 2.7
120
	 */
121
	private static function register( $string_key, $translation ) {
122
123
		/**
124
		 * Converts string into reference object variable
125
		 * Uses the same logic as JS to create the same references
126
		 */
127
		$ref = '__' . $string_key;
128
129
		// Add it to the strings localized
130
		self::$strings[ $ref ] = $translation;
131
132
		// Remove the old key
133
		unset( self::$strings[ $string_key ] );
134
	}
135
136
	/**
137
	 * Register our labels to use in JS
138
	 * We need to register them as normal string to convert to JS references
139
	 * And we need to register the translations to attach to these references, these may not be variables!
140
	 *
141
	 * @return array Key/value pairs with label/translation
142
	 *
143
	 * @since 2.7
144
	 */
145
	private static function default_strings() {
146
147
		return array(
148
149
			'%s is required.'                              => __( '%s is required.', 'pods' ),
150
151
			'This field is required.'                      => __( 'This field is required.', 'pods' ),
152
153
			'Add'                                          => __( 'Add', 'pods' ),
154
155
			'Add New'                                      => __( 'Add New', 'pods' ),
156
157
			'Add New Record'                               => __( 'Add New Record', 'pods' ),
158
159
			'Added!'                                       => __( 'Added!', 'pods' ),
160
161
			'Added! Choose another or <a href="#">close this box</a>' => __( 'Added! Choose another or <a href="#">close this box</a>', 'pods' ),
162
163
			'Copy'                                         => __( 'Copy', 'pods' ),
164
165
			'Reorder'                                      => __( 'Reorder', 'pods' ),
166
167
			'Remove'                                       => __( 'Remove', 'pods' ),
168
169
			'Deselect'                                     => __( 'Deselect', 'pods' ),
170
171
			'Download'                                     => __( 'Download', 'pods' ),
172
173
			'View'                                         => __( 'View', 'pods' ),
174
175
			'Edit'                                         => __( 'Edit', 'pods' ),
176
177
			'Search'                                       => __( 'Search', 'pods' ),
178
179
			'Navigating away from this page will discard any changes you have made.' => __( 'Navigating away from this page will discard any changes you have made.', 'pods' ),
180
181
			'Some fields have changes that were not saved yet, please save them or cancel the changes before saving the Pod.' => __( 'Some fields have changes that were not saved yet, please save them or cancel the changes before saving the Pod.', 'pods' ),
182
183
			'Unable to process request, please try again.' => __( 'Unable to process request, please try again.', 'pods' ),
184
185
			'Error uploading file: '                       => __( 'Error uploading file: ', 'pods' ),
186
187
			'Allowed Files'                                => __( 'Allowed Files', 'pods' ),
188
189
			'The Title'                                    => __( 'The Title', 'pods' ),
190
191
			'Select from existing'                         => __( 'Select from existing', 'pods' ),
192
193
			'You can only select'                          => __( 'You can only select', 'pods' ),
194
195
			'%s item'                                      => __( '%s item', 'pods' ),
196
197
			'%s items'                                     => __( '%s items', 'pods' ),
198
199
			'Icon'                                         => __( 'Icon', 'pods' ),
200
201
		);
202
203
	}
204
205
	/**
206
	 * Get current locale information from Multilingual plugins
207
	 *
208
	 * @since 2.7
209
	 *
210
	 * @param array $args    (optional) {
211
	 *
212
	 * @type bool   $refresh Rerun get_current_language() logic?
213
	 * }
214
	 *
215
	 * @return string
216
	 */
217
	public function get_current_language( $args = array() ) {
218
219
		$args = wp_parse_args(
220
			$args, array(
221
				'refresh' => false,
222
			)
223
		);
224
225
		if ( ! $args['refresh'] && ! empty( self::$current_language ) ) {
226
			return self::$current_language;
227
		}
228
229
		$this->get_current_language_data( $args );
230
231
		return self::$current_language;
232
	}
233
234
	/**
235
	 * Get current language information from Multilingual plugins
236
	 *
237
	 * @since 2.6.6
238
	 * @since 2.7 Moved to this class from PodsAPI
239
	 *
240
	 * @param array $args    (optional) {
241
	 *
242
	 * @type bool   $refresh Rerun logic?
