Issues (4335)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/emails/class-email-notification-table.php (10 issues)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * Email Notification
5
 *
6
 * This class handles table html  for email notifications listing.
7
 *
8
 * @package     Give
9
 * @subpackage  Classes/Emails
10
 * @copyright   Copyright (c) 2016, GiveWP
11
 * @license     https://opensource.org/licenses/gpl-license GNU Public License
12
 * @since       2.0
13
 */
14
class Give_Email_Notification_Table extends WP_List_Table {
15
	/**
16
	 * @var Give_Email_Notifications $email_notifications
17
	 * @since  2.0
18
	 * @access private
19
	 */
20
	private $email_notifications;
21
22
23
	/**
24
	 * Number of email notifications per page
25
	 *
26
	 * @since  2.0
27
	 * @access private
28
	 * @var int
29
	 */
30
	private $per_page = - 1;
31
32
	/**
33
	 * Give_Email_Notification_Table constructor.
34
	 *
35
	 * @since  2.0
36
	 * @access public
37
	 */
38
	public function __construct() {
39
		parent::__construct( array(
40
			'singular' => __( 'Give Email Notification', 'give' ),
41
			'plural'   => __( 'Give Email Notifications', 'give' ),
42
		) );
43
44
		$this->email_notifications = Give_Email_Notifications::get_instance();
45
	}
46
47
48
	/**
49
	 * Get table columns.
50
	 *
51
	 * @since  2.0
52
	 * @access public
53
	 *
54
	 * @return array
55
	 */
56
	public function get_columns() {
57
		/**
58
		 * Filter the table columns
59
		 *
60
		 * @since 2.0
61
		 */
62
		return apply_filters( 'give_email_notification_setting_columns', array(
63
			'cb'         => __( 'Email Status', 'give' ),
64
			'name'       => __( 'Email', 'give' ),
65
			'email_type' => __( 'Content Type', 'give' ),
66
			'recipient'  => __( 'Recipient(s)', 'give' ),
67
			'setting'    => __( 'Edit Email', 'give' ),
68
		) );
69
	}
70
71
	/**
72
	 * Get name column.
73
	 *
74
	 * @since  2.0
75
	 * @access public
76
	 *
77
	 * @param Give_Email_Notification $email
78
	 *
79
	 * @return  string
80
	 */
81
	public function column_name( $email ) {
82
		$edit_url = esc_url( admin_url( 'edit.php?post_type=give_forms&page=give-settings&tab=emails&section=' . $email->config['id'] ) );
83
		$actions  = $this->get_row_actions( $email );
84
85
		ob_start();
86
		?>
87
		<a class="row-title" href="<?php echo $edit_url; ?>"><?php echo $email->config['label']; ?></a>
0 ignored issues
show
Expected next thing to be a escaping function, not '$edit_url'
Loading history...
Expected next thing to be a escaping function, not '$email'
Loading history...
88
89
		<?php if ( $desc = $email->config['description'] ) : ?>
90
			<?php echo Give()->tooltips->render_help( esc_attr( $desc ) ); ?>
0 ignored issues
show
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'Give'
Loading history...
91
		<?php endif; ?>
92
93
		<?php echo $this->row_actions( $actions ); ?>
0 ignored issues
show
Expected next thing to be a escaping function, not '$this'
Loading history...
94
		<?php
95
		return ob_get_clean();
96
	}
97
98
	/**
99
	 * Get recipient column.
100
	 *
101
	 * @since  2.0
102
	 * @access public
103
	 *
104
	 * @param Give_Email_Notification $email
105
	 *
106
	 * @return string
107
	 */
108
	public function column_recipient( $email ) {
109
		ob_start();
110
111
		if( Give_Email_Notification_Util::has_recipient_field( $email ) ) {
0 ignored issues
show
Space after opening control structure is required
Loading history...
No space before opening parenthesis is prohibited
Loading history...
112
			$recipients = $email->get_recipient();
113
			if ( is_array( $recipients ) ) {
114
				$recipients = implode( '<br>', $recipients );
115
			}
116
117
			echo $recipients;
0 ignored issues
show
Expected next thing to be a escaping function, not '$recipients'
Loading history...
118
119
		} elseif ( ! empty( $email->config['recipient_group_name'] ) ) {
120
			echo $email->config['recipient_group_name'];
0 ignored issues
show
Expected next thing to be a escaping function, not '$email'
Loading history...
121
		}
122
123
		return ob_get_clean();
124
	}
125
126
	/**
127
	 * Get status column.
128
	 *
129
	 * @since  2.0
130
	 * @access public
131
	 *
132
	 * @param Give_Email_Notification $email
133
	 *
134
	 * @return string
135
	 */
136
	public function column_cb( $email ) {
137
		$notification_status  = $email->get_notification_status();
138
		$user_can_edit_status = (int) Give_Email_Notification_Util::is_notification_status_editable( $email );
139
		$icon_classes         = Give_Email_Notification_Util::is_email_notification_active( $email )
140
			? 'dashicons dashicons-yes'
141
			: 'dashicons dashicons-no-alt';
142
		$attributes           = array(
143
			'class'       => "give-email-notification-status give-email-notification-{$notification_status}",
144
			'data-id'     => $email->config['id'],
145
			'data-status' => $email->get_notification_status(),
146
			'data-edit'   => $user_can_edit_status,
147
		);
148
149
		if ( ! $user_can_edit_status ) {
150
			$icon_classes         = 'dashicons dashicons-lock';
151
152
			$attributes['data-notice'] = esc_attr( $email->config['notices']['non-notification-status-editable'] );
153
		}
154
155
		$html = sprintf(
156
			'<span %1$s><i class="%2$s"></i></span></span><span class="spinner"></span>',
157
			give_get_attribute_str( $attributes ),
158
			$icon_classes
159
		);
160
161
		return $html;
162
	}
163
164
165
	/**
166
	 * Get email_type column.
