staylor /
WordPress
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Post API: WP_Post class |
||
| 4 | * |
||
| 5 | * @package WordPress |
||
| 6 | * @subpackage Post |
||
| 7 | * @since 4.4.0 |
||
| 8 | */ |
||
| 9 | |||
| 10 | /** |
||
| 11 | * Core class used to implement the WP_Post object. |
||
| 12 | * |
||
| 13 | * @since 3.5.0 |
||
| 14 | * |
||
| 15 | * @property string $page_template |
||
| 16 | * |
||
| 17 | * @property-read array $ancestors |
||
| 18 | * @property-read int $post_category |
||
| 19 | * @property-read string $tag_input |
||
| 20 | * |
||
| 21 | */ |
||
| 22 | final class WP_Post { |
||
| 23 | |||
| 24 | /** |
||
| 25 | * Post ID. |
||
| 26 | * |
||
| 27 | * @var int |
||
| 28 | */ |
||
| 29 | public $ID; |
||
| 30 | |||
| 31 | /** |
||
| 32 | * ID of post author. |
||
| 33 | * |
||
| 34 | * A numeric string, for compatibility reasons. |
||
| 35 | * |
||
| 36 | * @var string |
||
| 37 | */ |
||
| 38 | public $post_author = 0; |
||
| 39 | |||
| 40 | /** |
||
| 41 | * The post's local publication time. |
||
| 42 | * |
||
| 43 | * @var string |
||
| 44 | */ |
||
| 45 | public $post_date = '0000-00-00 00:00:00'; |
||
| 46 | |||
| 47 | /** |
||
| 48 | * The post's GMT publication time. |
||
| 49 | * |
||
| 50 | * @var string |
||
| 51 | */ |
||
| 52 | public $post_date_gmt = '0000-00-00 00:00:00'; |
||
| 53 | |||
| 54 | /** |
||
| 55 | * The post's content. |
||
| 56 | * |
||
| 57 | * @var string |
||
| 58 | */ |
||
| 59 | public $post_content = ''; |
||
| 60 | |||
| 61 | /** |
||
| 62 | * The post's title. |
||
| 63 | * |
||
| 64 | * @var string |
||
| 65 | */ |
||
| 66 | public $post_title = ''; |
||
| 67 | |||
| 68 | /** |
||
| 69 | * The post's excerpt. |
||
| 70 | * |
||
| 71 | * @var string |
||
| 72 | */ |
||
| 73 | public $post_excerpt = ''; |
||
| 74 | |||
| 75 | /** |
||
| 76 | * The post's status. |
||
| 77 | * |
||
| 78 | * @var string |
||
| 79 | */ |
||
| 80 | public $post_status = 'publish'; |
||
| 81 | |||
| 82 | /** |
||
| 83 | * Whether comments are allowed. |
||
| 84 | * |
||
| 85 | * @var string |
||
| 86 | */ |
||
| 87 | public $comment_status = 'open'; |
||
| 88 | |||
| 89 | /** |
||
| 90 | * Whether pings are allowed. |
||
| 91 | * |
||
| 92 | * @var string |
||
| 93 | */ |
||
| 94 | public $ping_status = 'open'; |
||
| 95 | |||
| 96 | /** |
||
| 97 | * The post's password in plain text. |
||
| 98 | * |
||
| 99 | * @var string |
||
| 100 | */ |
||
| 101 | public $post_password = ''; |
||
| 102 | |||
| 103 | /** |
||
| 104 | * The post's slug. |
||
| 105 | * |
||
| 106 | * @var string |
||
| 107 | */ |
||
| 108 | public $post_name = ''; |
||
| 109 | |||
| 110 | /** |
||
| 111 | * URLs queued to be pinged. |
||
| 112 | * |
||
| 113 | * @var string |
||
| 114 | */ |
||
| 115 | public $to_ping = ''; |
||
| 116 | |||
| 117 | /** |
||
| 118 | * URLs that have been pinged. |
||
| 119 | * |
||
| 120 | * @var string |
||
| 121 | */ |
||
| 122 | public $pinged = ''; |
||
| 123 | |||
| 124 | /** |
||
| 125 | * The post's local modified time. |
||
| 126 | * |
||
| 127 | * @var string |
||
| 128 | */ |
||
| 129 | public $post_modified = '0000-00-00 00:00:00'; |
||
| 130 | |||
| 131 | /** |
||
| 132 | * The post's GMT modified time. |
||
| 133 | * |
||
| 134 | * @var string |
||
| 135 | */ |
||
| 136 | public $post_modified_gmt = '0000-00-00 00:00:00'; |
||
| 137 | |||
| 138 | /** |
||
| 139 | * A utility DB field for post content. |
