Issues (4335)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/emails/class-donation-receipt-email.php (5 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Donation Receipt Email
4
 *
5
 *
6
 * @package     Give
7
 * @subpackage  Classes/Emails
8
 * @copyright   Copyright (c) 2016, GiveWP
9
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
10
 * @since       2.0
11
 */
12
13
// Exit if access directly.
14
if ( ! defined( 'ABSPATH' ) ) {
15
	exit;
16
}
17
18
if ( ! class_exists( 'Give_Donation_Receipt_Email' ) ) :
19
20
	/**
21
	 * Give_Donation_Receipt_Email
22
	 *
23
	 * @abstract
24
	 * @since       2.0
25
	 */
26
	class Give_Donation_Receipt_Email extends Give_Email_Notification {
27
		/* @var Give_Payment $payment */
28
		public $payment;
29
30
		/**
31
		 * Create a class instance.
32
		 *
33
		 * @access  public
34
		 * @since   2.0
35
		 */
36
		public function init() {
37
			// Initialize empty payment.
38
			$this->payment = new Give_Payment( 0 );
39
40
			$this->load( array(
41
				'id'                   => 'donation-receipt',
42
				'label'                => __( 'Donation Receipt', 'give' ),
43
				'description'          => __( 'Sent to the donor when their donation completes or a pending donation is marked as complete.', 'give' ),
44
				'notification_status'  => 'enabled',
45
				'form_metabox_setting' => true,
46
				'recipient_group_name' => __( 'Donor', 'give' ),
47
				'default_email_subject' => esc_attr__( 'Donation Receipt', 'give' ),
48
				'default_email_message' => give_get_default_donation_receipt_email(),
49
				'default_email_header'  => __( 'Donation Receipt', 'give' ),
50
			) );
51
52
			add_action( "give_{$this->config['id']}_email_notification", array( $this, 'send_donation_receipt' ) );
53
			add_action( 'give_email_links', array( $this, 'resend_donation_receipt' ) );
54
		}
55
56
		/**
57
		 * Get email subject.
58
		 *
59
		 * @since  2.0
60
		 * @access public
61
		 *
62
		 * @param int $form_id
63
		 * @return string
64
		 */
65 View Code Duplication
		public function get_email_subject( $form_id = null ) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
66
			$subject = wp_strip_all_tags(
67
				Give_Email_Notification_Util::get_value(
68
					$this,
69
					Give_Email_Setting_Field::get_prefix( $this, $form_id ) . 'email_subject',
70
					$form_id,
71
					$this->config['default_email_subject']
72
				)
73
			);
74
75
			/**
76
			 * Filters the donation email receipt subject.
77
			 * Note: This filter will deprecate soon.
78
			 *
79
			 * @since 1.0
80
			 */
81
			$subject = apply_filters(
82
				'give_donation_subject',
83
				$subject,
84
				$this->payment->ID
85
			);
86
87
			/**
88
			 * Filters the donation email receipt subject.
89
			 *
90
			 * @since 2.0
91
			 */
92
			$subject = apply_filters(
93
				"give_{$this->config['id']}_get_email_subject",
94
				$subject,
95
				$this,
96
				$form_id
97
			);
98
99
			return $subject;
100
		}
101
102
103
		/**
104
		 * Get email message.
105
		 *
106
		 * @since  2.0
107
		 * @access public
108
		 *
109
		 * @param int $form_id
110
		 * @return string
111
		 */
112
		public function get_email_message( $form_id = null ) {
113
			$message = Give_Email_Notification_Util::get_value(
114
				$this,
115
				Give_Email_Setting_Field::get_prefix( $this, $form_id ) . 'email_message',
116
				$form_id,
117
				$this->config['default_email_message']
118
			);
119
120
			/**
121
			 * Filter message on basis of email template
122
			 * Note: This filter will deprecate soon.
123
			 *
124
			 * @since 1.0
125
			 */
126
			$message = apply_filters(
127
				'give_donation_receipt_' . Give()->emails->get_template(),
128
				$message,
129
				$this->payment->ID,
130
				$this->payment->payment_meta
131
			);
132
133
			/**
134
			 * Filter the message
135
			 * Note: This filter will deprecate soon.
136
			 *
137
			 * @since 1.0
138
			 */
139
			$message = apply_filters(
140
				'give_donation_receipt',
141
				$message,
142
				$this->payment->ID,
143
				$this->payment->payment_meta
144
			);
145
146
			/**
147
			 * Filter the message
148
			 *
149
			 * @since 2.0
150
			 */
151
			$message = apply_filters(
152
				"give_{$this->config['id']}_get_email_message",
153
				$message,
154
				$this,
155
				$form_id
156
			);
157
158
			return $message;
159
		}
160
161
		/**
162
		 * Get the recipient attachments.
