Issues (4335)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/settings/class-settings-gateways.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Give Settings Page/Tab
4
 *
5
 * @package     Give
6
 * @subpackage  Classes/Give_Settings_Gateways
7
 * @copyright   Copyright (c) 2016, GiveWP
8
 * @license     http://opensource.org/licenses/gpl-2.0.php GNU Public License
9
 * @since       1.8
10
 */
11
12
if ( ! defined( 'ABSPATH' ) ) {
13
	exit; // Exit if accessed directly
14
}
15
16
if ( ! class_exists( 'Give_Settings_Gateways' ) ) :
17
18
	/**
19
	 * Give_Settings_Gateways.
20
	 *
21
	 * @sine 1.8
22
	 */
23
	class Give_Settings_Gateways extends Give_Settings_Page {
24
25
		/**
26
		 * Constructor.
27
		 */
28 View Code Duplication
		public function __construct() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
29
			$this->id    = 'gateways';
30
			$this->label = esc_html__( 'Payment Gateways', 'give' );
31
32
			$this->default_tab = 'gateways-settings';
33
34
			parent::__construct();
35
36
			// Do not use main form for this tab.
37
			if ( give_get_current_setting_tab() === $this->id ) {
38
				add_action( 'give_admin_field_gateway_notice', array( $this, 'render_gateway_notice' ), 10, 2 );
39
				add_action( 'give_admin_field_enabled_gateways', array( $this, 'render_enabled_gateways' ), 10, 2 );
40
			}
41
		}
42
43
		/**
44
		 * Get settings array.
45
		 *
46
		 * @since  1.8
47
		 * @return array
48
		 */
49
		public function get_settings() {
50
			$settings        = array();
51
			$current_section = give_get_current_setting_section();
52
53
			switch ( $current_section ) {
54
				case 'paypal-standard':
55
					$settings = array(
56
						// Section 2: PayPal Standard.
57
						array(
58
							'type' => 'title',
59
							'id'   => 'give_title_gateway_settings_2',
60
						),
61
						array(
62
							'name' => __( 'PayPal Email', 'give' ),
63
							'desc' => __( 'Enter your PayPal account\'s email.', 'give' ),
64
							'id'   => 'paypal_email',
65
							'type' => 'email',
66
						),
67
						array(
68
							'name' => __( 'PayPal Page Style', 'give' ),
69
							'desc' => __( 'Enter the name of the PayPal page style to use, or leave blank to use the default.', 'give' ),
70
							'id'   => 'paypal_page_style',
71
							'type' => 'text',
72
						),
73
						array(
74
							'name'    => __( 'PayPal Transaction Type', 'give' ),
75
							'desc'    => __( 'Nonprofits must verify their status to withdraw donations they receive via PayPal. PayPal users that are not verified nonprofits must demonstrate how their donations will be used, once they raise more than $10,000. By default, Give transactions are sent to PayPal as donations. You may change the transaction type using this option if you feel you may not meet PayPal\'s donation requirements.', 'give' ),
76
							'id'      => 'paypal_button_type',
77
							'type'    => 'radio_inline',
78
							'options' => array(
79
								'donation' => __( 'Donation', 'give' ),
80
								'standard' => __( 'Standard Transaction', 'give' )
81
							),
82
							'default' => 'donation',
83
						),
84
						array(
85
							'name'    => __( 'Billing Details', 'give' ),
86
							'desc'    => __( 'This option will enable the billing details section for PayPal Standard which requires the donor\'s address to complete the donation. These fields are not required by PayPal to process the transaction, but you may have a need to collect the data.', 'give' ),
87
							'id'      => 'paypal_standard_billing_details',
88
							'type'    => 'radio_inline',
89
							'default' => 'disabled',
