Issues (2873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

deprecated/deprecated.php (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 19 and the first side effect is on line 12.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * @package Pods\Deprecated
4
 */
5
6
/**
7
 *
8
 */
9
10
// JSON support
11
if ( ! function_exists( 'json_encode' ) ) {
12
	require_once ABSPATH . '/wp-includes/js/tinymce/plugins/spellchecker/classes/utils/JSON.php';
13
14
	/**
15
	 * @param mixed $str Data to encode.
16
	 *
17
	 * @return mixed
18
	 */
19
	function json_encode( $str ) {
20
21
		$json = new Moxiecode_JSON();
22
23
		return $json->encode( $str );
24
	}
25
26
	/**
27
	 * @param string $str JSON string.
28
	 *
29
	 * @return mixed
30
	 */
31
	function json_decode( $str ) {
32
33
		$json = new Moxiecode_JSON();
34
35
		return $json->decode( $str );
36
	}
37
}//end if
38
39
// WP 3.4.x support
40
if ( ! function_exists( 'wp_send_json' ) ) {
41
	/**
42
	 * @param array $response Response data.
43
	 */
44
	function wp_send_json( $response ) {
45
46
		@header( 'Content-Type: application/json; charset=' . get_option( 'blog_charset' ) );
0 ignored issues
show
Silencing errors is discouraged
Loading history...
47
		echo json_encode( $response );
48
		if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
49
			wp_die();
50
		} else {
51
			die;
52
		}
53
	}
54
}
55
56
/**
57
 * Get the full URL of the current page
58
 *
59
 * @return string
60
 * @since      1.9.6
61
 *
62
 * @deprecated 2.3
63
 */
64
if ( ! function_exists( 'get_current_url' ) ) {
65
	/**
66
	 * @return mixed|void
67
	 */
68
	function get_current_url() {
69
70
		$url = pods_current_url();
71
72
		return apply_filters( 'get_current_url', $url );
73
	}
74
}
75
76
/**
77
 * Mapping function to new function name (following normalization of function names from pod_ to pods_)
78
 *
79
 * @since      1.x
80
 * @deprecated deprecated since version 2.0
81
 *
82
 * @param string      $sql              SQL query.
83
 * @param string      $error            Error message on failure.
84
 * @param null|string $results_error    Error message if results returned.
85
 * @param null|string $no_results_error Error message if no results returned.
86
 *
87
 * @return array|bool|mixed|null|void Result of the query
88
 */
89
function pod_query( $sql, $error = 'SQL failed', $results_error = null, $no_results_error = null ) {
90
91
	pods_deprecated( 'pod_query', '2.0', 'pods_query' );
92
	global $wpdb;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
93
94
	$sql = trim( $sql );
95
96
	// Using @wp_users is deprecated! use $wpdb->users instead!
97
	$sql = str_replace( '@wp_pod_tbl_', $wpdb->prefix . 'pods_', $sql );
98
	$sql = str_replace( '@wp_users', $wpdb->users, $sql );
0 ignored issues
show
Usage of users/usermeta tables is highly discouraged in VIP context, For storing user additional user metadata, you should look at User Attributes.
Loading history...
99
	$sql = str_replace( '@wp_', $wpdb->prefix, $sql );
100
	$sql = str_replace( '{prefix}', '@wp_', $sql );
101
102
	$sql = apply_filters( 'pod_query', $sql, $error, $results_error, $no_results_error );
103
104
	$result = pods_query( $sql, $error, $results_error, $no_results_error );
105
106
	$result = apply_filters( 'pod_query_return', $result, $sql, $error, $results_error, $no_results_error );
107
108
	return $result;
109
}
110
111
/**
112
 * Include and Init the Pods class
113
 *
114
 * @since      1.x
115
 * @deprecated deprecated since version 2.0
116
 * @package    Pods\Deprecated
117
 */
118
class Pod {
119
120
	private $new;
121
122
	public static $deprecated_notice = true;
123
124
	public $body_classes;
125
126
	public $ui = array();
0 ignored issues
show
Comprehensibility introduced by
Avoid variables with short names like $ui. Configured minimum length is 3.

Short variable names may make your code harder to understand. Variable names should be self-descriptive. This check looks for variable names who are shorter than a configured minimum.

