Issues (2873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

ui/js/jquery.pods.attach.js (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
/*@global PodsI18n */
2
var pods_file_context = false; // tracks whether or not we've got a thickbox displayed in our context
3
var pods_file_thickbox_modder; // stores our interval for making necessary changes to thickbox content
4
5
// handle our thickbox mods
6
function pods_attachments ( src, file_limit ) {
7
    var pods_thickbox = jQuery( '#TB_iframeContent' ).contents();
8
9
    // add quick add text so we dont have to expand each line item
10
    var wp_media_show_links = pods_thickbox.find( 'div.media-item a.describe-toggle-on' );
11
12
    // loop through each 'Show' link and check if we added an 'Add' action next to it
13
    for ( var x = 0, len = wp_media_show_links.length; x < len; x++ ) {
14
        var wp_media_show = jQuery( wp_media_show_links[x] );
15
16
        if ( wp_media_show.data( 'pods-injected-quick-add') !== true ) {
17
            // Create 'Add' link
18
            var pods_file_quick_add = jQuery( '<a href="#">' + PodsI18n.__( 'Add' ) + '</a>' ).addClass( 'pods-quick-add' );
0 ignored issues
show
PodsI18n does not seem to be defined.
Loading history...
19
20
            pods_file_quick_add.bind( 'click', function( e ) {
0 ignored issues
show
It is generally not recommended to make functions within a loop.

While making functions in a loop will not lead to any runtime error, the code might not behave as you expect as the variables in the scope are not imported by value, but by reference. Let’s take a look at an example:

var funcs = [];
for (var i=0; i<10; i++) {
    funcs.push(function() {
        alert(i);
    });
}

funcs[0](); // alert(10);
funcs[1](); // alert(10);
/// ...
funcs[9](); // alert(10);

If you would instead like to bind the function inside the loop to the value of the variable during that specific iteration, you can create the function from another function:

var createFunc = function(i) {
    return function() {
        alert(i);
    };
};