90
							'options' => array(
91
								'enabled'  => __( 'Enabled', 'give' ),
92
								'disabled' => __( 'Disabled', 'give' ),
93
							)
94
						),
95
						array(
96
							'name'    => __( 'PayPal IPN Verification', 'give' ),
97
							'desc'    => __( 'If donations are not getting marked as complete, use a slightly less secure method of verifying donations.', 'give' ),
98
							'id'      => 'paypal_verification',
99
							'type'    => 'radio_inline',
100
							'default' => 'enabled',
101
							'options' => array(
102
								'enabled'  => __( 'Enabled', 'give' ),
103
								'disabled' => __( 'Disabled', 'give' ),
104
							)
105
						),
106
						array(
107
							'id'      => 'paypal_invoice_prefix',
108
							'name'    => esc_html__( 'Invoice ID Prefix', 'give' ),
109
							'desc'    => esc_html__( 'Please enter a prefix for your invoice numbers. If you use your PayPal account for multiple stores ensure this prefix is unique as PayPal will not allow orders with the same invoice number.', 'give' ),
110
							'type'    => 'text',
111
							'default' => 'GIVE-',
112
						),
113
						array(
114
							'name'  => __( 'PayPal Standard Gateway Settings Docs Link', 'give' ),
115
							'id'    => 'paypal_standard_gateway_settings_docs_link',
116
							'url'   => esc_url( 'http://docs.givewp.com/settings-gateway-paypal-standard' ),
117
							'title' => __( 'PayPal Standard Gateway Settings', 'give' ),
118
							'type'  => 'give_docs_link',
119
						),
120
						array(
121
							'type' => 'sectionend',
122
							'id'   => 'give_title_gateway_settings_2',
123
						)
124
					);
125
					break;
126
127
				case 'offline-donations' :
128
					$settings = array(
129
						// Section 3: Offline gateway.
130
						array(
131
							'type' => 'title',
132
							'id'   => 'give_title_gateway_settings_3',
133
						),
134
						array(
135
							'name'    => __( 'Collect Billing Details', 'give' ),
136
							'desc'    => __( 'Enable to request billing details for offline donations. Will appear above offline donation instructions. Can be enabled/disabled per form.', 'give' ),
137
							'id'      => 'give_offline_donation_enable_billing_fields',
138
							'type'    => 'radio_inline',
139
							'default' => 'disabled',
140
							'options' => array(
141
								'enabled'  => __( 'Enabled', 'give' ),
142
								'disabled' => __( 'Disabled', 'give' )
143
							)
144
						),
145
						array(
146
							'name'    => __( 'Offline Donation Instructions', 'give' ),
147
							'desc'    => __( 'The following content will appear for all forms when the user selects the offline donation payment option. Note: You may customize the content per form as needed.', 'give' ),
148
							'id'      => 'global_offline_donation_content',
149
							'default' => give_get_default_offline_donation_content(),
150
							'type'    => 'wysiwyg',
151
							'options' => array(
152
								'textarea_rows' => 6,
153
							)
154
						),
155
						array(
156
							'name'  => esc_html__( 'Offline Donations Settings Docs Link', 'give' ),
157
							'id'    => 'offline_gateway_settings_docs_link',
158
							'url'   => esc_url( 'http://docs.givewp.com/offlinegateway' ),
159
							'title' => __( 'Offline Gateway Settings', 'give' ),
160
							'type'  => 'give_docs_link',
161
						),
162
						array(
163
							'type' => 'sectionend',
164
							'id'   => 'give_title_gateway_settings_3',
165
						)
166
					);
167
					break;
168
169
				case 'gateways-settings':
170
					$settings = array(
171
						// Section 1: Gateways.