Loading history...
127
128
	public $meta = array();
129
130
	public $meta_properties = array();
131
132
	public $meta_extra = '';
133
134
	/**
135
	 * Pod constructor.
136
	 *
137
	 * @param null $type
138
	 * @param null $id
139
	 */
140
	public function __construct( $type = null, $id = null ) {
141
142
		if ( self::$deprecated_notice ) {
143
			pods_deprecated( 'PodAPI (class)', '2.0', 'pods_api (function)' );
144
		}
145
146
		pods_deprecated( 'Pod (class)', '2.0', 'pods (function)' );
147
148
		$this->new = pods( $type, $id );
149
	}
150
151
	/**
152
	 * Handle variables that have been deprecated
153
	 *
154
	 * @since 2.0
155
	 *
156
	 * @param string $name Property name.
157
	 *
158
	 * @return array|bool|int|mixed|PodsData
159
	 */
160
	public function __get( $name ) {
161
162
		$name = (string) $name;
163
164
		if ( 'data' === $name ) {
165
			if ( self::$deprecated_notice ) {
166
				pods_deprecated( "Pods->{$name}", '2.0', 'Pods->row()' );
167
			}
168
169
			$var = $this->new->row();
170
		} elseif ( '_data' === $name ) {
171
			$var = $this->new->data;
172
		} elseif ( 'total' === $name ) {
173
			if ( self::$deprecated_notice ) {
174
				pods_deprecated( "Pods->{$name}", '2.0', 'Pods->total()' );
175
			}
176
177
			$var = $this->new->total();
178
		} elseif ( 'total_rows' === $name ) {
179
			if ( self::$deprecated_notice ) {
180
				pods_deprecated( "Pods->{$name}", '2.0', 'Pods->total_found()' );
181
			}
182
183
			$var = $this->new->total_found();
184
		} elseif ( 'zebra' === $name ) {
185
			if ( self::$deprecated_notice ) {
186
				pods_deprecated( "Pods->{$name}", '2.0', 'Pods->zebra()' );
187
			}
188
189
			$var = $this->new->zebra();
190
		} else {
191
			$var = $this->new->{$name};
192
		}//end if
193
194
		return $var;
195
	}
196
197
	/**
198
	 * Handle variables that have been deprecated
199
	 *
200
	 * @since 2.0
201
	 *
202
	 * @param string $name  Property name.
203
	 * @param mixed  $value Property value to set.
204
	 *
205
	 * @return mixed
206
	 */
207
	public function __set( $name, $value ) {
208
209
		$name = (string) $name;
210
211
		$this->new->{$name} = $value;
212
213
		return $value;
214
	}
215
216
	/**
217
	 * Handle methods that have been deprecated
218
	 *
219
	 * @since 2.0
220
	 *
221
	 * @param string $name Call name.
222
	 * @param array  $args Call arguments.
223
	 *
224
	 * @return mixed
225
	 */
226
	public function __call( $name, $args ) {
227
228
		$name = (string) $name;
229
230
		return call_user_func_array( array( $this->new, $name ), $args );
231
	}
232
233
	/**
234
	 * Handle variables that have been deprecated
235
	 *
236
	 * @since 2.0
237
	 *
238
	 * @param string $name Property name.
239
	 *
240
	 * @return bool
241
	 */
242
	public function __isset( $name ) {
243
244
		$name = (string) $name;
245
246
		if ( in_array( $name, array( '_data', 'data', 'total', 'total_rows', 'zebra' ), true ) ) {
247
			return true;
248
		} elseif ( in_array( $name, array( 'meta', 'meta_properties', 'meta_extra' ), true ) ) {
249
			return true;
250
		} else {
251
			return isset( $this->new->{$name} );
252
		}
253
	}
254
}
255
256
/**
257
 * Include and Init the PodsAPI class
258
 *
259
 * @since      1.x
260
 * @deprecated deprecated since version 2.0
261
 * @package    Pods\Deprecated
262
 */
263
class PodAPI {
264
265
	private $new;
266
267
	public static $deprecated_notice = true;
268
269
	/**
270
	 * PodAPI constructor.
271
	 *
272
	 * @param null $type
273
	 * @param null $format
274
	 */
275
	public function __construct( $type = null, $format = null ) {
276
277
		if ( self::$deprecated_notice ) {
278
			pods_deprecated( 'PodAPI (class)', '2.0', 'pods_api (function)' );
279
		}
280
281
		$this->new = pods_api( $type, $format );
282
	}
283
284
	/**
285
	 * Handle variables that have been deprecated
286
	 *
287
	 * @since 2.0
288
	 *
289
	 * @param string $name Property name.
290
	 *
291
	 * @return null|mixed
292
	 */
293
	public function __get( $name ) {
294
295
		$name = (string) $name;
296
297
		$var = $this->new->{$name};
298
299
		return $var;
300
	}
301
302
	/**
303
	 * Handle methods that have been deprecated
304
	 *
305
	 * @since 2.0
306
	 *
307
	 * @param string $name Call name.
308
	 * @param array  $args Call arguments.
309
	 *
310
	 * @return mixed
311
	 */
312
	public function __call( $name, $args ) {
313
314
		$name = (string) $name;
315
316
		return call_user_func_array( array( $this->new, $name ), $args );
317
	}
318
}
319
320
/**
321
 * Include and Init the PodsUI class
322
 *
323
 * @since      2.0
324
 * @deprecated deprecated since version 2.0
325
 *
326
 * @param Pods $obj Pods object.
327
 *
328
 * @return PodsUI
329
 */
330
function pods_ui_manage( $obj ) {
331
332
	pods_deprecated( 'pods_ui_manage', '2.0', 'pods_ui' );
333
334
	return pods_ui( $obj, true );
335
}
336
337
/**
338
 * Limit Access based on Field Value
339
 *
340
 * @since      1.x
341
 * @deprecated deprecated since version 2.0
342
 *
343
 * @param Pods   $object Pods object.
344
 * @param array  $access Access array.
345
 * @param string $what   Action name.
346
 *
347
 * @return bool
348
 */
349
function pods_ui_access( $object, $access, $what ) {
350
351
	pods_deprecated( 'pods_ui_access', '2.0' );
352
	if ( is_array( $access ) ) {
353
		foreach ( $access as $field => $match ) {
354
			if ( is_array( $match ) ) {
355
				$okay = false;
356
				foreach ( $match as $the_field => $the_match ) {
357
					if ( $object->get_field( $the_field ) == $the_match ) {
0 ignored issues
show
Documentation Bug introduced by
The method get_field does not exist on object<Pods>? Since you implemented __call, maybe consider adding a @method annotation.