167
	 *
168
	 * @since  2.0
169
	 * @access public
170
	 *
171
	 * @param Give_Email_Notification $email
172
	 *
173
	 * @return string
174
	 */
175
	public function column_email_type( Give_Email_Notification $email ) {
176
		$email_content_type_label = apply_filters(
177
			"give_email_list_render_{$email->config['id']}_email_content_type",
178
			Give_Email_Notification_Util::get_formatted_email_type( $email->config['content_type'] ),
179
			$email
180
		);
181
182
		return $email_content_type_label;
183
	}
184
185
	/**
186
	 * Get setting column.
187
	 *
188
	 * @since  2.0
189
	 * @access public
190
	 *
191
	 * @param Give_Email_Notification $email
192
	 *
193
	 * @return string
194
	 */
195
	public function column_setting( Give_Email_Notification $email ) {
196
		return Give()->tooltips->render_link( array(
197
			'label'       => __( 'Edit', 'give' ) . " {$email->config['label']}",
0 ignored issues
show
Expected next thing to be a escaping function, not '" {$email->config['label']}"'
Loading history...
198
			'tag_content' => '<span class="dashicons dashicons-admin-generic"></span>',
199
			'link'        => esc_url( admin_url( 'edit.php?post_type=give_forms&page=give-settings&tab=emails&section=' . $email->config['id'] ) ),
0 ignored issues
show
Expected next thing to be a escaping function, not '$email'
Loading history...
200
			'attributes'  => array(
201
				'class' => 'button button-small',
202
			),
203
		) );
204
	}
205
206
207
	/**
208
	 * Print row actions.
209
	 *
210
	 * @since  2.0
211
	 * @access private
212
	 *
213
	 * @param Give_Email_Notification $email
214
	 *
215
	 * @return array
216
	 */
217
	private function get_row_actions( $email ) {
218
		$edit_url = esc_url( admin_url( 'edit.php?post_type=give_forms&page=give-settings&tab=emails&section=' . $email->config['id'] ) );
219
220
		/**
221
		 * Filter the row actions
222
		 *
223
		 * @since 2.0
224
		 *
225
		 * @param array $row_actions
226
		 */
227
		$row_actions = apply_filters(
228
			'give_email_notification_row_actions',
229
			array(
230
				'edit' => "<a href=\"{$edit_url}\">" . __( 'Edit', 'give' ) . '</a>',
231
			),
232
			$email
233
		);
234
235
		return $row_actions;
236
	}
237
238
239
	/**
240
	 * Prepare email notifications
241
	 *
242
	 * @since  2.0
243
	 * @access public
244
	 */
245
	public function prepare_items() {
246
		// Set columns.
247
		$columns               = $this->get_columns();
248
		$hidden                = array();
249
		$email_notifications   = array();
250
		$sortable              = $this->get_sortable_columns();
251
		$this->_column_headers = array( $columns, $hidden, $sortable, $this->get_primary_column_name() );
252
253
		// Get email section
254
		$current_section = give_get_current_setting_section();
255
256
		// Set email notifications.
257
		/* @var Give_Email_Notification $email_notification */
258
		foreach ( $this->email_notifications->get_email_notifications() as $email_notification ) {
259
			if ( ! Give_Email_Notification_Util::is_show_on_emails_setting_page( $email_notification ) ) {
260
				continue;
261
			}
262
263
			if ( 'donor-email' === $current_section ) {
264
				// Add donor emails to email array list.
265
				if ( empty( $email_notification->config['has_recipient_field'] ) ) {
266
					$email_notifications[] = $email_notification;
267
				}
268
			} elseif ( 'admin-email' === $current_section ) {
269
				// Add admin emails to email array list.
270
				if ( ! empty( $email_notification->config['has_recipient_field'] ) ) {
271
					$email_notifications[] = $email_notification;
272
				}
273
			}
274
		}
275
276
		$total_items  = count( $email_notifications );
277
		$this->items = $email_notifications;
278
		$this->set_pagination_args( array(
279
			'total_items' => $total_items,
280
			'per_page'    => $this->per_page,
281
		) );
282
	}
283
284
	/**
285
	 * Message to be displayed when there are no items
286
	 *
287
	 * @since  2.0
288
	 * @access public
289
	 */
290
	public function no_items() {
291
		_e( 'No give email notification found.', 'give' );
292
	}
293
294
	/**
295
	 * Get primary column.
296
	 *
297
	 * @since  2,0
298
	 * @access public
299
	 *
300
	 * @return string Name of the default primary column.
301
	 */
302
	public function get_primary_column_name() {
303
		return 'name';
304
	}
305
}
306