243
	 * }
244
	 *
245
	 * @return array
246
	 */
247
	public function get_current_language_data( $args = array() ) {
248
249
		$args = wp_parse_args(
250
			$args, array(
251
				'refresh' => false,
252
			)
253
		);
254
255
		if ( ! $args['refresh'] && ! empty( self::$current_language_data ) ) {
256
			return self::$current_language_data;
257
		}
258
259
		/**
260
		 * @var $sitepress SitePress object
261
		 * @var $polylang  Polylang object
262
		 */
263
		/*
264
		 * @todo wpml-comp Remove global object usage
265
		 */
266
		global $sitepress, $polylang;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
267
268
		$lang_data        = false;
269
		$translator       = false;
270
		$current_language = false;
271
272
		// Multilingual support
273
		if ( did_action( 'wpml_loaded' ) && apply_filters( 'wpml_setting', true, 'auto_adjust_ids' ) ) {
274
			// WPML support
275
			$translator = 'WPML';
276
277
			// Get the global current language (if set)
278
			$wpml_language    = apply_filters( 'wpml_current_language', null );
279
			$current_language = ( $wpml_language != 'all' ) ? $wpml_language : '';
280
281
		} elseif ( ( function_exists( 'PLL' ) || is_object( $polylang ) ) && function_exists( 'pll_current_language' ) ) {
282
			// Polylang support
283
			$translator = 'PLL';
284
285
			// Get the global current language (if set)
286
			$current_language = pll_current_language( 'slug' );
287
		}
288
289
		/**
290
		 * Admin functions that overwrite the current language
291
		 *
292
		 * @since 2.6.6
293
		 */
294
		if ( is_admin() && ! empty( $translator ) ) {
295
			if ( $translator == 'PLL' ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
296
				/**
297
				 * Polylang support
298
				 * Get the current user's preferred language.
299
				 * This is a user meta setting that will overwrite the language returned from pll_current_language()
300
				 *
301
				 * @see polylang/admin/admin-base.php -> init_user()
302
				 */
303
				$current_language = get_user_meta( get_current_user_id(), 'pll_filter_content', true );
0 ignored issues
show
get_user_meta() usage is highly discouraged, check VIP documentation on "Working with wp_users"
Loading history...
304
			}
305
306
			// Get current language based on the object language if available
307
			if ( function_exists( 'get_current_screen' ) ) {
308
				$current_screen = get_current_screen();
309
310
				/**
311
				 * Overwrite the current language if needed for post types
312
				 */
313
				if ( isset( $current_screen->base ) && ( $current_screen->base == 'post' || $current_screen->base == 'edit' ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
314
					if ( ! empty( $_GET['post'] ) ) {
315
						/**
316
						 * WPML support
317
						 * In WPML the current language is always set to default on an edit screen
318
						 * We need to overwrite this when the current object is not-translatable to enable relationships with different languages
319
						 */
320
						if ( $translator == 'WPML' && ! apply_filters( 'wpml_is_translated_post_type', false, ( get_post_type( $_GET['post'] ) ) ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
321
							// Overwrite the current language to nothing if this is a NOT-translatable post_type
322
							$current_language = '';
323
						}
324
325
						/**
326
						 * Polylang support (1.5.4+)
327
						 * In polylang the preferred language could be anything.
328
						 * We only want the related objects if they are not translatable OR the same language as the current object
329
						 */
330
						if ( $translator == 'PLL' && function_exists( 'pll_get_post_language' ) && pll_is_translated_post_type( get_post_type( $_GET['post'] ) ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
331
							// Overwrite the current language if this is a translatable post_type
332
							$current_language = pll_get_post_language( (int) $_GET['post'] );
333
						}
334
					}//end if
335
336
					/**
337
					 * Polylang support (1.0.1+)
338
					 * In polylang the preferred language could be anything.
339
					 * When we're adding a new object and language is set we only want the related objects if they are not translatable OR the same language
340
					 */
341
					if ( $translator == 'PLL' && ! empty( $_GET['new_lang'] ) && ! empty( $_GET['post_type'] ) && pll_is_translated_post_type( sanitize_text_field( $_GET['post_type'] ) ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
342
						$current_language = $_GET['new_lang'];
343
					}
344
345
					/**
346
					 * Overwrite the current language if needed for taxonomies
347
					 */
348
				} elseif ( isset( $current_screen->base ) && ( $current_screen->base == 'term' || $current_screen->base == 'edit-tags' ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
349
					// @todo MAYBE: Similar function like get_post_type for taxonomies so we don't need to check for $_GET['taxonomy']
350
					if ( ! empty( $_GET['taxonomy'] ) ) {
351
						/*
352
						 * @todo wpml-comp API call for taxonomy needed!
353
						 * Suggested API call:
354
						 * add_filter( 'wpml_is_translated_taxonomy', $_GET['taxonomy'], 10, 2 );
355
						 */
356
						/**
357
						 * WPML support
358
						 * In WPML the current language is always set to default on an edit screen
359
						 * We need to overwrite this when the current object is not-translatable to enable relationships with different languages
360
						 */
361
						if ( $translator == 'WPML' && method_exists( $sitepress, 'is_translated_taxonomy' ) && ! $sitepress->is_translated_taxonomy( $_GET['taxonomy'] ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
362
							// Overwrite the current language to nothing if this is a NOT-translatable taxonomy
363
							$current_language = '';
364
						}
365
366
						/**
367
						 * Polylang support (1.5.4+)
368
						 * In polylang the preferred language could be anything.