var funcs = [];
for (var i=0; i<10; i++) {
    funcs.push(createFunc(i));
}

funcs[0](); // alert(0)
funcs[1](); // alert(1)
// ...
funcs[9](); // alert(9)
Loading history...
21
                var item = jQuery( this );
22
                var item_parent = item.parent();
23
24
                item.fadeOut( 'fast', function() {
25
26
                    // Not sure if the close link should be there for each link?
27
                    item.before( '<span class="pods-attached pods-quick-add">' + PodsI18n.__( 'Added!' ) + '</span>' );
0 ignored issues
show
PodsI18n does not seem to be defined.
Loading history...
28
                    //item.before( '<span class="pods-attached pods-quick-add">Added! <a href="#">close this box</a>.</span>' );
29
30
                    item.remove(); }
31
                );
32
33
                var wp_media_meta = item_parent;
34
35
                pods_thickbox_send( wp_media_meta, e );
36
37
                item_parent.find( 'span.pods-attached a' ).on( 'click', function ( e ) {
38
                    parent.eval( 'tb_remove()' );
39
                } );
40
41
                item_parent.find( 'span.pods-attached' ).delay( 6000 ).fadeOut( 'fast' );
42
43
                e.preventDefault();
44
            } );
45
46
            wp_media_show.after( pods_file_quick_add );
47
48
            wp_media_show.data( 'pods-injected-quick-add', true );
49
        }
50
    }
51
52
    pods_thickbox.find( 'td.savesend input' ).unbind( 'click' ).click( function ( e ) {
53
        var wp_media_meta = jQuery( this ).parent().parent().parent();
54
55
        pods_thickbox_send( wp_media_meta, e );
56
    } );
57
58
    function pods_thickbox_send ( wp_media_meta, e ) {
59
        // grab our meta as per the Media library
60
        var wp_media_title = wp_media_meta.find( 'tr.post_title td.field input' ).val();
61
        //var wp_media_caption = wp_media_meta.find( 'tr.post_excerpt td.field input' ).val();
62
        var wp_media_id = wp_media_meta.find( 'td.imgedit-response' ).attr( 'id' ).replace( 'imgedit-response-', '' );
63
        var wp_media_thumb = wp_media_meta.parent().find( 'img.thumbnail' ).attr( 'src' );
64
        var wp_media_link = wp_media_meta.find( 'tr.url td.field input.urlfield' ).val();
65
66
        // use the data we found to form a new Pods file entry and append it to the DOM
67
        var source = jQuery( '#' + src + '-handlebars' ).html();
68
69
        var binding = {
70
            id : wp_media_id,
71
            name : wp_media_title,
72
            icon : wp_media_thumb
73
        };
74
75
        var tmpl = Handlebars.compile( source );
0 ignored issues
show
Handlebars does not seem to be defined.
Loading history...
76
77
        pods_file_context.prepend( tmpl( binding ) );
78
79
        if ( !pods_file_context.is( ':visible' ) )
80
            pods_file_context.show().removeClass( 'hidden' );
0 ignored issues
show
{ was expected, but instead pods_file_context was given.
Loading history...
81
82
        pods_file_context.find( 'li#pods-file-' + wp_media_id ).slideDown( 'fast' );
83
84
        var items = pods_file_context.find( 'li.pods-file' ),
85
            itemCount = items.size();
86
87
        if ( 0 < file_limit && itemCount > file_limit ) {
88
            items.each( function ( idx, elem ) {
89
                if ( idx + 1 > file_limit ) {
90
                    jQuery( elem ).remove();
91
                }
92
            } );
93
        }
94
95
        if ( 1 < file_limit || file_limit == 0 ) {
0 ignored issues
show
=== was expected, but instead == was given.
Loading history...
96
            jQuery( this ).after( ' <span class="pods-attached">' + PodsI18n.__( 'Added! Choose another or <a href="#">close this box</a>' ) + '</span>' );
0 ignored issues
show
Possible strict violation.
Loading history...
PodsI18n does not seem to be defined.
Loading history...
97
            jQuery( this ).parent().find( 'span.pods-attached a' ).on( 'click', function ( e ) {
0 ignored issues
show
Possible strict violation.
Loading history...
98
                parent.eval( 'tb_remove()' );
99
100
                e.preventDefault();
101
            } );
102
            jQuery( this ).parent().find( 'span.pods-attached' ).delay( 6000 ).fadeOut( 'fast' );
0 ignored issues
show
Possible strict violation.
Loading history...
103
        }
104
        else {
105
            parent.eval( 'tb_remove()' );
106
        }
107
108
        e.preventDefault();
109
    }
110
111
    // update button
112
    if ( pods_thickbox.find( '.media-item .savesend input[type=submit], #insertonlybutton' ).length ) {
113
        pods_thickbox.find( '.media-item .savesend input[type=submit], #insertonlybutton' ).val( 'Select' );
114
    }
115
116
    // hide the URL tab
117
    if ( pods_thickbox.find( '#tab-type_url' ).length )
118
        pods_thickbox.find( '#tab-type_url' ).hide();
0 ignored issues
show
{ was expected, but instead pods_thickbox was given.
Loading history...
119
120
    // we need to ALWAYS get the fullsize since we're retrieving the guid
121
    // if the user inserts an image somewhere else and chooses another size, everything breaks, so we'll force it
122
    if ( pods_thickbox.find( 'tr.post_title' ).length ) {
123
        pods_thickbox.find( 'tr.image-size input[value="full"]' ).prop( 'checked', true );
124
        pods_thickbox.find( 'tr.image-size,tr.post_content,tr.url,tr.align,tr.submit>td>a.del-link' ).hide();
125
    }
126
127
    // was the thickbox closed?
128
    if ( pods_thickbox.length == 0 && pods_file_context ) {
0 ignored issues
show
=== was expected, but instead == was given.
Loading history...
129
        clearInterval( pods_file_thickbox_modder );
130
        pods_file_context = false;
131
    }
132
}
133