Issues (52)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/license/class-bd-license-handler.php (5 issues)

1
<?php
2
/**
3
 * License Handler for Bulk Delete Addons.
4
 *
5
 * @since      5.0
6
 *
7
 * @author     Sudar
8
 *
9
 * @package    BulkDelete/License
10
 */
11
defined( 'ABSPATH' ) || exit; // Exit if accessed directly
12
13
class BD_License_Handler {
14
	/**
15
	 * Name of the addon.
16
	 *
17
	 * @since 5.0
18
	 */
19
	private $addon_name;
20
21
	/**
22
	 * Code of the addon.
23
	 *
24
	 * @since 5.0
25
	 */
26
	private $addon_code;
27
28
	/**
29
	 * Version of the plugin.
30
	 *
31
	 * @since 5.0
32
	 */
33
	private $version;
34
35
	/**
36
	 * plugin file name.
37
	 *
38
	 * @since 5.0
39
	 */
40
	private $plugin_file;
41
42
	/**
43
	 * Plugin base name.
44
	 *
45
	 * @since 5.5
46
	 */
47
	private $plugin_basename;
48
49
	/**
50
	 * Author of the plugin.
51
	 *
52
	 * @since 5.0
53
	 */
54
	private $author;
55
56
	/**
57
	 * Instance of the updater class.
58
	 *
59
	 * @since 5.5
60
	 */
61
	private $updater;
62
63
	/**
64
	 * Notice Message.
65
	 *
66
	 * @since 5.5
67
	 */
68
	private $notice_msg = '';
69
70
	/**
71
	 * Constructor.
72
	 *
73
	 * @since 5.0
74
	 *
75
	 * @param string $addon_name  Name of the addon
76
	 * @param string $addon_code  Code of the addon
77
	 * @param string $version     Version of the addon
78
	 * @param string $plugin_file Addon file name
79
	 * @param string $author      (optional) Author of the addon
80
	 */
81
	public function __construct( $addon_name, $addon_code, $version, $plugin_file, $author = 'Sudar Muthu' ) {
82
		$this->addon_name      = $addon_name;
83
		$this->addon_code      = $addon_code;
84
		$this->version         = $version;
85
		$this->plugin_file     = $plugin_file;
86
		$this->plugin_basename = plugin_basename( $plugin_file );
87
		$this->author          = $author;
88
89
		$this->hooks();
90
	}
91
92
	/**
93
	 * setup hooks.
94
	 *
95
	 * @access private
96
	 *
97
	 * @since 5.0
98
	 */
99
	private function hooks() {
100
		add_action( 'admin_init', array( $this, 'check_license' ), 0 );
101
		add_action( 'admin_notices', array( $this, 'show_admin_notices' ) );
102
		add_action( 'after_plugin_row_' . $this->plugin_basename, array( $this, 'plugin_row' ), 11, 3 );
103
104
		add_action( 'bd_license_form' , array( $this, 'display_license_form' ) );
105
		add_action( 'bd_license_field', array( $this, 'add_license_field' ) );
106
		add_filter( 'bd_license_input', array( $this, 'parse_license_input' ), 1 );
107
	}
108
109
	/**
110
	 * Check whether the license is valid for the addon.
111
	 *
112
	 * If the license is not valid then add a notice about it.
113
	 * If it is valid then hook the plugin updater.
114
	 *
115
	 * @since 5.5
116
	 */
117
	public function check_license() {
118
		if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
119
			return;
120
		}
121
122
		$campaign_args = array(
123
			'utm_source'   => 'wpadmin',
124
			'utm_campaign' => 'BulkDelete',
125
			'utm_medium'   => 'header-notice',
126
			'utm_content'  => strtolower( $this->addon_code ),
127
		);
128
		$addon_url = bd_get_addon_url( $this->addon_name, $campaign_args );
129
130
		$license_code = BD_License::get_license_code( $this->addon_code );
131
132
		if ( false == $license_code ) {
0 ignored issues
show
It seems like you are loosely comparing $license_code of type boolean|string against false; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.
Loading history...
133
			$this->notice_msg = sprintf( __( '"%1$s" addon is installed but not activated. To activate the addon, please <a href="%2$s">enter your license key</a>. If you don\'t have a license key, then you can <a href="%3$s" target="_blank">purchase one</a>.', 'bulk-delete' ), $this->addon_name, esc_url( get_bloginfo( 'wpurl' ) . '/wp-admin/admin.php?page=' . Bulk_Delete::ADDON_PAGE_SLUG ), esc_url( $addon_url ) );
134
		} else {
135
			if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
136
				$this->notice_msg = sprintf( __( 'The license for "%1$s" addon is either invalid or has expired. Please <a href="%2$s" target="_blank">renew the license</a> or <a href="%3$s">enter a new license key</a> to receive updates and support.', 'bulk-delete' ), $this->addon_name, esc_url( $addon_url ), esc_url( get_bloginfo( 'wpurl' ) . '/wp-admin/admin.php?page=' . Bulk_Delete::ADDON_PAGE_SLUG ) );
137
			}
138
		}
139
140
		$this->hook_updater( $license_code );
141
	}
142
143
	/**
144
	 * Start the updater.
145
	 *
146
	 * @since 5.0
147
	 * @access private
148
	 *
149
	 * @param string $license_code License Code
150
	 */
151
	private function hook_updater( $license_code ) {
152
		if ( ! class_exists( 'EDD_SL_Plugin_Updater' ) ) {
153
			require_once Bulk_Delete::$PLUGIN_DIR . '/include/libraries/EDD_SL_Plugin_Updater.php';
154
		}
155
156
		$this->updater = new EDD_SL_Plugin_Updater( BD_EDD_API_Wrapper::STORE_URL, $this->plugin_file, array(
0 ignored issues
show
The type EDD_SL_Plugin_Updater was not found. Maybe you did not declare it correctly or list all dependencies?