||
| 140 | * |
||
| 141 | * |
||
| 142 | * @var string |
||
| 143 | */ |
||
| 144 | public $post_content_filtered = ''; |
||
| 145 | |||
| 146 | /** |
||
| 147 | * ID of a post's parent post. |
||
| 148 | * |
||
| 149 | * @var int |
||
| 150 | */ |
||
| 151 | public $post_parent = 0; |
||
| 152 | |||
| 153 | /** |
||
| 154 | * The unique identifier for a post, not necessarily a URL, used as the feed GUID. |
||
| 155 | * |
||
| 156 | * @var string |
||
| 157 | */ |
||
| 158 | public $guid = ''; |
||
| 159 | |||
| 160 | /** |
||
| 161 | * A field used for ordering posts. |
||
| 162 | * |
||
| 163 | * @var int |
||
| 164 | */ |
||
| 165 | public $menu_order = 0; |
||
| 166 | |||
| 167 | /** |
||
| 168 | * The post's type, like post or page. |
||
| 169 | * |
||
| 170 | * @var string |
||
| 171 | */ |
||
| 172 | public $post_type = 'post'; |
||
| 173 | |||
| 174 | /** |
||
| 175 | * An attachment's mime type. |
||
| 176 | * |
||
| 177 | * @var string |
||
| 178 | */ |
||
| 179 | public $post_mime_type = ''; |
||
| 180 | |||
| 181 | /** |
||
| 182 | * Cached comment count. |
||
| 183 | * |
||
| 184 | * A numeric string, for compatibility reasons. |
||
| 185 | * |
||
| 186 | * @var string |
||
| 187 | */ |
||
| 188 | public $comment_count = 0; |
||
| 189 | |||
| 190 | /** |
||
| 191 | * Stores the post object's sanitization level. |
||
| 192 | * |
||
| 193 | * Does not correspond to a DB field. |
||
| 194 | * |
||
| 195 | * @var string |
||
| 196 | */ |
||
| 197 | public $filter; |
||
| 198 | |||
| 199 | /** |
||
| 200 | * Retrieve WP_Post instance. |
||
| 201 | * |
||
| 202 | * @static |
||
| 203 | * @access public |
||
| 204 | * |
||
| 205 | * @global wpdb $wpdb WordPress database abstraction object. |
||
| 206 | * |
||
| 207 | * @param int $post_id Post ID. |
||
| 208 | * @return WP_Post|false Post object, false otherwise. |
||
| 209 | */ |
||
| 210 | public static function get_instance( $post_id ) { |
||
| 211 | global $wpdb; |
||
| 212 | |||
| 213 | $post_id = (int) $post_id; |
||
| 214 | if ( ! $post_id ) |
||
| 215 | return false; |
||
| 216 | |||
| 217 | $_post = wp_cache_get( $post_id, 'posts' ); |
||
| 218 | |||
| 219 | if ( ! $_post ) { |
||
| 220 | $_post = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE ID = %d LIMIT 1", $post_id ) ); |
||
| 221 | |||
| 222 | if ( ! $_post ) |
||
| 223 | return false; |
||
| 224 | |||
| 225 | $_post = sanitize_post( $_post, 'raw' ); |
||
| 226 | wp_cache_add( $_post->ID, $_post, 'posts' ); |
||
| 227 | } elseif ( empty( $_post->filter ) ) { |
||
| 228 | $_post = sanitize_post( $_post, 'raw' ); |
||
| 229 | } |
||
| 230 | |||
| 231 | return new WP_Post( $_post ); |
||
| 232 | } |
||
| 233 | |||
| 234 | /** |
||
| 235 | * Constructor. |
||
| 236 | * |
||
| 237 | * @param WP_Post|object $post Post object. |
||
| 238 | */ |
||
| 239 | public function __construct( $post ) { |
||
| 240 | foreach ( get_object_vars( $post ) as $key => $value ) |
||
| 241 | $this->$key = $value; |
||
| 242 | } |
||
| 243 | |||
| 244 | /** |
||
| 245 | * Isset-er. |
||
| 246 | * |
||
| 247 | * @param string $key Property to check if set. |
||
| 248 | * @return bool |
||
| 249 | */ |
||
| 250 | public function __isset( $key ) { |
||
| 251 | if ( 'ancestors' == $key ) |
||
| 252 | return true; |
||
| 253 | |||
| 254 | if ( 'page_template' == $key ) |
||
| 255 | return ( 'page' == $this->post_type ); |
||
| 256 | |||
