Issues (2010)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

wp-includes/bookmark.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Link/Bookmark API
4
 *
5
 * @package WordPress
6
 * @subpackage Bookmark
7
 */
8
9
/**
10
 * Retrieve Bookmark data
11
 *
12
 * @since 2.1.0
13
 *
14
 * @global wpdb $wpdb WordPress database abstraction object.
15
 *
16
 * @param int|stdClass $bookmark
17
 * @param string $output Optional. Either OBJECT, ARRAY_N, or ARRAY_A constant
18
 * @param string $filter Optional, default is 'raw'.
19
 * @return array|object|null Type returned depends on $output value.
20
 */
21
function get_bookmark($bookmark, $output = OBJECT, $filter = 'raw') {
22
	global $wpdb;
23
24
	if ( empty($bookmark) ) {
25
		if ( isset($GLOBALS['link']) )
26
			$_bookmark = & $GLOBALS['link'];
27
		else
28
			$_bookmark = null;
29
	} elseif ( is_object($bookmark) ) {
30
		wp_cache_add($bookmark->link_id, $bookmark, 'bookmark');
31
		$_bookmark = $bookmark;
32
	} else {
33
		if ( isset($GLOBALS['link']) && ($GLOBALS['link']->link_id == $bookmark) ) {
34
			$_bookmark = & $GLOBALS['link'];
35
		} elseif ( ! $_bookmark = wp_cache_get($bookmark, 'bookmark') ) {
36
			$_bookmark = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->links WHERE link_id = %d LIMIT 1", $bookmark));
37
			if ( $_bookmark ) {
38
				$_bookmark->link_category = array_unique( wp_get_object_terms( $_bookmark->link_id, 'link_category', array( 'fields' => 'ids' ) ) );
39
				wp_cache_add( $_bookmark->link_id, $_bookmark, 'bookmark' );
40
			}
41
		}
42
	}
43
44
	if ( ! $_bookmark )
45
		return $_bookmark;
46
47
	$_bookmark = sanitize_bookmark($_bookmark, $filter);
48
49
	if ( $output == OBJECT ) {
50
		return $_bookmark;
51
	} elseif ( $output == ARRAY_A ) {
52
		return get_object_vars($_bookmark);
53
	} elseif ( $output == ARRAY_N ) {
54
		return array_values(get_object_vars($_bookmark));
55
	} else {
56
		return $_bookmark;
57
	}
58
}
59
60
/**
61
 * Retrieve single bookmark data item or field.
62
 *
63
 * @since 2.3.0
64
 *
65
 * @param string $field The name of the data field to return
66
 * @param int $bookmark The bookmark ID to get field
67
 * @param string $context Optional. The context of how the field will be used.
68
 * @return string|WP_Error
69
 */
70 View Code Duplication
function get_bookmark_field( $field, $bookmark, $context = 'display' ) {
0 ignored issues
show
This function seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
71
	$bookmark = (int) $bookmark;
72
	$bookmark = get_bookmark( $bookmark );
73
74
	if ( is_wp_error($bookmark) )
75
		return $bookmark;
76
77
	if ( !is_object($bookmark) )
78
		return '';
79
80
	if ( !isset($bookmark->$field) )
81
		return '';
82
83
	return sanitize_bookmark_field($field, $bookmark->$field, $bookmark->link_id, $context);
84
}
85
86
/**
87
 * Retrieves the list of bookmarks
88
 *
89
 * Attempts to retrieve from the cache first based on MD5 hash of arguments. If
90
 * that fails, then the query will be built from the arguments and executed. The
91
 * results will be stored to the cache.
92
 *
93
 * @since 2.1.0
94
 *
95
 * @global wpdb $wpdb WordPress database abstraction object.
96
 *
97
 * @param string|array $args {
98
 *     Optional. String or array of arguments to retrieve bookmarks.
99
 *
100
 *     @type string   $orderby        How to order the links by. Accepts post fields. Default 'name'.
101
 *     @type string   $order          Whether to order bookmarks in ascending or descending order.
102
 *                                    Accepts 'ASC' (ascending) or 'DESC' (descending). Default 'ASC'.
103
 *     @type int      $limit          Amount of bookmarks to display. Accepts 1+ or -1 for all.
104
 *                                    Default -1.
105
 *     @type string   $category       Comma-separated list of category ids to include links from.
106
 *                                    Default empty.
107
 *     @type string   $category_name  Category to retrieve links for by name. Default empty.
