Issues (51)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/Util/helper.php (4 issues)

1
<?php namespace EmailLog\Util;
2
3
/**
4
 * Email Log Helper functions.
5
 * Some of these functions would be used the addons.
6
 */
7
defined( 'ABSPATH' ) || exit; // Exit if accessed directly.
8
9
/**
10
 * Perform additional sanitation of emails.
11
 *
12
 * @since 1.9
13
 *
14
 * @param string $email    Email string to be sanitized.
15
 * @param bool   $multiple (Optional) Should multiple emails be allowed. True by default.
16
 *
17
 * @return string Sanitized email.
18
 */
19
function sanitize_email( $email, $multiple = true ) {
20 13
	$emails = explode( ',', $email );
21 13
	if ( ! $multiple ) {
22 3
		$emails = array_slice( $emails, 0, 1 );
23
	}
24
25 13
	$cleaned_emails = array_map( __NAMESPACE__ . '\\sanitize_email_with_name', $emails );
26
27 13
	return implode( ', ', $cleaned_emails );
28
}
29
30
/**
31
 * Sanitize email with name.
32
 *
33
 * @since 1.9
34
 *
35
 * @param string $string Email string to be sanitized.
36
 *
37
 * @return string Sanitized email.
38
 */
39
function sanitize_email_with_name( $string ) {
40 13
	$string = trim( $string );
41
42 13
	$bracket_pos = strpos( $string, '<' );
43 13
	if ( false !== $bracket_pos ) {
44 5
		if ( $bracket_pos > 0 ) {
45 5
			$name = substr( $string, 0, $bracket_pos );
46 5
			$name = trim( $name );
47
48 5
			$email = substr( $string, $bracket_pos + 1 );
49 5
			$email = str_replace( '>', '', $email );
50
51 5
			return sanitize_text_field( $name ) . ' <' . \sanitize_email( $email ) . '>';
52
		}
53
	}
54
55 8
	return \sanitize_email( $string );
56
}
57
58
/**
59
 * Gets the columns to export logs.
60
 *
61
 * If the More Fields add-on is active, additional columns are returned.
62
 *
63
 * @since 2.0.0
64
 *
65
 * @return string[] List of Columns to export.
66
 */
67
function get_log_columns_to_export() {
68
69
	if ( is_plugin_active( 'email-log-more-fields/email-log-more-fields.php' ) ) {
70
		return array(
71
			'id',
72
			'sent_date',
73
			'to_email',
74
			'subject',
75
			'from',
76
			'cc',
77
			'bcc',
78
			'reply-to',
79
			'attachment',
80
		);
81
	}
82
83
	return array( 'id', 'sent_date', 'to_email', 'subject' );
84
}
85
86
/**
87
 * Is it an admin request and not an ajax request.
88
 *
89
 * @since 2.1
90
 *
91
 * @return bool True if admin non ajax request, False otherwise.
92
 */
93
function is_admin_non_ajax_request() {
94
	if ( function_exists( 'wp_doing_ajax' ) && wp_doing_ajax() ) {
95
		return false;
96
	}
97
98
	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
99
		return false;
100
	}
101
102
	return is_admin();
103
}
104
105
/**
106
 * Checks the Checkbox when values are present in a given array.
107
 *
108
 * Use this function in Checkbox fields.
109
 *
110
 * @since 2.1.0
111
 *
112
 * @param array  $values  List of all possible values.
113
 * @param string $current The current value to be checked.
114
 */
115
function checked_array( $values, $current ) {
116 2
	if ( ! is_array( $values ) ) {
117 1
		return;
118
	}
119
120 1
	if ( in_array( $current, $values, true ) ) {
121 1
		echo "checked='checked'";
122
	}
123 1
}
124
125
/**
126
 * Return failure icon.
127
 *
128
 * @since 2.3.2
129
 *
130
 * @return string Failure icon markup.
131
 */
132
function get_failure_icon() {
133
	return <<<EOT
134
<span class="dashicons dashicons-dismiss"></span>
135
EOT;
136
}
137
138
/**
139
 * Return success icon.
