Issues (51)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/Addon/License/Licenser.php (2 issues)

1
<?php namespace EmailLog\Addon\License;
2
3
use EmailLog\Addon\AddonList;
4
use EmailLog\Addon\API\EDDUpdater;
5
use EmailLog\Core\Loadie;
6
7
defined( 'ABSPATH' ) || exit; // Exit if accessed directly.
8
9
/**
10
 * Handles the add-on licensing for Email Log.
11
 *
12
 * There can be one normal license for each add-on or one bundle license for all add-ons.
13
 * This class is final because we don't want other plugins to interfere with Email Log licensing.
14
 *
15
 * @since 2.0.0
16
 */
17
final class Licenser implements Loadie {
18
19
	/**
20
	 * Bundle License object.
21
	 *
22
	 * @var \EmailLog\Addon\License\BundleLicense
23
	 */
24
	private $bundle_license;
25
26
	/**
27
	 * List of Add-on updaters.
28
	 *
29
	 * @var \EmailLog\Addon\API\EDDUpdater[]
30
	 */
31
	private $updaters = array();
32
33
	/**
34
	 * List of add-ons.
35
	 *
36
	 * @var \EmailLog\Addon\AddonList
37
	 */
38
	private $addon_list;
39
40
	/**
41
	 * Licenser constructor.
42
	 * If the bundle_license object is not passed a new object is created.
43
	 * If the addon_list object is not passed a new object is created.
44
	 *
45
	 * @param \EmailLog\Addon\License\BundleLicense|null $bundle_license Optional. Bundle License.
46
	 * @param \EmailLog\Addon\AddonList|null             $addon_list     Optional. Add-on List.
47
	 */
48
	public function __construct( $bundle_license = null, $addon_list = null ) {
49
		if ( ! $bundle_license instanceof BundleLicense ) {
50
			$bundle_license = new BundleLicense();
51
		}
52
53
		if ( ! $addon_list instanceof AddonList ) {
54
			$addon_list = new AddonList();
55
		}
56
57
		$this->bundle_license = $bundle_license;
58
		$this->addon_list     = $addon_list;
59
	}
60
61
	/**
62
	 * Load all Licenser related hooks.
63
	 *
64
	 * @inheritdoc
65
	 */
66
	public function load() {
67
		$this->bundle_license->load();
68
69
		add_action( 'el_before_addon_list', array( $this, 'render_bundle_license_form' ) );
70
71
		add_action( 'el_bundle_license_activate', array( $this, 'activate_bundle_license' ) );
72
		add_action( 'el_bundle_license_deactivate', array( $this, 'deactivate_bundle_license' ) );
73
74
		add_action( 'el_license_activate', array( $this, 'activate_addon_license' ) );
75
		add_action( 'el_license_deactivate', array( $this, 'deactivate_addon_license' ) );
76
	}
77
78
	/**
79
	 * Add an Add-on Updater.
80
	 *
81
	 * @param \EmailLog\Addon\API\EDDUpdater $updater Add-on Updater.
82
	 */
83
	public function add_updater( $updater ) {
84
		if ( $updater instanceof EDDUpdater ) {
0 ignored issues
show
$updater is always a sub-type of EmailLog\Addon\API\EDDUpdater.
Loading history...
85
			$this->updaters[ $updater->get_slug() ] = $updater;
86
		}
87
	}
88
89
	/**
90
	 * Get list of add-ons.
91
	 *
92
	 * @return \EmailLog\Addon\AddonList Add-on List.
93
	 */
94
	public function get_addon_list() {
95
		return $this->addon_list;
96
	}
97
98
	/**
99
	 * Render the Bundle License Form.
100
	 */
101
	public function render_bundle_license_form() {
102
		$action       = 'el_bundle_license_activate';
103
		$action_text  = __( 'Activate', 'email-log' );
104
		$button_class = 'button-primary';
105
106
		$expiry_details       = '';
107
		$expiry_details_class = '';
108
109
		if ( $this->is_bundle_license_valid() ) {
110
			$action       = 'el_bundle_license_deactivate';
111
			$action_text  = __( 'Deactivate', 'email-log' );
112
			$button_class = '';
113
114
			if ( $this->bundle_license->is_lifetime_license() ) {
115
				$expiry_details       = __( 'You have a lifetime license, which will never expire!', 'email-log' );
116
				$expiry_details_class = 'notice notice-success';
117
			} else {
118
				$expiry_date = date( 'F d, Y', strtotime( $this->get_bundle_license_expiry_date() ) );
0 ignored issues
show
It seems like $this->get_bundle_license_expiry_date() can also be of type false; however, parameter $datetime of strtotime() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

118
				$expiry_date = date( 'F d, Y', strtotime( /** @scrutinizer ignore-type */ $this->get_bundle_license_expiry_date() ) );
Loading history...
