GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (81)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/libs/class-wp-logging.php (5 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * Class for logging events and errors
5
 *
6
 * @package     WP Logging Class
7
 * @copyright   Copyright (c) 2012, Pippin Williamson
8
 * @license     http://opensource.org/licenses/gpl-2.0.php GNU Public License
9
*/
10
11
class WP_Logging {
12
13
14
	/**
15
	 * Class constructor.
16
	 *
17
	 * @since 1.0
18
	 *
19
	 * @access public
20
	 * @return void
0 ignored issues
show
Comprehensibility Best Practice introduced by
Adding a @return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.

Adding a @return annotation to a constructor is not recommended, since a constructor does not have a meaningful return value.

Please refer to the PHP core documentation on constructors.

Loading history...
21
	 */
22
	function __construct() {
0 ignored issues
show
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
23
24
		// create the log post type
25
		add_action( 'init', array( $this, 'register_post_type' ) );
26
27
		// create types taxonomy and default types
28
		add_action( 'init', array( $this, 'register_taxonomy' ) );
29
30
		// make a cron job for this hook to start pruning
31
		add_action( 'wp_logging_prune_routine', array( $this, 'prune_logs' ) );
32
33
	}
34
35
	/**
36
	 * Allows you to tie in a cron job and prune old logs.
37
	 *
38
	 * @since 1.1
39
	 * @access public
40
	 *
41
	 * @uses $this->get_logs_to_prune()     Returns array of posts via get_posts of logs to prune
42
	 * @uses $this->prune_old_logs()        Deletes the logs that we don't want anymore
43
	 */
44
	public function prune_logs(){
45
46
		$should_we_prune = apply_filters( 'wp_logging_should_we_prune', false );
47
48
		if ( $should_we_prune === false ){
49
			return;
50
		}
51
52
		$logs_to_prune = $this->get_logs_to_prune();
53
54
		if ( isset( $logs_to_prune ) && ! empty( $logs_to_prune ) ){
55
			$this->prune_old_logs( $logs_to_prune );
56
		}
57
58
	} // prune_logs
59
60
	/**
61
	 * Deletes the old logs that we don't want
62
	 *
63
	 * @since 1.1
64
	 * @access private
65
	 *
66
	 * @param array/obj     $logs     required     The array of logs we want to prune
0 ignored issues
show
The doc-type array/obj could not be parsed: Unknown type name "array/obj" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
67
	 *
68
	 * @uses wp_delete_post()                      Deletes the post from WordPress
69
	 *
70
	 * @filter wp_logging_force_delete_log         Allows user to override the force delete setting which bypasses the trash
71
	 */
72
	private function prune_old_logs( $logs ){
73
74
		$force = apply_filters( 'wp_logging_force_delete_log', true );
75
76
		foreach( $logs as $l ){
77
			wp_delete_post( $l->ID, $force );
78
		}
79
80
	} // prune_old_logs
81
82
	/**
83
	 * Returns an array of posts that are prune candidates.
84
	 *
85
	 * @since 1.1
86
	 * @access private
87
	 *
88
	 * @return array     $old_logs     The array of posts that were returned from get_posts
89
	 *
90
	 * @uses apply_filters()           Allows users to change given args
91
	 * @uses get_posts()               Returns an array of posts from given args
92
	 *
93
	 * @filter wp_logging_prune_when           Users can change how long ago we are looking for logs to prune
94
	 * @filter wp_logging_prune_query_args     Gives users access to change any query args for pruning
95
	 */
96
	private function get_logs_to_prune(){
97
98
		$how_old = apply_filters( 'wp_logging_prune_when', '2 weeks ago' );
99
100
		$args = array(
101
			'post_type'      => 'wp_log',
102
			'posts_per_page' => '100',
103
			'date_query'     => array(
104
				array(
105
					'column' => 'post_date_gmt',
106
					'before' => (string) $how_old,
107
				)
108
			)
109
		);
110
111
		$old_logs = get_posts( apply_filters( 'wp_logging_prune_query_args', $args ) );
112
113
		return $old_logs;
114
115
	} // get_logs_to_prune
116
117
	/**
118
	 * Log types
119
	 *
120
	 * Sets up the default log types and allows for new ones to be created
121
	 *
122
	 * @access      private
123
	 * @since       1.0
124
	 *
125
	 * @return     array
126
	*/
127
128
	private static function log_types() {
129
		$terms = array(
130
			'error', 'event'
131
		);
132
133
		return apply_filters( 'wp_log_types', $terms );
134
	}
135
136
137
	/**
138
	 * Registers the wp_log Post Type
139
	 *
140