140
 *
141
 * @since 2.3.2
142
 *
143
 * @return string Success icon markup.
144
 */
145
function get_success_icon() {
146
	return <<<EOT
147
<span class="dashicons dashicons-yes-alt"></span>
148
EOT;
149
150
}
151
152
/**
153
 * Stringify arrays.
154
 *
155
 * If the parameter is an array, then return delimiter separated values of the array.
156
 * Otherwise return the parameter.
157
 *
158
 * @since 2.3.0
159
 * @since 2.3.2 Renamed name to `Stringify`.
160
 *
161
 * @param array|string $may_be_array The array whose values are to be converted to string.
162
 * @param string       $delimiter    Optional. Default is `,`.
163
 *
164
 * @return string Stringified value.
165
 */
166
function stringify( $may_be_array, $delimiter = ',' ) {
167 1
	if ( ! is_array( $may_be_array ) ) {
168
		return (string) $may_be_array;
169
	}
170
171 1
	return implode( $delimiter, $may_be_array );
172
}
173
174
/**
175
 * Gets the User defined Date time format.
176
 *
177
 * @used-by \EmailLog\Core\UI\Setting\CoreSetting
178
 *
179
 * @since   2.3.0
180
 *
181
 * @return string
182
 */
183
function get_user_defined_date_time_format() {
184
	return sprintf( '%1$s %2$s', get_option( 'date_format', 'Y-m-d' ), get_option( 'time_format', 'g:i a' ) );
0 ignored issues
show
It seems like get_option('date_format', 'Y-m-d') can also be of type false; however, parameter $values of sprintf() does only seem to accept double|integer|string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

184
	return sprintf( '%1$s %2$s', /** @scrutinizer ignore-type */ get_option( 'date_format', 'Y-m-d' ), get_option( 'time_format', 'g:i a' ) );
Loading history...
185
}
186
187
/**
188
 * Get the display format for displaying the email log time.
189
 *
190
 * @since 2.4.3
191
 *
192
 * @return string Email log time display format.
193
 */
194
function get_display_format_for_log_time() {
195
	$default_time_format = get_option( 'time_format', 'g:i:s a' );
196
197
	if ( false === stripos( $default_time_format, 's' ) ) {
0 ignored issues
show
It seems like $default_time_format can also be of type false; however, parameter $haystack of stripos() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

197
	if ( false === stripos( /** @scrutinizer ignore-type */ $default_time_format, 's' ) ) {
Loading history...
198
		/* translators: Email Log time display format, see http://php.net/date */
199
		$default_time_format = __( 'g:i:s a', 'email-log' );
200
	}
201
202
	/**
203
	 * Filter the time format string for displaying log time.
204
	 *
205
	 * @since 2.4.3
206
	 *
207
	 * @param string $default_time_format Default time format.
208
	 */
209
	return apply_filters( 'el_log_time_display_format', $default_time_format );
210
}
211
212
/**
213
 * Gets the value by key from the array.
214
 *
215
 * If the key isn't found, then null is returned.
216
 *
217
 * @since 2.3.0
218
 *
219
 * @param array  $array   The actual array.
220
 * @param string $key     The key whose value is to be retrieved.
221
 * @param string $default Optional.
222
 *
223
 * @return mixed|null
224
 */
225
function el_array_get( $array, $key, $default = null ) {
226
	return isset( $array[ $key ] ) ? $array[ $key ] : $default;
227
}
228
229
/**
230
 * Returns TRUE if the given search term is Advanced Search Term.
231
 *
232
 * @param string $term Search Term.
233
 *
234
 * @return bool
235
 */
236
function is_advanced_search_term( $term ) {
237
	if ( ! is_string( $term ) ) {
0 ignored issues
show
The condition is_string($term) is always true.
Loading history...
238
		return false;
239
	}
240
241
	$predicates = get_advanced_search_term_predicates( $term );
242
243
	return ! empty( $predicates );
244
}
245
246
/**
247
 * Gets the Search Term Predicates.