172
						array(
173
							'id'   => 'give_title_gateway_settings_1',
174
							'type' => 'title'
175
						),
176
						array(
177
							'id'   => 'gateway_notice',
178
							'type' => 'gateway_notice',
179
						),
180
						array(
181
							'name'    => __( 'Test Mode', 'give' ),
182
							'desc'    => __( 'While in test mode no live donations are processed. To fully use test mode, you must have a sandbox (test) account for the payment gateway you are testing.', 'give' ),
183
							'id'      => 'test_mode',
184
							'type'    => 'radio_inline',
185
							'default' => 'disabled',
186
							'options' => array(
187
								'enabled'  => __( 'Enabled', 'give' ),
188
								'disabled' => __( 'Disabled', 'give' ),
189
							)
190
						),
191
						array(
192
							'name' => __( 'Enabled Gateways', 'give' ),
193
							'desc' => __( 'Enable your payment gateway. Can be ordered by dragging.', 'give' ),
194
							'id'   => 'gateways',
195
							'type' => 'enabled_gateways'
196
						),
197
198
						/**
199
						 * "Enabled Gateways" setting field contains gateways label setting but when you save gateway settings then label will not save
200
						 *  because this is not registered setting API and code will not recognize them.
201
						 *
202
						 * This setting will not render on admin setting screen but help internal code to recognize "gateways_label"  setting and add them to give setting when save.
203
						 */
204
						array(
205
							'name' => __( 'Gateways Label', 'give' ),
206
							'desc' => '',
207
							'id'   => 'gateways_label',
208
							'type' => 'gateways_label_hidden'
209
						),
210
211
						/**
212
						 * "Enabled Gateways" setting field contains default gateway setting but when you save gateway settings then this setting will not save
213
						 *  because this is not registered setting API and code will not recognize them.
214
						 *
215
						 * This setting will not render on admin setting screen but help internal code to recognize "default_gateway"  setting and add them to give setting when save.
216
						 */
217
						array(
218
							'name' => __( 'Default Gateway', 'give' ),
219
							'desc' => __( 'The gateway that will be selected by default.', 'give' ),
220
							'id'   => 'default_gateway',
221
							'type' => 'default_gateway_hidden'
222
						),
223
224
						array(
225
							'name'  => __( 'Gateways Docs Link', 'give' ),
226
							'id'    => 'gateway_settings_docs_link',
227
							'url'   => esc_url( 'http://docs.givewp.com/settings-gateways' ),
228
							'title' => __( 'Gateway Settings', 'give' ),
229
							'type'  => 'give_docs_link',
230
						),
231
						array(
232
							'id'   => 'give_title_gateway_settings_1',
233
							'type' => 'sectionend'
234
						),
235
					);
236
					break;
237
			}
238
239
			/**
240
			 * Filter the payment gateways settings.
241
			 * Backward compatibility: Please do not use this filter. This filter is deprecated in 1.8
242
			 */
243
			$settings = apply_filters( 'give_settings_gateways', $settings );
244
245
			/**
246
			 * Filter the settings.
247
			 *
248
			 * @since  1.8
249
			 *
250
			 * @param  array $settings
251
			 */
252
			$settings = apply_filters( 'give_get_settings_' . $this->id, $settings );
253
254
			// Output.
255
			return $settings;
256
		}
257
258
		/**
259
		 * Get sections.
260
		 *
261
		 * @since 1.8
262
		 * @return array
263
		 */
264
		public function get_sections() {
265
			$sections = array(
266
				'gateways-settings' => __( 'Gateways', 'give' ),
267
				'paypal-standard'   => __( 'PayPal Standard', 'give' ),
268
				'offline-donations' => __( 'Offline Donations', 'give' )
269
			);
270
271
			return apply_filters( 'give_get_sections_' . $this->id, $sections );
272
		}
273
274
275
		/**
276
		 * Render Gateway Notice
277
		 *
278
		 * @since  2.3.0
279
		 * @access public
280
		 *
281
		 * @param $field
282
		 * @param $settings
283
		 */
284
		public function render_gateway_notice( $field, $settings ) {
0 ignored issues
show
The parameter $field is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $settings is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
285
286
			$gateways = give_get_payment_gateways();
287
288
			// Only display notice if no active gateways are installed. Filter provided for developers to configure display.