If you implement __call and you know which methods are available, you can improve IDE auto-completion and static analysis by adding a @method annotation to the class.

This is often the case, when __call is implemented by a parent class and only the child class knows which methods exist:

class ParentClass {
    private $data = array();

    public function __call($method, array $args) {
        if (0 === strpos($method, 'get')) {
            return $this->data[strtolower(substr($method, 3))];
        }

        throw new \LogicException(sprintf('Unsupported method: %s', $method));
    }
}

/**
 * If this class knows which fields exist, you can specify the methods here:
 *
 * @method string getName()
 */
class SomeClass extends ParentClass { }
Loading history...
358
						$okay = true;
359
					}
360
				}
361
				if ( false === $okay ) {
362
					return false;
363
				}
364
			} elseif ( $object->get_field( $field ) != $match ) {
0 ignored issues
show
Documentation Bug introduced by
The method get_field does not exist on object<Pods>? Since you implemented __call, maybe consider adding a @method annotation.

If you implement __call and you know which methods are available, you can improve IDE auto-completion and static analysis by adding a @method annotation to the class.

This is often the case, when __call is implemented by a parent class and only the child class knows which methods exist:

class ParentClass {
    private $data = array();

    public function __call($method, array $args) {
        if (0 === strpos($method, 'get')) {
            return $this->data[strtolower(substr($method, 3))];
        }