108
 *     @type int|bool $hide_invisible Whether to show or hide links marked as 'invisible'. Accepts
109
 *                                    1|true or 0|false. Default 1|true.
110
 *     @type int|bool $show_updated   Whether to display the time the bookmark was last updated.
111
 *                                    Accepts 1|true or 0|false. Default 0|false.
112
 *     @type string   $include        Comma-separated list of bookmark IDs to include. Default empty.
113
 *     @type string   $exclude        Comma-separated list of bookmark IDs to exclude. Default empty.
114
 * }
115
 * @return array List of bookmark row objects.
116
 */
117
function get_bookmarks( $args = '' ) {
118
	global $wpdb;
119
120
	$defaults = array(
121
		'orderby' => 'name', 'order' => 'ASC',
122
		'limit' => -1, 'category' => '',
123
		'category_name' => '', 'hide_invisible' => 1,
124
		'show_updated' => 0, 'include' => '',
125
		'exclude' => '', 'search' => ''
126
	);
127
128
	$r = wp_parse_args( $args, $defaults );
129
130
	$key = md5( serialize( $r ) );
131
	$cache = false;
132
	if ( 'rand' !== $r['orderby'] && $cache = wp_cache_get( 'get_bookmarks', 'bookmark' ) ) {
133
		if ( is_array( $cache ) && isset( $cache[ $key ] ) ) {
134
			$bookmarks = $cache[ $key ];
135
			/**
136
			 * Filters the returned list of bookmarks.
137
			 *
138
			 * The first time the hook is evaluated in this file, it returns the cached
139
			 * bookmarks list. The second evaluation returns a cached bookmarks list if the
140
			 * link category is passed but does not exist. The third evaluation returns
141
			 * the full cached results.
142
			 *
143
			 * @since 2.1.0
144
			 *
145
			 * @see get_bookmarks()
146
			 *
147
			 * @param array $bookmarks List of the cached bookmarks.
148
			 * @param array $r         An array of bookmark query arguments.
149
			 */
150
			return apply_filters( 'get_bookmarks', $bookmarks, $r );
151
		}
152
	}
153
154
	if ( ! is_array( $cache ) ) {
155
		$cache = array();
156
	}
157
158
	$inclusions = '';
159
	if ( ! empty( $r['include'] ) ) {
160
		$r['exclude'] = '';  //ignore exclude, category, and category_name params if using include
161
		$r['category'] = '';
162
		$r['category_name'] = '';
163
		$inclinks = preg_split( '/[\s,]+/', $r['include'] );
164
		if ( count( $inclinks ) ) {
165
			foreach ( $inclinks as $inclink ) {
166
				if ( empty( $inclusions ) ) {
167
					$inclusions = ' AND ( link_id = ' . intval( $inclink ) . ' ';
168
				} else {
169
					$inclusions .= ' OR link_id = ' . intval( $inclink ) . ' ';
170
				}
171
			}
172
		}
173
	}
174
	if (! empty( $inclusions ) ) {
175
		$inclusions .= ')';
176
	}
177
178
	$exclusions = '';
179 View Code Duplication
	if ( ! empty( $r['exclude'] ) ) {
180
		$exlinks = preg_split( '/[\s,]+/', $r['exclude'] );
181
		if ( count( $exlinks ) ) {
182
			foreach ( $exlinks as $exlink ) {
183
				if ( empty( $exclusions ) ) {
184
					$exclusions = ' AND ( link_id <> ' . intval( $exlink ) . ' ';
185
				} else {
186
					$exclusions .= ' AND link_id <> ' . intval( $exlink ) . ' ';
187
				}
188
			}
189
		}
190
	}
191
	if ( ! empty( $exclusions ) ) {
192
		$exclusions .= ')';
193
	}
194
195
	if ( ! empty( $r['category_name'] ) ) {
196
		if ( $r['category'] = get_term_by('name', $r['category_name'], 'link_category') ) {
197
			$r['category'] = $r['category']->term_id;
198
		} else {
199
			$cache[ $key ] = array();
200
			wp_cache_set( 'get_bookmarks', $cache, 'bookmark' );
201
			/** This filter is documented in wp-includes/bookmark.php */
202
			return apply_filters( 'get_bookmarks', array(), $r );