289
			if ( apply_filters( 'give_gateway_upsell_notice_conditions', count( $gateways ) <= 3 ) ) : ?>
290
291
				<div class="give-gateways-notice">
292
293
					<div class="give-gateways-cc-icon">
294
						<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="35"
295
						     height="29" viewBox="0 0 35 29">
296
							<defs>
297
								<path id="credit-card-a"
298
								      d="M32.0772569,3.88888889 L2.92274306,3.88888889 C1.30642361,3.88888889 0,5.1953125 0,6.80555556 L0,28.1944444 C0,29.8046875 1.30642361,31.1111111 2.92274306,31.1111111 L32.0772569,31.1111111 C33.6935764,31.1111111 35,29.8046875 35,28.1944444 L35,6.80555556 C35,5.1953125 33.6935764,3.88888889 32.0772569,3.88888889 Z M3.28732639,6.80555556 L31.7126736,6.80555556 C31.9131944,6.80555556 32.0772569,6.96961806 32.0772569,7.17013889 L32.0772569,9.72222222 L2.92274306,9.72222222 L2.92274306,7.17013889 C2.92274306,6.96961806 3.08680556,6.80555556 3.28732639,6.80555556 Z M31.7126736,28.1944444 L3.28732639,28.1944444 C3.08680556,28.1944444 2.92274306,28.0303819 2.92274306,27.8298611 L2.92274306,17.5 L32.0772569,17.5 L32.0772569,27.8298611 C32.0772569,28.0303819 31.9131944,28.1944444 31.7126736,28.1944444 Z M11.6666667,22.1180556 L11.6666667,24.5486111 C11.6666667,24.9496528 11.3385417,25.2777778 10.9375,25.2777778 L6.5625,25.2777778 C6.16145833,25.2777778 5.83333333,24.9496528 5.83333333,24.5486111 L5.83333333,22.1180556 C5.83333333,21.7170139 6.16145833,21.3888889 6.5625,21.3888889 L10.9375,21.3888889 C11.3385417,21.3888889 11.6666667,21.7170139 11.6666667,22.1180556 Z M23.3333333,22.1180556 L23.3333333,24.5486111 C23.3333333,24.9496528 23.0052083,25.2777778 22.6041667,25.2777778 L14.3402778,25.2777778 C13.9392361,25.2777778 13.6111111,24.9496528 13.6111111,24.5486111 L13.6111111,22.1180556 C13.6111111,21.7170139 13.9392361,21.3888889 14.3402778,21.3888889 L22.6041667,21.3888889 C23.0052083,21.3888889 23.3333333,21.7170139 23.3333333,22.1180556 Z"/>
299
							</defs>
300
							<g fill="none" fill-rule="evenodd" opacity=".341" transform="translate(0 -3)">
301
								<mask id="credit-card-b" fill="#fff">
302
									<use xlink:href="#credit-card-a"/>
303
								</mask>
304
								<g fill="#242A42" mask="url(#credit-card-b)">
305
									<rect width="35" height="35"/>
306
								</g>
307
							</g>
308
						</svg>
309
					</div>
310
311
					<p class="give-gateways-notice-message"><?php printf( __( 'Activate a premium gateway like <a href="%1$s" target="_blank">Stripe</a>, <a href="%2$s" target="_blank">PayPal Pro</a>, or <a href="%3$s" target="_blank">Authorize.net</a> and allow your donors to give using their credit cards. ', 'give' ), 'https://givewp.com/addons/stripe-gateway/?utm_source=WP%20Admin%20%3E%20Donations%20%3E%20Settings%20%3E%20Gateways&utm_medium=banner', 'https://givewp.com/addons/paypal-pro-gateway/?utm_source=WP%20Admin%20%3E%20Donations%20%3E%20Settings%20%3E%20Gateways&utm_medium=banner', 'https://givewp.com/addons/authorize-net-gateway/?utm_source=WP%20Admin%20%3E%20Donations%20%3E%20Settings%20%3E%20Gateways&utm_medium=banner' ); ?></p>
312
313
					<div class="give-gateways-notice-button">
314