163
		 *
164
		 * @since  2.0
165
		 * @access public
166
		 *
167
		 * @param int $form_id
168
		 * @return array
169
		 */
170 View Code Duplication
		public function get_email_attachments( $form_id = null) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
171
			/**
172
			 * Filter the attachments.
173
			 * Note: this filter will deprecate soon.
174
			 *
175
			 * @since 1.0
176
			 */
177
			$attachments = apply_filters(
178
				'give_receipt_attachments',
179
				array(),
180
				$this->payment->ID,
181
				$this->payment->payment_meta
182
			);
183
184
			/**
185
			 * Filter the attachments.
186
			 *
187
			 * @since 2.0
188
			 */
189
			$attachments = apply_filters(
190
				"give_{$this->config['id']}_get_email_attachments",
191
				$attachments,
192
				$this,
193
				$form_id
194
			);
195
196
			return $attachments;
197
		}
198
199
200
		/**
201
		 * Set email data.
202
		 *
203
		 * @since 2.0
204
		 */
205 View Code Duplication
		public function setup_email_data() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
206
			// Set recipient email.
207
			$this->recipient_email = $this->payment->email;
208
209
			/**
210
			 * Filters the from name.
211
			 *
212
			 * @param int   $payment_id   Payment id.
213
			 * @param mixed $payment_data Payment meta data.
214
			 *
215
			 * @since 1.0
216
			 */
217
			$from_name = apply_filters(
218
				'give_donation_from_name',
219
				Give()->emails->get_from_name(),
220
				$this->payment->ID,
221
				$this->payment->payment_meta
222
			);
223
224
			/**
225
			 * Filters the from email.
226
			 *
227
			 * @param int   $payment_id   Payment id.
228
			 * @param mixed $payment_data Payment meta data.
229
			 *
230
			 * @since 1.0
231
			 */
232
			$from_email = apply_filters(
233
				'give_donation_from_address',
234
				Give()->emails->get_from_address(),
235
				$this->payment->ID,
236
				$this->payment->payment_meta
237
			);
238
239
			Give()->emails->__set( 'from_name', $from_name );
240
			Give()->emails->__set( 'from_email', $from_email );
241
242
			/**
243
			 * Filters the donation receipt's email headers.
244
			 *
245
			 * @param int   $payment_id   Payment id.
246
			 * @param mixed $payment_data Payment meta data.
247
			 *
248
			 * @since 1.0
249
			 */
250
			$headers = apply_filters(
251
				'give_receipt_headers',
252
				Give()->emails->get_headers(),
253
				$this->payment->ID,
254
				$this->payment->payment_meta
255
			);
256
257
			Give()->emails->__set( 'headers', $headers );
258
		}
259
260
		/**
261
		 * Send donation receipt
262
		 *
263
		 * @since  2.0
264
		 * @access public
265
		 *
266
		 * @param $payment_id
267
		 */
268 View Code Duplication
		public function send_donation_receipt( $payment_id ) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
269
			$this->payment = new Give_Payment( $payment_id );
270
271
			// Setup email data.
272
			$this->setup_email_data();
273
274
			// Send email.
275
			$this->send_email_notification( array(
276
				'payment_id' => $this->payment->ID,
277
			) );
278
		}
279
280
		/**
281
		 * Resend payment receipt by row action.
282
		 *
283
		 * @since  2.0
284
		 * @access public
285
		 *
286
		 * @param array $data Donation details.
287
		 */
288
		public function resend_donation_receipt( $data ) {
289
			$purchase_id = absint( $data['purchase_id'] );
290
291
			if ( empty( $purchase_id ) ) {
292
				return;
293
			}
294
295
			// Get donation payment information.
296
			$this->payment = new Give_Payment( $purchase_id );
297
298 View Code Duplication
			if ( ! current_user_can( 'edit_give_payments', $this->payment->ID ) ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
299
				wp_die( esc_html__( 'You do not have permission to edit donations.', 'give' ), esc_html__( 'Error', 'give' ), array(
300
					'response' => 403,
301
				) );
302
			}
303
304
			// Setup email data.
305
			$this->setup_email_data();
306
307
			// Send email.
308
			$this->send_email_notification( array(
309
				'payment_id' => $this->payment->ID,
310
			) );
311
312
			wp_redirect( add_query_arg( array(
313
				'give-messages[]' => 'email-sent',
314
				'give-action'     => false,
315
				'purchase_id'     => false,
316
			) ) );
317
			exit;
318
		}
319
	}
320
321
endif; // End class_exists check
322
323
return Give_Donation_Receipt_Email::get_instance();
324