        throw new \LogicException(sprintf('Unsupported method: %s', $method));
    }
}

/**
 * If this class knows which fields exist, you can specify the methods here:
 *
 * @method string getName()
 */
class SomeClass extends ParentClass { }
Loading history...
365
				return false;
366
			}
367
		}
368
	}
369
370
	return true;
371
}
372
373
/**
374
 * Return a GET, POST, COOKIE, SESSION, or URI string segment
375
 *
376
 * @param mixed  $key  The variable name or URI segment position
377
 * @param string $type (optional) "uri", "get", "post", "request", "server", "session", or "cookie"
378
 *
379
 * @return string The requested value, or null
380
 * @since      1.6.2
381
 * @deprecated deprecated since version 2.0
382
 */
383
function pods_url_variable( $key = 'last', $type = 'url' ) {
384
385
	$output = apply_filters( 'pods_url_variable', pods_var( $key, $type ), $key, $type );
386
387
	return $output;
388
}
389
390
/**
391
 * Generate form key - INTERNAL USE
392
 *
393
 * @since      1.2.0
394
 * @deprecated deprecated since version 2.0
395
 *
396
 * @param string $datatype   Pod name.
397
 * @param string $uri_hash   URI hash for session.
398
 * @param array  $columns    List of columns.
399
 * @param int    $form_count Form counter.
400
 *
401
 * @return mixed|string|void
402
 */
403
function pods_generate_key( $datatype, $uri_hash, $columns, $form_count = 1 ) {
404
405
	$token                             = wp_create_nonce( 'pods-form-' . $datatype . '-' . (int) $form_count . '-' . $uri_hash . '-' . json_encode( $columns ) );
406
	$token                             = apply_filters( 'pods_generate_key', $token, $datatype, $uri_hash, $columns, (int) $form_count );
407
	$_SESSION[ 'pods_form_' . $token ] = $columns;
0 ignored issues
show
Usage of $_SESSION variable is prohibited.
Loading history...
408
409
	return $token;
410
}
411
412
/**
413
 * Validate form key - INTERNAL USE
414
 *
415
 * @since      1.2.0
416
 * @deprecated deprecated since version 2.0
417
 *
418
 * @param string     $token      Nonce token.
419
 * @param string     $datatype   Pod name.
420
 * @param string     $uri_hash   URI hash for session.
421
 * @param null|array $columns    List of columns.
422
 * @param int        $form_count Form counter.
423
 *
424
 * @return mixed|void
425
 */
426
function pods_validate_key( $token, $datatype, $uri_hash, $columns = null, $form_count = 1 ) {
427
428
	if ( null === $columns && ! empty( $_SESSION ) && isset( $_SESSION[ 'pods_form_' . $token ] ) ) {
0 ignored issues
show
Usage of $_SESSION variable is prohibited.
Loading history...
429
		$columns = $_SESSION[ 'pods_form_' . $token ];
0 ignored issues
show
Usage of $_SESSION variable is prohibited.
Loading history...
430
	}
431
	$success = false;
432
	if ( false !== wp_verify_nonce( $token, 'pods-form-' . $datatype . '-' . (int) $form_count . '-' . $uri_hash . '-' . json_encode( $columns ) ) ) {
433
		$success = $columns;
434
	}
435
436
	return apply_filters( 'pods_validate_key', $success, $token, $datatype, $uri_hash, $columns, (int) $form_count );
437
}
438
439
/**
440
 * Output a message in the WP Dashboard UI
441
 *
442
 * @param string $message
443
 * @param bool   $error Whether or not it is an error message
444
 *
445
 * @return bool
0 ignored issues
show
Should the return type not be boolean|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
446
 *
447
 * @since     1.12
448
 * @deprcated 2.3
449
 */
450
function pods_ui_message( $message, $error = false ) {
451
452
	pods_deprecated( 'pods_message', '2.3' );
453
454
	pods_message( $message, ( $error ? 'error' : 'notice' ) );
455
}
456
457
/**
458
 * Output an error in the WP Dashboard UI
459
 *
460
 * @param string $message
461
 *
462
 * @return bool
0 ignored issues
show
Should the return type not be boolean|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
463
 *
464
 * @since     1.12
465
 * @deprcated 2.3
466
 */
467
function pods_ui_error( $message ) {
468
469
	pods_deprecated( 'pods_message', '2.3' );
470
471
	pods_message( $message, 'error' );
472
}
473
474
/**
475
 * Get a Point value from a Pods Version number
476
 *
477
 * @since     1.10.1
478
 * @deprcated 2.3
479
 *
480
 * @param string $point Version number with points.
481
 *
482
 * @return int|string
483
 */
484
function pods_point_to_version( $point ) {
485
486
	$version_tmp = explode( '.', $point );
487
	$version     = '';
488
489
	for ( $x = 0; $x < 3; $x ++ ) {
490
		// 3 points max - MAJOR.MINOR.PATCH
491
		if ( ! isset( $version_tmp[ $x ] ) || strlen( $version_tmp[ $x ] ) < 1 ) {
492
			$version_tmp[ $x ] = '000';
493
		}
494
495
		$version_temp = str_split( $version_tmp[ $x ] );
496
497
		if ( 3 == count( $version_temp ) ) {
498
			$version .= $version_tmp[ $x ];
499
		} elseif ( 2 == count( $version_temp ) ) {
500
			$version .= '0' . $version_tmp[ $x ];
501
		} elseif ( 1 == count( $version_temp ) ) {
502
			$version .= '00' . $version_tmp[ $x ];
503
		}
504
	}
505
506
	$version = (int) $version;
507
508
	return $version;
509
}
510
511
/**
512
 * Get a Point value from a Pods Version number
513
 *
514
 * @since     1.10
515
 * @deprcated 2.3
516
 *
517
 * @param string $version Version number string.
518
 *
519
 * @return array|string
520
 */
521
function pods_version_to_point( $version ) {
522
523
	$point_tmp = $version;
524
525
	if ( strlen( $point_tmp ) < 9 ) {
526
		if ( 8 == strlen( $point_tmp ) ) {
527
			$point_tmp = '0' . $point_tmp;
528
		}
529
530
		if ( 7 == strlen( $point_tmp ) ) {
531
			$point_tmp = '00' . $point_tmp;
532
		}
533
534
		if ( 3 == strlen( $version ) ) {
535
			// older versions prior to 1.9.9
536
			return implode( '.', str_split( $version ) );
537
		}
538
	}
539
540
	$point_tmp = str_split( $point_tmp, 3 );
541
	$point     = array();
542
543
	foreach ( $point_tmp as $the_point ) {
544
		$point[] = (int) $the_point;
545
	}
546
547
	$point = implode( '.', $point );
548
549
	return $point;
550
}
551