| 257 | if ( 'post_category' == $key ) |
||
| 258 | return true; |
||
| 259 | |||
| 260 | if ( 'tags_input' == $key ) |
||
| 261 | return true; |
||
| 262 | |||
| 263 | return metadata_exists( 'post', $this->ID, $key ); |
||
| 264 | } |
||
| 265 | |||
| 266 | /** |
||
| 267 | * Getter. |
||
| 268 | * |
||
| 269 | * @param string $key Key to get. |
||
| 270 | * @return mixed |
||
| 271 | */ |
||
| 272 | public function __get( $key ) { |
||
| 273 | if ( 'page_template' == $key && $this->__isset( $key ) ) { |
||
| 274 | return get_post_meta( $this->ID, '_wp_page_template', true ); |
||
| 275 | } |
||
| 276 | |||
| 277 | View Code Duplication | if ( 'post_category' == $key ) { |
|
| 278 | if ( is_object_in_taxonomy( $this->post_type, 'category' ) ) |
||
| 279 | $terms = get_the_terms( $this, 'category' ); |
||
| 280 | |||
| 281 | if ( empty( $terms ) ) |
||
| 282 | return array(); |
||
| 283 | |||
| 284 | return wp_list_pluck( $terms, 'term_id' ); |
||
|
0 ignored issues
–
show
|
|||
| 285 | } |
||
| 286 | |||
| 287 | View Code Duplication | if ( 'tags_input' == $key ) { |
|
| 288 | if ( is_object_in_taxonomy( $this->post_type, 'post_tag' ) ) |
||
| 289 | $terms = get_the_terms( $this, 'post_tag' ); |
||
| 290 | |||
| 291 | if ( empty( $terms ) ) |
||
| 292 | return array(); |
||
| 293 | |||
| 294 | return wp_list_pluck( $terms, 'name' ); |
||
|
0 ignored issues
–
show
It seems like
$terms defined by get_the_terms($this, 'post_tag') on line 289 can also be of type object<WP_Error>; however, wp_list_pluck() does only seem to accept array, maybe add an additional type check?
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /**
* @return array|string
*/
function returnsDifferentValues($x) {
if ($x) {
return 'foo';
}
return array();
}
$x = returnsDifferentValues($y);
if (is_array($x)) {
// $x is an array.
}
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. Loading history...
|
|||
| 295 | } |
||
| 296 | |||
| 297 | // Rest of the values need filtering. |
||
| 298 | if ( 'ancestors' == $key ) |
||
| 299 | $value = get_post_ancestors( $this ); |
||
| 300 | else |
||
| 301 | $value = get_post_meta( $this->ID, $key, true ); |
||
| 302 | |||
| 303 | if ( $this->filter ) |
||
| 304 | $value = sanitize_post_field( $key, $value, $this->ID, $this->filter ); |
||
| 305 | |||
| 306 | return $value; |
||
| 307 | } |
||
| 308 | |||
| 309 | /** |
||
| 310 | * {@Missing Summary} |
||
| 311 | * |
||
| 312 | * @param string $filter Filter. |
||
| 313 | * @return self|array|bool|object|WP_Post |
||
| 314 | */ |
||
| 315 | public function filter( $filter ) { |
||
| 316 | if ( $this->filter == $filter ) |
||
| 317 | return $this; |
||
| 318 | |||
| 319 | if ( $filter == 'raw' ) |
||
| 320 | return self::get_instance( $this->ID ); |
||
| 321 | |||
| 322 | return sanitize_post( $this, $filter ); |
||
| 323 | } |
||
| 324 | |||
| 325 | /** |
||
| 326 | * Convert object to array. |
||
| 327 | * |
||
| 328 | * @return array Object as array. |
||
| 329 | */ |
||
| 330 | public function to_array() { |
||
| 331 | $post = get_object_vars( $this ); |
||
| 332 | |||
| 333 | foreach ( array( 'ancestors', 'page_template', 'post_category', 'tags_input' ) as $key ) { |
||
| 334 | if ( $this->__isset( $key ) ) |
||
| 335 | $post[ $key ] = $this->__get( $key ); |
||
| 336 | } |
||
| 337 | |||
| 338 | return $post; |
||
| 339 | } |
||
| 340 | } |
||
| 341 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.