	 * @access      public
141
	 * @since       1.0
142
	 *
143
	 * @uses 		register_post_type()
144
	 *
145
	 * @return     void
146
	*/
147
148
	public function register_post_type() {
149
150
		/* logs post type */
151
152
		$log_args = array(
153
			'labels'              => array( 'name' => __( 'Logs', 'wp-logging' ) ),
154
			'public'              => defined( 'WP_DEBUG' ) && WP_DEBUG,
155
			'query_var'           => false,
156
			'rewrite'             => false,
157
			'capability_type'     => 'post',
158
			'supports'            => array( 'title', 'editor' ),
159
			'can_export'          => false,
160
			'exclude_from_search' => true,
161
			'publicly_queryable'  => false,
162
163
		);
164
		register_post_type( 'wp_log', apply_filters( 'wp_logging_post_type_args', $log_args ) );
165
166
	}
167
168
169
	/**
170
	 * Registers the Type Taxonomy
171
	 *
172
	 * The Type taxonomy is used to determine the type of log entry
173
	 *
174
	 * @access      public
175
	 * @since       1.0
176
	 *
177
	 * @uses 		register_taxonomy()
178
	 * @uses 		term_exists()
179
	 * @uses 		wp_insert_term()
180
	 *
181
	 * @return     void
182
	*/
183
184
	public function register_taxonomy() {
185
186
		register_taxonomy( 'wp_log_type', 'wp_log', array( 'public' => defined( 'WP_DEBUG' ) && WP_DEBUG ) );
187
188
		$types = self::log_types();
189
190
		foreach ( $types as $type ) {
191
			if( ! term_exists( $type, 'wp_log_type' ) ) {
192
				wp_insert_term( $type, 'wp_log_type' );
193
			}
194
		}
195
	}
196
197
198
	/**
199
	 * Check if a log type is valid
200
	 *
201
	 * Checks to see if the specified type is in the registered list of types
202
	 *
203
	 * @access      private
204
	 * @since       1.0
205
	 *
206
	 *
207
	 * @return     array
208
	*/
209
210
	private static function valid_type( $type ) {
211
		return in_array( $type, self::log_types() );
212
	}
213
214
215
	/**
216
	 * Create new log entry
217
	 *
218
	 * This is just a simple and fast way to log something. Use self::insert_log()
219
	 * if you need to store custom meta data
220
	 *
221
	 * @access      private
222
	 * @since       1.0
223
	 *
224
	 * @uses 		self::insert_log()
225
	 *
226
	 * @return      int The ID of the new log entry
227
	*/
228
229
	public static function add( $title = '', $message = '', $parent = 0, $type = null ) {
230
231
		$log_data = array(
232
			'post_title'   => $title,
233
			'post_content' => $message,
234
			'post_parent'  => $parent,
235
			'log_type'     => $type
236
		);
237
238
		return self::insert_log( $log_data );
239
240
	}
241
242
243
	/**
244
	 * Stores a log entry
245
	 *
246
	 * @access      private
247
	 * @since       1.0
248
	 *
249
	 * @uses 		wp_parse_args()
250
	 * @uses 		wp_insert_post()
251
	 * @uses 		update_post_meta()
252
	 * @uses 		wp_set_object_terms()
253
	 * @uses 		sanitize_key()
254
	 *
255
	 * @return      int The ID of the newly created log item
256
	*/
257
258
	public static function insert_log( $log_data = array(), $log_meta = array() ) {
259
260
		$defaults = array(
261
			'post_type'    => 'wp_log',
262
			'post_status'  => 'publish',
263
			'post_parent'  => 0,
264
			'post_content' => '',
265
			'log_type'     => false
266
		);
267
268
		$args = wp_parse_args( $log_data, $defaults );
269
270
		do_action( 'wp_pre_insert_log' );
271
272
		// store the log entry
273
		$log_id = wp_insert_post( $args );
274
275
		// set the log type, if any
276
		if( $log_data['log_type'] && self::valid_type( $log_data['log_type'] ) ) {
277
			wp_set_object_terms( $log_id, $log_data['log_type'], 'wp_log_type', false );
278
		}
279
280
281
		// set log meta, if any
282
		if( $log_id && ! empty( $log_meta ) ) {
283
			foreach( (array) $log_meta as $key => $meta ) {
284
				update_post_meta( $log_id, '_wp_log_' . sanitize_key( $key ), $meta );
285
			}
286
		}
287
288
		do_action( 'wp_post_insert_log', $log_id );
289
290
		return $log_id;
291
292
	}
293
294
295
	/**
296
	 * Update and existing log item
297
	 *
298
	 * @access      private
299
	 * @since       1.0
300
	 *
301
	 * @uses 		wp_parse_args()
302
	 * @uses 		wp_update_post()
303
	 * @uses 		update_post_meta()
304
	 *
305
	 * @return      bool True if successful, false otherwise
306
	*/
307
	public static function update_log( $log_data = array(), $log_meta = array() ) {
308
309
		do_action( 'wp_pre_update_log', $log_id );
0 ignored issues
show
The variable $log_id seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition?