119
120
				if ( $this->bundle_license->has_expired() ) {
121
					/* translators: 1 License expiry date, 2 License Renewal link */
122
					$expiry_details       = sprintf( __( 'Your license has expired on %1$s. Please <a href="%2$s">renew it</a> to receive automatic updates and support.', 'email-log' ), $expiry_date, esc_url( $this->bundle_license->get_renewal_link() ) );
123
					$expiry_details_class = 'notice notice-warning';
124
				} else {
125
					/* translators: 1 License expiry date */
126
					$expiry_details       = sprintf( __( 'Your license is valid till %s', 'email-log' ), $expiry_date );
127
					$expiry_details_class = 'expires';
128
				}
129
			}
130
		}
131
		?>
132
133
		<div class="bundle-license">
134
			<?php if ( ! $this->is_bundle_license_valid() ) : ?>
135
				<p class="notice notice-warning">
136
					<?php
137
					printf(
138
						__( "Enter your license key to activate add-ons. If you don't have a license, then you can <a href='%s' target='_blank'>buy it</a>", 'email-log' ),
139
						'https://wpemaillog.com/store/?utm_campaign=Upsell&utm_medium=wpadmin&utm_source=notice&utm_content=buy-it'
140
					);
141
					?>
142
				</p>
143
			<?php endif; ?>
144
145
			<form method="post">
146
				<input type="text" name="el-license" class="el-license" size="40"
147
					   title="<?php _e( 'Email Log Bundle License Key', 'email-log' ); ?>"
148
					   placeholder="<?php _e( 'Email Log Bundle License Key', 'email-log' ); ?>"
149
					   value="<?php echo esc_attr( $this->bundle_license->get_license_key() ); ?>">
150
151
				<input type="submit" class="button <?php echo sanitize_html_class( $button_class ); ?>"
152
					   value="<?php echo esc_attr( $action_text ); ?>">
153
154
				<?php if ( ! empty( $expiry_details ) ) : ?>
155
					<p class="<?php echo esc_attr( $expiry_details_class ); ?>">
156
						<?php echo $expiry_details; ?>
157
					</p>
158
				<?php endif; ?>
159
160
				<input type="hidden" name="el-action" value="<?php echo esc_attr( $action ); ?>">
161
162
				<?php wp_nonce_field( $action, $action . '_nonce' ); ?>
163
			</form>
164
		</div>
165
		<?php
166
	}
167
168
	/**
169
	 * Activate Bundle License.
170
	 *
171
	 * @param array $request Request Object.
172
	 */
173
	public function activate_bundle_license( $request ) {
174
		$license_key = sanitize_text_field( $request['el-license'] );
175
176
		$this->bundle_license->set_license_key( $license_key );
177
178
		try {
179
			$this->bundle_license->activate();
180
			$message = __( 'Your license has been activated. You can now install add-ons, will receive automatic updates and access to email support.', 'email-log' );
181
			$type    = 'updated';
182
		} catch ( \Exception $e ) {
183
			$message = $e->getMessage();
184
			$type    = 'error';
185
		}
186
187
		add_settings_error( 'bundle-license', 'bundle-license', $message, $type );
188
	}
189
190
	/**
191
	 * Deactivate Bundle License.
192
	 */
193
	public function deactivate_bundle_license() {
194
		try {
195
			$this->bundle_license->deactivate();
196
			$message = __( 'Your license has been deactivated. You will not receive automatic updates.', 'email-log' );
197
			$type    = 'updated';
198
		} catch ( \Exception $e ) {
199
			$message = $e->getMessage();
200
			$type    = 'error';
201
		}
202
203
		add_settings_error( 'bundle-license', 'bundle-license', $message, $type );
204
	}
205
206
	/**
207
	 * Is the bundle license valid?
208
	 *
209
	 * @return bool True, if Bundle License is active, False otherwise.
210
	 */
211
	public function is_bundle_license_valid() {
212
		return $this->bundle_license->is_valid();
213
	}
214
215
	/**
216
	 * Get the expiry date of the Bundle License.
