Issues (197)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/admin/stripe-settings.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if ( ! defined( 'ABSPATH' ) ) {
3
	exit;
4
}
5
6
if ( woocommerce_gateway_stripe()->connect->is_connected() ) {
7
	$reset_link = add_query_arg(
8
		array(
9
			'_wpnonce'                     => wp_create_nonce( 'reset_stripe_api_credentials' ),
10
			'reset_stripe_api_credentials' => true,
11
		),
12
		admin_url( 'admin.php?page=wc-settings&tab=checkout&section=stripe' )
13
	);
14
15
	$api_credentials_text = sprintf(
16
		__( '%1$sClear all Stripe account keys.%2$s %3$sThis will disable any connection to Stripe.%4$s', 'woocommerce-gateway-stripe' ),
17
		'<a id="wc_stripe_connect_button" href="' . $reset_link . '" class="button button-secondary">',
18
		'</a>',
19
		'<span style="color:red;">',
20
		'</span>'
21
	);
22
} else {
23
	$oauth_url = woocommerce_gateway_stripe()->connect->get_oauth_url();
0 ignored issues
show
The property connect does not seem to exist in Singleton.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
24
25
	if ( ! is_wp_error( $oauth_url ) ) {
26
		$api_credentials_text = sprintf(
27
			__( '%1$sSetup or link an existing Stripe account.%2$s By clicking this button you agree to the %3$sTerms of Service%2$s. Or, manually enter Stripe account keys below.', 'woocommerce-gateway-stripe' ),
28
			'<a id="wc_stripe_connect_button" href="' . $oauth_url . '" class="button button-primary">',
29
			'</a>',
30
			'<a href="https://wordpress.com/tos">'
31
32
		);
33
	} else {
34
		$api_credentials_text = __( 'Manually enter Stripe keys below.', 'woocommerce-gateway-stripe' );
35
	}
36
}
37
38
return apply_filters(
39
	'wc_stripe_settings',
40
	array(
41
		'enabled'                       => array(
42
			'title'       => __( 'Enable/Disable', 'woocommerce-gateway-stripe' ),
43
			'label'       => __( 'Enable Stripe', 'woocommerce-gateway-stripe' ),
44
			'type'        => 'checkbox',
45
			'description' => '',
46
			'default'     => 'no',
47
		),
48
		'title'                         => array(
49
			'title'       => __( 'Title', 'woocommerce-gateway-stripe' ),
50
			'type'        => 'text',
51
			'description' => __( 'This controls the title which the user sees during checkout.', 'woocommerce-gateway-stripe' ),
52
			'default'     => __( 'Credit Card (Stripe)', 'woocommerce-gateway-stripe' ),
53
			'desc_tip'    => true,
54
		),
55
		'description'                   => array(
56
			'title'       => __( 'Description', 'woocommerce-gateway-stripe' ),
57
			'type'        => 'text',
58
			'description' => __( 'This controls the description which the user sees during checkout.', 'woocommerce-gateway-stripe' ),
59
			'default'     => __( 'Pay with your credit card via Stripe.', 'woocommerce-gateway-stripe' ),
60
			'desc_tip'    => true,
61
		),
62
		'webhook'                       => array(
63
			'title'       => __( 'Webhook Endpoints', 'woocommerce-gateway-stripe' ),
64
			'type'        => 'title',
65
			/* translators: webhook URL */
66
			'description' => $this->display_admin_settings_webhook_description(),
67
		),
68
		'api_credentials'               => array(
69
			'title'       => __( 'Stripe Account Keys', 'woocommerce-gateway-stripe' ),
70
			'type'        => 'title',
71
			'description' => $api_credentials_text
72
		),
73
		'testmode'                      => array(
74
			'title'       => __( 'Test mode', 'woocommerce-gateway-stripe' ),
75
			'label'       => __( 'Enable Test Mode', 'woocommerce-gateway-stripe' ),
76
			'type'        => 'checkbox',
77
			'description' => __( 'Place the payment gateway in test mode using test API keys.', 'woocommerce-gateway-stripe' ),
78
			'default'     => 'yes',
79
			'desc_tip'    => true,
80
		),
81
		'test_publishable_key'          => array(
82
			'title'       => __( 'Test Publishable Key', 'woocommerce-gateway-stripe' ),
83
			'type'        => 'text',
84
			'description' => __( 'Get your API keys from your stripe account. Invalid values will be rejected. Only values starting with "pk_test_" will be saved.', 'woocommerce-gateway-stripe' ),
85
			'default'     => '',
86
			'desc_tip'    => true,
87
		),
88
		'test_secret_key'               => array(