The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g. excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:

filter:
    dependency_paths: ["lib/*"]

For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths

Loading history...
157
				'version'    => $this->version,
158
				'license'    => $license_code,
159
				'item_name'  => $this->addon_name,
160
				'addon_code' => $this->addon_code,
161
				'author'     => $this->author,
162
				'url'        => home_url(),
163
			)
164
		);
165
	}
166
167
	/**
168
	 * Display notification at the top of all admin pages.
169
	 *
170
	 * @since 5.5
171
	 */
172
	public function show_admin_notices() {
173
		/**
174
		 * Check if user have admin rights.
175
		 *
176
		 * @since 6.0
177
		 */
178
		if ( current_user_can( 'manage_options' ) ) {
179
			if ( '' != $this->notice_msg ) {
180
				printf( '<div class="error"><p><strong>%s</strong></p></div>', $this->notice_msg );
181
			}
182
		}
183
	}
184
185
	/**
186
	 * Display license information about addon in plugin list table.
187
	 *
188
	 * @since 5.5
189
	 *
190
	 * @param string $plugin_file Path to the plugin file, relative to the plugins directory.
191
	 * @param array  $plugin_data An array of plugin data.
192
	 * @param string $status      Status of the plugin.
193
	 */
194
	public function plugin_row( $plugin_file, $plugin_data, $status ) {
0 ignored issues
show
The parameter $status is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

194
	public function plugin_row( $plugin_file, $plugin_data, /** @scrutinizer ignore-unused */ $status ) {

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $plugin_data is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

194
	public function plugin_row( $plugin_file, /** @scrutinizer ignore-unused */ $plugin_data, $status ) {