This error can happen if you refactor code and forget to move the variable initialization.

Let’s take a look at a simple example:

function someFunction() {
    $x = 5;
    echo $x;
}

The above code is perfectly fine. Now imagine that we re-order the statements:

function someFunction() {
    echo $x;
    $x = 5;
}

In that case, $x would be read before it is initialized. This was a very basic example, however the principle is the same for the found issue.

Loading history...
310
311
		$defaults = array(
312
			'post_type'   => 'wp_log',
313
			'post_status' => 'publish',
314
			'post_parent' => 0
315
		);
316
317
		$args = wp_parse_args( $log_data, $defaults );
318
319
		// store the log entry
320
		$log_id = wp_update_post( $args );
321
322
		if( $log_id && ! empty( $log_meta ) ) {
323
			foreach( (array) $log_meta as $key => $meta ) {
324
				if( ! empty( $meta ) )
325
					update_post_meta( $log_id, '_wp_log_' . sanitize_key( $key ), $meta );
326
			}
327
		}
328
329
		do_action( 'wp_post_update_log', $log_id );
330
331
	}
332
333
334
	/**
335
	 * Easily retrieves log items for a particular object ID
336
	 *
337
	 * @access      private
338
	 * @since       1.0
339
	 *
340
	 * @uses 		self::get_connected_logs()
341
	 *
342
	 * @return      array
343
	*/
344
345
	public static function get_logs( $object_id = 0, $type = null, $paged = null ) {
346
		return self::get_connected_logs( array( 'post_parent' => $object_id, 'paged' => $paged, 'log_type' => $type ) );
347
348
	}
349
350
351
	/**
352
	 * Retrieve all connected logs
353
	 *
354
	 * Used for retrieving logs related to particular items, such as a specific purchase.
355
	 *
356
	 * @access  private
357
	 * @since 	1.0
358
	 *
359
	 * @uses 	wp_parse_args()
360
	 * @uses 	get_posts()
361
	 * @uses 	get_query_var()
362
	 * @uses 	self::valid_type()
363
	 *
364
	 * @return  array / false
365
	*/
366
367
	public static function get_connected_logs( $args = array() ) {
368
369
		$defaults = array(
370
			'post_parent'    => 0,
371
			'post_type'      => 'wp_log',
372
			'posts_per_page' => 10,
373
			'post_status'    => 'publish',
374
			'paged'          => get_query_var( 'paged' ),
375
			'log_type'       => false
376
		);
377
378
		$query_args = wp_parse_args( $args, $defaults );
379
380
		if( $query_args['log_type'] && self::valid_type( $query_args['log_type'] ) ) {
381
382
			$query_args['tax_query'] = array(
383
				array(
384
					'taxonomy' => 'wp_log_type',
385
					'field'    => 'slug',
386
					'terms'    => $query_args['log_type']
387
				)
388
			);
389
390
		}
391
392
		$logs = get_posts( $query_args );
393
394
		if( $logs )
395
			return $logs;
396
397
		// no logs found
398
		return false;
0 ignored issues
show
Bug Best Practice introduced by
The return type of return false; (false) is incompatible with the return type documented by WP_Logging::get_connected_logs of type array.

If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.

Let’s take a look at an example:

class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}

Our function my_function expects a Post object, and outputs the author of the post. The base class Post returns a simple string and outputting a simple string will work just fine. However, the child class BlogPost which is a sub-type of Post instead decided to return an object, and is therefore violating the SOLID principles. If a BlogPost were passed to my_function, PHP would not complain, but ultimately fail when executing the strtoupper call in its body.

Loading history...
399
400
	}
401
402
403
	/**
404
	 * Retrieves number of log entries connected to particular object ID
405
	 *
406
	 * @access  private
407
	 * @since 	1.0
408
	 *
409
	 * @uses 	WP_Query()
410
	 * @uses 	self::valid_type()
411
	 *
412
	 * @return  int
413
	*/
414
415
	public static function get_log_count( $object_id = 0, $type = null, $meta_query = null ) {
416
417
		$query_args = array(
418
			'post_parent'    => $object_id,
419
			'post_type'      => 'wp_log',
420
			'posts_per_page' => -1,
421
			'post_status'    => 'publish'
422
		);
423
424
		if( ! empty( $type ) && self::valid_type( $type ) ) {
425
426
			$query_args['tax_query'] = array(
427
				array(
428
					'taxonomy' => 'wp_log_type',
429
					'field'    => 'slug',
430
					'terms'    => $type
431
				)
432
			);
433
434
		}
435
436
		if( ! empty( $meta_query ) ) {
437
			$query_args['meta_query'] = $meta_query;
438
		}
439
440
		$logs = new WP_Query( $query_args );
441
442
		return (int) $logs->post_count;
443
444
	}
445
446
}
447
$GLOBALS['wp_logs'] = new WP_Logging();
448