203
		}
204
	}
205
206
	$search = '';
207
	if ( ! empty( $r['search'] ) ) {
208
		$like = '%' . $wpdb->esc_like( $r['search'] ) . '%';
209
		$search = $wpdb->prepare(" AND ( (link_url LIKE %s) OR (link_name LIKE %s) OR (link_description LIKE %s) ) ", $like, $like, $like );
210
	}
211
212
	$category_query = '';
213
	$join = '';
214 View Code Duplication
	if ( ! empty( $r['category'] ) ) {
215
		$incategories = preg_split( '/[\s,]+/', $r['category'] );
216
		if ( count($incategories) ) {
217
			foreach ( $incategories as $incat ) {
218
				if ( empty( $category_query ) ) {
219
					$category_query = ' AND ( tt.term_id = ' . intval( $incat ) . ' ';
220
				} else {
221
					$category_query .= ' OR tt.term_id = ' . intval( $incat ) . ' ';
222
				}
223
			}
224
		}
225
	}
226
	if ( ! empty( $category_query ) ) {
227
		$category_query .= ") AND taxonomy = 'link_category'";
228
		$join = " INNER JOIN $wpdb->term_relationships AS tr ON ($wpdb->links.link_id = tr.object_id) INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_taxonomy_id = tr.term_taxonomy_id";
229
	}
230
231
	if ( $r['show_updated'] ) {
232
		$recently_updated_test = ", IF (DATE_ADD(link_updated, INTERVAL 120 MINUTE) >= NOW(), 1,0) as recently_updated ";
233
	} else {
234
		$recently_updated_test = '';
235
	}
236
237
	$get_updated = ( $r['show_updated'] ) ? ', UNIX_TIMESTAMP(link_updated) AS link_updated_f ' : '';
238
239
	$orderby = strtolower( $r['orderby'] );
240
	$length = '';
241
	switch ( $orderby ) {
242
		case 'length':
243
			$length = ", CHAR_LENGTH(link_name) AS length";
244
			break;
245
		case 'rand':
246
			$orderby = 'rand()';
247
			break;
248
		case 'link_id':
249
			$orderby = "$wpdb->links.link_id";
250
			break;
251
		default:
252
			$orderparams = array();
253
			$keys = array( 'link_id', 'link_name', 'link_url', 'link_visible', 'link_rating', 'link_owner', 'link_updated', 'link_notes', 'link_description' );
254
			foreach ( explode( ',', $orderby ) as $ordparam ) {
255
				$ordparam = trim( $ordparam );
256
257
				if ( in_array( 'link_' . $ordparam, $keys ) ) {
258
					$orderparams[] = 'link_' . $ordparam;
259
				} elseif ( in_array( $ordparam, $keys ) ) {
260
					$orderparams[] = $ordparam;
261
				}
262
			}
263
			$orderby = implode( ',', $orderparams );
264
	}
265
266
	if ( empty( $orderby ) ) {
267
		$orderby = 'link_name';
268
	}
269
270
	$order = strtoupper( $r['order'] );
271 View Code Duplication
	if ( '' !== $order && ! in_array( $order, array( 'ASC', 'DESC' ) ) ) {
272
		$order = 'ASC';
273
	}
274
275
	$visible = '';
276
	if ( $r['hide_invisible'] ) {
277
		$visible = "AND link_visible = 'Y'";
278
	}
279
280
	$query = "SELECT * $length $recently_updated_test $get_updated FROM $wpdb->links $join WHERE 1=1 $visible $category_query";
281
	$query .= " $exclusions $inclusions $search";
282
	$query .= " ORDER BY $orderby $order";
283
	if ( $r['limit'] != -1 ) {
284
		$query .= ' LIMIT ' . $r['limit'];
285
	}
286
287
	$results = $wpdb->get_results( $query );
288
289
	if ( 'rand()' !== $orderby ) {
290
		$cache[ $key ] = $results;
291
		wp_cache_set( 'get_bookmarks', $cache, 'bookmark' );
292
	}
293
294
	/** This filter is documented in wp-includes/bookmark.php */
295
	return apply_filters( 'get_bookmarks', $results, $r );
296
}
297
298
/**
299
 * Sanitizes all bookmark fields
300
 *
301
 * @since 2.3.0
302
 *
303
 * @param object|array $bookmark Bookmark row
304
 * @param string $context Optional, default is 'display'. How to filter the
305
 *		fields
306
 * @return object|array Same type as $bookmark but with fields sanitized.