369
						 * We only want the related objects if they are not translatable OR the same language as the current object
370
						 */
371
						if ( $translator == 'PLL' && ! empty( $_GET['tag_ID'] ) && function_exists( 'pll_get_term_language' ) && pll_is_translated_taxonomy( sanitize_text_field( $_GET['taxonomy'] ) ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
372
							// Overwrite the current language if this is a translatable taxonomy
373
							$current_language = pll_get_term_language( (int) $_GET['tag_ID'] );
374
						}
375
					}//end if
376
377
					/**
378
					 * Polylang support (1.0.1+)
379
					 * In polylang the preferred language could be anything.
380
					 * When we're adding a new object and language is set we only want the related objects if they are not translatable OR the same language
381
					 */
382
					if ( $translator == 'PLL' && ! empty( $_GET['new_lang'] ) && ! empty( $_GET['taxonomy'] ) && pll_is_translated_taxonomy( sanitize_text_field( $_GET['taxonomy'] ) ) ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
383
						$current_language = $_GET['new_lang'];
384
					}
385
				}//end if
386
			}//end if
387
		}//end if
388
389
		$current_language = pods_sanitize( sanitize_text_field( $current_language ) );
390
391
		if ( ! empty( $current_language ) ) {
392
			// We need to return language data
393
			$lang_data = array(
394
				'language' => $current_language,
395
				't_id'     => 0,
396
				'tt_id'    => 0,
397
				'term'     => null,
398
			);
399
400
			/**
401
			 * Polylang support
402
			 * Get the language taxonomy object for the current language
403
			 */
404
			if ( $translator == 'PLL' ) {
0 ignored issues
show
Found "== '". Use Yoda Condition checks, you must
Loading history...
405
				$current_language_t = false;
406
407
				// Get the language term object
408
				if ( function_exists( 'PLL' ) && isset( PLL()->model ) && method_exists( PLL()->model, 'get_language' ) ) {
409
					// Polylang 1.8 and newer
410
					$current_language_t = PLL()->model->get_language( $current_language );
411
				} elseif ( is_object( $polylang ) && isset( $polylang->model ) && method_exists( $polylang->model, 'get_language' ) ) {
412
					// Polylang 1.2 - 1.7.x
413
					$current_language_t = $polylang->model->get_language( $current_language );
414
				} elseif ( is_object( $polylang ) && method_exists( $polylang, 'get_language' ) ) {
415
					// Polylang 1.1.x and older
416
					$current_language_t = $polylang->get_language( $current_language );
417
				}
418
419
				// If the language object exists, add it!
420
				if ( $current_language_t && ! empty( $current_language_t->term_id ) ) {
421
					$lang_data['t_id']     = (int) $current_language_t->term_id;
422
					$lang_data['tt_id']    = (int) $current_language_t->term_taxonomy_id;
423
					$lang_data['tl_t_id']  = (int) $current_language_t->tl_term_id;
424
					$lang_data['tl_tt_id'] = (int) $current_language_t->tl_term_taxonomy_id;
425
					$lang_data['term']     = $current_language_t;
426
				}
427
			}//end if
428
		}//end if
429
430
		/**
431
		 * Override language data used by Pods.
432
		 *
433
		 * @since 2.6.6
434
		 *
435
		 * @param array|false    $lang_data  {
436
		 *                                   Language data
437
		 *
438
		 * @type string          $language   Language slug
439
		 * @type int             $t_id       Language term_id
440
		 * @type int             $tt_id      Language term_taxonomy_id
441
		 * @type WP_Term         $term       Language term object
442
		 * }
443
		 *
444
		 * @param string|boolean $translator Language plugin used
445
		 */
446
		$lang_data = apply_filters( 'pods_get_current_language', $lang_data, $translator );
447
448
		self::$current_language      = $lang_data['language'];
449
		self::$current_language_data = $lang_data;
450
451
		return $lang_data;
452
453
	}
454
455
	/**
456
	 * Add Pods templates to possible i18n enabled post-types (polylang settings).
457
	 *
458
	 * @since  2.7
459
	 *
460
	 * @param  array $post_types
461
	 * @param  bool  $is_settings
462
	 *
463
	 * @return array  mixed
464
	 */
465
	public function pll_get_post_types( $post_types, $is_settings = false ) {
466
467
		if ( $is_settings ) {
468
			$post_types['_pods_template'] = '_pods_template';
469
		}
470
471
		return $post_types;
472
	}
473
474
}
475