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
195
		if ( $plugin_file != $this->plugin_basename ) {
196
			return;
197
		}
198
199
		$campaign_args = array(
200
			'utm_source'   => 'wpadmin',
201
			'utm_campaign' => 'BulkDelete',
202
			'utm_medium'   => 'plugin-page',
203
			'utm_content'  => strtolower( $this->addon_code ),
204
		);
205
		$addon_url = bd_get_addon_url( $this->addon_name, $campaign_args );
206
207
		$license_code = BD_License::get_license_code( $this->addon_code );
208
		if ( false == $license_code ) {
0 ignored issues
show
It seems like you are loosely comparing $license_code of type boolean|string against false; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.
Loading history...
209
			$plugin_row_msg = sprintf( __( 'Addon is not activated. To activate the addon, please <a href="%1$s">enter your license key</a>. If you don\'t have a license key, then you can <a href="%2$s" target="_blank">purchase one</a>.', 'bulk-delete' ), esc_url( get_bloginfo( 'wpurl' ) . '/wp-admin/admin.php?page=' . Bulk_Delete::ADDON_PAGE_SLUG ), esc_url( $addon_url ) );
210
?>
211
			<tr class="plugin-update-tr">
212
				<td colspan="3" class="plugin-update">
213
					<div class="update-message"><span class="bd-licence-activate-notice"><?php echo $plugin_row_msg; ?></span></div>
214
				</td>
215
			</tr>
216
<?php
217
		} else {
218
			if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
219
				$plugin_row_msg = sprintf( __( 'The license for this addon is either invalid or has expired. Please <a href="%1$s" target="_blank">renew the license</a> or <a href="%2$s">enter a new license key</a> to receive updates and support.', 'bulk-delete' ), esc_url( $addon_url ), esc_url( get_bloginfo( 'wpurl' ) . '/wp-admin/admin.php?page=' . Bulk_Delete::ADDON_PAGE_SLUG ) );
220
?>
221
				<tr class="plugin-update-tr">
222
					<td colspan="3" class="plugin-update">
223
						<div class="update-message"><span class="bd-licence-activate-notice"><?php echo $plugin_row_msg; ?></span></div>
224
					</td>
225
				</tr>
226
<?php
227
			}
228
		}
229
	}
230
231
	/**
232
	 * Decide whether to display the license form or not.
233
	 *
234
	 * @since 5.0
235
	 */
236
	public function display_license_form() {
237
		if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
238
			$bd                                = BULK_DELETE();
239
			$bd->display_activate_license_form = true;
240
		}
241
	}
242
243
	/**
244
	 * Add the license field to license form.
245
	 *
246
	 * @since 5.0
247
	 */
248
	public function add_license_field() {
249
		if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
250
			add_settings_field(
251
				$this->addon_code, // ID
252
				'"' . $this->addon_name . '" ' . __( 'Addon License Key', 'bulk-delete' ), // Title
253
				array( $this, 'print_license_key_field' ), // Callback
254
				Bulk_Delete::ADDON_PAGE_SLUG, // Page
255
				Bulk_Delete::SETTING_SECTION_ID // Section
256
			);
257
		}
258
	}
259
260
	/**
261
	 * Print the license field.
262
	 *
263
	 * @since 5.0
264
	 */
265
	public function print_license_key_field() {
266
		if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
267
			printf(
268
				'<input type="text" id="%s" name="%s[%s]" placeholder="%s" size="40">',
269
				$this->addon_code,
270
				Bulk_Delete::SETTING_OPTION_NAME,
271
				$this->addon_code,
272
				__( 'Enter license key', 'bulk-delete' )
273
			);
274
		}
275
	}
276
277
	/**
278
	 * Parse the license key and activate it if needed.
279
	 * If the key is invalid, then don't save it in the setting option.
280
	 *
281
	 * @since 5.0
282
	 *
283
	 * @param array $input
284
	 *
285
	 * @return array
286
	 */
287
	public function parse_license_input( $input ) {
288
		if ( is_array( $input ) && key_exists( $this->addon_code, $input ) ) {
289
			$license_code = trim( $input[ $this->addon_code ] );
290
291
			if ( ! empty( $license_code ) ) {
292
				if ( ! BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
293
					$activated = BD_License::activate_license( $this->addon_name, $this->addon_code, $license_code );
294
					if ( ! $activated ) {
295
						unset( $input[ $this->addon_code ] );
296
					}
297
				}
298
			} else {
299
				unset( $input[ $this->addon_code ] );
300
			}
301
		} else {
302
			if ( BD_License::has_valid_license( $this->addon_name, $this->addon_code ) ) {
303
				$license_code               = BD_License::get_license_code( $this->addon_code );
304
				$input[ $this->addon_code ] = $license_code;
305
			}
306
		}
307
308
		return $input;
309
	}
310
}
311
?>
312