217
	 *
218
	 * @return false|string Expiry date, False if license is not valid.
219
	 */
220
	protected function get_bundle_license_expiry_date() {
221
		return $this->bundle_license->get_expiry_date();
222
	}
223
224
	/**
225
	 * Activate individual add-on License.
226
	 *
227
	 * @param array $request Request Array.
228
	 */
229
	public function activate_addon_license( $request ) {
230
		$license_key = sanitize_text_field( $request['el-license'] );
231
		$addon_name  = sanitize_text_field( $request['el-addon'] );
232
233
		$license = $this->addon_list->get_addon_by_name( $addon_name )->get_license();
234
		$license->set_license_key( $license_key );
235
236
		try {
237
			$license->activate();
238
			$message = sprintf(
239
				__( 'Your license for %s has been activated. You will receive automatic updates and access to email support.', 'email-log' ),
240
				$addon_name
241
			);
242
			$type = 'updated';
243
		} catch ( \Exception $e ) {
244
			$message = $e->getMessage();
245
			$type    = 'error';
246
		}
247
248
		add_settings_error( 'addon-license', 'addon-license', $message, $type );
249
	}
250
251
	/**
252
	 * Deactivate individual add-on License.
253
	 *
254
	 * @param array $request Request Array.
255
	 */
256
	public function deactivate_addon_license( $request ) {
257
		$license_key = sanitize_text_field( $request['el-license'] );
258
		$addon_name  = sanitize_text_field( $request['el-addon'] );
259
260
		$license = $this->addon_list->get_addon_by_name( $addon_name )->get_license();
261
		$license->set_license_key( $license_key );
262
263
		try {
264
			$license->deactivate();
265
			$message = sprintf(
266
				__( 'Your license for %s has been deactivated. You will not receive automatic updates.', 'email-log' ),
267
				$addon_name
268
			);
269
			$type = 'updated';
270
		} catch ( \Exception $e ) {
271
			$message = $e->getMessage();
272
			$type    = 'error';
273
		}
274
275
		add_settings_error( 'addon-license', 'addon-license', $message, $type );
276
	}
277
278
	/**
279
	 * Get the license key of an add-on.
280
	 *
281
	 * @param string $addon_name Addon.
282
	 *
283
	 * @return bool|string License key if found, False otherwise.
284
	 */
285
	public function get_addon_license_key( $addon_name ) {
286
		if ( $this->is_bundle_license_valid() ) {
287
			return $this->bundle_license->get_addon_license_key( $addon_name );
288
		}
289
290
		$addon = $this->addon_list->get_addon_by_name( $addon_name );
291
292
		if ( ! $addon ) {
293
			return false;
294
		}
295
296
		return $addon->get_addon_license_key();
297
	}
298
299
	/**
300
	 * Get the Download URL of an add-on.
301
	 *
302
	 * @param string $addon_slug Add-on slug.
303
	 *
304
	 * @return string Download URL.
305
	 */
306
	public function get_addon_download_url( $addon_slug ) {
307
		if ( isset( $this->updaters[ $addon_slug ] ) ) {
308
			return $this->updaters[ $addon_slug ]->get_download_url();
309
		}
310
311
		return '';
312
	}
313
314
	/**
315
	 * Is an add-on active?
316
	 *
317
	 * @since 2.4.0
318
	 *
319
	 * @param string $addon_name Add-on name.
320
	 *
321
	 * @return bool True if add-on is present and is active, false otherwise.
322
	 */
323
	public function is_addon_active( $addon_name ) {
324
		return $this->addon_list->is_addon_active( $addon_name );
325
	}
326
327
	/**
328
	 * Is an add-on installed?
329
	 *
330
	 * @since 2.4.0
331
	 *
332
	 * @param string $addon_name Add-on name.
333
	 *
334
	 * @return bool True if add-on is present and is installed, false otherwise.
335
	 */
336
	public function is_addon_installed( $addon_name ) {
337
		return $this->addon_list->is_addon_installed( $addon_name );
338
	}
339
340
	/**
341
	 * Return the bundle license.
342
	 *
343
	 * @return \EmailLog\Addon\License\BundleLicense|null Bundle license or null if no bundle license.
344
	 */
345
	public function get_bundle_license() {
346
		return $this->bundle_license;
347
	}
348
}
349