248
 *
249
 * Example:
250
 *
251
 * If $term = to:[email protected] then,
252
 *
253
 * the output would be
254
 *
255
 * $output = array(
256
 *      'to' => [email protected]
257
 * )
258
 *
259
 * @since 2.3.0
260
 *
261
 * @param string $term Search Term.
262
 *
263
 * @return array
264
 */
265
function get_advanced_search_term_predicates( $term ) {
266
	if ( ! is_string( $term ) ) {
0 ignored issues
show
The condition is_string($term) is always true.
Loading history...
267
		return array();
268
	}
269
270
	$predicates           = explode( ' ', $term );
271
	$predicates_organized = array();
272
273
	foreach ( $predicates as $predicate ) {
274
		$is_match = preg_match( '/(id|email|to|cc|bcc|reply-to):(.*)$/', $predicate, $matches );
275
		if ( 1 === $is_match ) {
276
			$predicates_organized[ $matches[1] ] = $matches[2];
277
		}
278
	}
279
280
	return $predicates_organized;
281
}
282
283
/**
284
 * Gets the Advanced Search URL.
285
 *
286
 * @since 2.3.0
287
 *
288
 * @return string
289
 */
290
function get_advanced_search_url() {
291
	$admin_url = get_admin_url( null, 'admin.php?page=email-log' );
292
293
	return add_query_arg( 'el_as', 1, $admin_url );
294
}
295
296
/**
297
 * Gets the Column labels to be used in LogList table.
298
 *
299
 * Deprecated. This is currently used by Email Log - Export Logs add-on v1.2.1 and will eventually be removed.
300
 *
301
 * @since 2.3.0
302
 * @since 2.3.2 Deprecated.
303
 *
304
 * @param string $db_column Column ID.
305
 *
306
 * @return string Column label.
307
 */
308
function get_column_label_by_db_column( $db_column ) {
309
	return get_column_label( $db_column );
310
}
311
312
/**
313
 * Get Column label based on column name.
314
 *
315
 * @since 2.3.2
316
 *
317
 * @param string $column_name Column name.
318
 *
319
 * @return string Column label.
320
 */
321
function get_column_label( $column_name ) {
322 1
	$labels = get_column_label_map();
323
324 1
	if ( ! array_key_exists( $column_name, $labels ) ) {
325
		return $column_name;
326
	}
327
328 1
	return $labels[ $column_name ];
329
}
330
331
/**
332
 * Returns an array of Email Log columns.
333
 *
334
 * Keys are the column names in the DB.
335
 * This holds true except for CC, BCC & Reply To as they are put under one column `headers`.
336
 *
337
 * @since 2.3.2
338
 *
339
 * @return array Key value pair of Email Log columns.
340
 */
341
function get_column_label_map() {
342
	$labels = array(
343 1
		'id'          => __( 'ID', 'email-log' ),
344 1
		'to_email'    => __( 'To', 'email-log' ),
345 1
		'subject'     => __( 'Subject', 'email-log' ),
346 1
		'message'     => __( 'Message', 'email-log' ),
347 1
		'attachments' => __( 'Attachment', 'email-log' ),
348 1
		'sent_date'   => __( 'Sent at', 'email-log' ),
349 1
		'from'        => __( 'From', 'email-log' ),
350 1
		'cc'          => __( 'CC', 'email-log' ),
351 1
		'bcc'         => __( 'BCC', 'email-log' ),
352 1
		'reply_to'    => __( 'Reply To', 'email-log' ),
353 1
		'ip_address'  => __( 'IP Address', 'email-log' ),
354 1
		'result'      => __( 'Sent Status', 'email-log' ),
355
	);
356
357
	/**
358
	 * Filters the Labels used through out the Email Log plugin.
359
	 *
360
	 * @since 2.3.2
361
	 *
362
	 * @param array $labels List of DB Columns and its respective labels which are internationalized string.
363
	 *                      Example: 'id' => __( 'ID', 'email-log' ),
364
	 */
365 1
	return apply_filters( 'el_db_column_labels', $labels );
366
}
367