307
 */
308
function sanitize_bookmark($bookmark, $context = 'display') {
309
	$fields = array('link_id', 'link_url', 'link_name', 'link_image', 'link_target', 'link_category',
310
		'link_description', 'link_visible', 'link_owner', 'link_rating', 'link_updated',
311
		'link_rel', 'link_notes', 'link_rss', );
312
313
	if ( is_object($bookmark) ) {
314
		$do_object = true;
315
		$link_id = $bookmark->link_id;
316
	} else {
317
		$do_object = false;
318
		$link_id = $bookmark['link_id'];
319
	}
320
321 View Code Duplication
	foreach ( $fields as $field ) {
322
		if ( $do_object ) {
323
			if ( isset($bookmark->$field) )
324
				$bookmark->$field = sanitize_bookmark_field($field, $bookmark->$field, $link_id, $context);
325
		} else {
326
			if ( isset($bookmark[$field]) )
327
				$bookmark[$field] = sanitize_bookmark_field($field, $bookmark[$field], $link_id, $context);
328
		}
329
	}
330
331
	return $bookmark;
332
}
333
334
/**
335
 * Sanitizes a bookmark field.
336
 *
337
 * Sanitizes the bookmark fields based on what the field name is. If the field
338
 * has a strict value set, then it will be tested for that, else a more generic
339
 * filtering is applied. After the more strict filter is applied, if the `$context`
340
 * is 'raw' then the value is immediately return.
341
 *
342
 * Hooks exist for the more generic cases. With the 'edit' context, the {@see 'edit_$field'}
343
 * filter will be called and passed the `$value` and `$bookmark_id` respectively.
344
 *
345
 * With the 'db' context, the {@see 'pre_$field'} filter is called and passed the value.
346
 * The 'display' context is the final context and has the `$field` has the filter name
347
 * and is passed the `$value`, `$bookmark_id`, and `$context`, respectively.
348
 *
349
 * @since 2.3.0
350
 *
351
 * @param string $field       The bookmark field.
352
 * @param mixed  $value       The bookmark field value.
353
 * @param int    $bookmark_id Bookmark ID.
354
 * @param string $context     How to filter the field value. Accepts 'raw', 'edit', 'attribute',
355
 *                            'js', 'db', or 'display'
356
 * @return mixed The filtered value.
357
 */
358
function sanitize_bookmark_field( $field, $value, $bookmark_id, $context ) {
359
	switch ( $field ) {
360
	case 'link_id' : // ints
361
	case 'link_rating' :
362
		$value = (int) $value;
363
		break;
364
	case 'link_category' : // array( ints )
365
		$value = array_map('absint', (array) $value);
366
		// We return here so that the categories aren't filtered.
367
		// The 'link_category' filter is for the name of a link category, not an array of a link's link categories
368
		return $value;
369
370
	case 'link_visible' : // bool stored as Y|N
371
		$value = preg_replace('/[^YNyn]/', '', $value);
372
		break;
373
	case 'link_target' : // "enum"
374
		$targets = array('_top', '_blank');
375
		if ( ! in_array($value, $targets) )
376
			$value = '';
377
		break;
378
	}
379
380
	if ( 'raw' == $context )
381
		return $value;
382
383
	if ( 'edit' == $context ) {
384
		/** This filter is documented in wp-includes/post.php */
385
		$value = apply_filters( "edit_$field", $value, $bookmark_id );
386
387
		if ( 'link_notes' == $field ) {
388
			$value = esc_html( $value ); // textarea_escaped
389
		} else {
390
			$value = esc_attr($value);
391
		}
392
	} elseif ( 'db' == $context ) {
393
		/** This filter is documented in wp-includes/post.php */
394
		$value = apply_filters( "pre_$field", $value );
395
	} else {
396
		/** This filter is documented in wp-includes/post.php */
397
		$value = apply_filters( $field, $value, $bookmark_id, $context );
398
399 View Code Duplication
		if ( 'attribute' == $context ) {
400
			$value = esc_attr( $value );
401
		} elseif ( 'js' == $context ) {
402
			$value = esc_js( $value );
403
		}
404
	}
405
406
	return $value;
407
}
408
409
/**
410
 * Deletes the bookmark cache.
411
 *
412
 * @since 2.7.0
413
 *
414
 * @param int $bookmark_id Bookmark ID.
415
 */
416
function clean_bookmark_cache( $bookmark_id ) {
417
	wp_cache_delete( $bookmark_id, 'bookmark' );
418
	wp_cache_delete( 'get_bookmarks', 'bookmark' );
419
	clean_object_term_cache( $bookmark_id, 'link');
420
}
421