						<a href="https://givewp.com/addons/category/payment-gateways/?utm_source=WP%20Admin%20%3E%20Donations%20%3E%20Settings%20%3E%20Gateways&utm_medium=banner"
315
						   target="_blank" class="button"><?php esc_html_e( 'View Gateways', 'give' ); ?></a>
316
					</div>
317
318
				</div>
319
320
			<?php endif;
321
322
		}
323
324
		/**
325
		 * Render enabled gateways
326
		 *
327
		 * @since  2.0.5
328
		 * @access public
329
		 *
330
		 * @param $field
331
		 * @param $settings
332
		 */
333
		public function render_enabled_gateways( $field, $settings ) {
334
			$id              = $field['id'];
335
			$gateways        = give_get_ordered_payment_gateways( give_get_payment_gateways() );
336
			$gateways_label  = give_get_option( 'gateways_label', array() );
0 ignored issues
show
array() is of type array, but the function expects a string|boolean.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
337
			$default_gateway = give_get_option( 'default_gateway', current( array_keys( $gateways ) ) );
338
339
			ob_start();
340
341
			echo '<div class="gateway-enabled-wrap">';
342
343
			echo '<div class="gateway-enabled-settings-title">';
344
			printf(
345
				'
346
						<span></span>
347
						<span>%1$s</span>
348
						<span>%2$s</span>
349
						<span>%3$s</span>
350
						<span>%4$s</span>
351
						',
352
				__( 'Gateway', 'give' ),
353
				__( 'Label', 'give' ),
354
				__( 'Default', 'give' ),
355
				__( 'Enabled', 'give' )
356
			);
357
			echo '</div>';
358
359
			echo '<ul class="give-checklist-fields give-payment-gatways-list">';
360
			foreach ( $gateways as $key => $option ) :
361
				$enabled = null;
362
				if ( is_array( $settings ) && array_key_exists( $key, $settings ) ) {
363
					$enabled = '1';
364
				}
365
366
				echo '<li>';
367
				printf( '<span class="give-drag-handle"><span class="dashicons dashicons-menu"></span></span>' );
368
				printf( '<span class="admin-label">%s</span>', esc_html( $option['admin_label'] ) );
369
370
				$label = '';
371
				if ( ! empty( $gateways_label[ $key ] ) ) {
372
					$label = $gateways_label[ $key ];
373
				}
374
375
				printf(
376
					'<input class="checkout-label" type="text" id="%1$s[%2$s]" name="%1$s[%2$s]" value="%3$s" placeholder="%4$s"/>',
377
					'gateways_label',
378
					esc_attr( $key ),
379
					esc_html( $label ),
380
					esc_html( $option['checkout_label'] )
381
				);
382
383
				printf(
384
					'<input class="gateways-radio" type="radio" name="%1$s" value="%2$s" %3$s %4$s>',
385
					'default_gateway',
386
					$key,
387
					checked( $key, $default_gateway, false ),
388
					disabled( null, $enabled, false )
389
				);
390
391
				printf(
392
					'<input class="gateways-checkbox" name="%1$s[%2$s]" id="%1$s[%2$s]" type="checkbox" value="1" %3$s data-payment-gateway="%4$s"/>',
393
					esc_attr( $id ),
394
					esc_attr( $key ),
395
					checked( '1', $enabled, false ),
396
					esc_html( $option['admin_label'] )
397
				);
398
				echo '</li>';
399
			endforeach;
400
			echo '</ul>';
401
402
			echo '</div>'; // end gateway-enabled-wrap.
403
404
			printf(
405
				'<tr><th>%1$s</th><td>%2$s</td></tr>',
406
				$field['title'],
407
				ob_get_clean()
408
			);
409
		}
410
	}
411
412
endif;
413
414
return new Give_Settings_Gateways();
415