89
			'title'       => __( 'Test Secret Key', 'woocommerce-gateway-stripe' ),
90
			'type'        => 'password',
91
			'description' => __( 'Get your API keys from your stripe account. Invalid values will be rejected. Only values starting with "sk_test_" or "rk_test_" will be saved.', 'woocommerce-gateway-stripe' ),
92
			'default'     => '',
93
			'desc_tip'    => true,
94
		),
95
		'test_webhook_secret'           => array(
96
			'title'       => __( 'Test Webhook Secret', 'woocommerce-gateway-stripe' ),
97
			'type'        => 'password',
98
			'description' => __( 'Get your webhook signing secret from the webhooks section in your stripe account.', 'woocommerce-gateway-stripe' ),
99
			'default'     => '',
100
			'desc_tip'    => true,
101
		),
102
		'publishable_key'               => array(
103
			'title'       => __( 'Live Publishable Key', 'woocommerce-gateway-stripe' ),
104
			'type'        => 'text',
105
			'description' => __( 'Get your API keys from your stripe account. Invalid values will be rejected. Only values starting with "pk_live_" will be saved.', 'woocommerce-gateway-stripe' ),
106
			'default'     => '',
107
			'desc_tip'    => true,
108
		),
109
		'secret_key'                    => array(
110
			'title'       => __( 'Live Secret Key', 'woocommerce-gateway-stripe' ),
111
			'type'        => 'password',
112
			'description' => __( 'Get your API keys from your stripe account. Invalid values will be rejected. Only values starting with "sk_live_" or "rk_live_" will be saved.', 'woocommerce-gateway-stripe' ),
113
			'default'     => '',
114
			'desc_tip'    => true,
115
		),
116
		'webhook_secret'               => array(
117
			'title'       => __( 'Webhook Secret', 'woocommerce-gateway-stripe' ),
118
			'type'        => 'password',
119
			'description' => __( 'Get your webhook signing secret from the webhooks section in your stripe account.', 'woocommerce-gateway-stripe' ),
120
			'default'     => '',
121
			'desc_tip'    => true,
122
		),
123
		'inline_cc_form'                => array(
124
			'title'       => __( 'Inline Credit Card Form', 'woocommerce-gateway-stripe' ),
125
			'type'        => 'checkbox',
126
			'description' => __( 'Choose the style you want to show for your credit card form. When unchecked, the credit card form will display separate credit card number field, expiry date field and cvc field.', 'woocommerce-gateway-stripe' ),
127
			'default'     => 'no',
128
			'desc_tip'    => true,
129
		),
130
		'statement_descriptor'          => array(
131
			'title'       => __( 'Statement Descriptor', 'woocommerce-gateway-stripe' ),
132
			'type'        => 'text',
133
			'description' => __( 'Statement descriptors are limited to 22 characters, cannot use the special characters >, <, ", \, \', *, and must not consist solely of numbers. This will appear on your customer\'s statement in capital letters.', 'woocommerce-gateway-stripe' ),
134
			'default'     => '',
135
			'desc_tip'    => true,
136
		),
137
		'capture'                       => array(
138
			'title'       => __( 'Capture', 'woocommerce-gateway-stripe' ),
139
			'label'       => __( 'Capture charge immediately', 'woocommerce-gateway-stripe' ),
140
			'type'        => 'checkbox',
141
			'description' => __( 'Whether or not to immediately capture the charge. When unchecked, the charge issues an authorization and will need to be captured later. Uncaptured charges expire in 7 days.', 'woocommerce-gateway-stripe' ),
142
			'default'     => 'yes',
143
			'desc_tip'    => true,
144
		),
145
		'payment_request'               => array(
146
			'title'       => __( 'Payment Request Buttons', 'woocommerce-gateway-stripe' ),
147
			'label'       => sprintf(
148
				/* translators: 1) br tag 2) Stripe anchor tag 3) Apple anchor tag 4) Stripe dashboard opening anchor tag 5) Stripe dashboard closing anchor tag */
149
				__( 'Enable Payment Request Buttons. (Apple Pay/Google Pay) %1$sBy using Apple Pay, you agree to %2$s and %3$s\'s terms of service. (Apple Pay domain verification is performed automatically; configuration can be found on the %4$sStripe dashboard%5$s.)', 'woocommerce-gateway-stripe' ),
150
				'<br />',
151
				'<a href="https://stripe.com/apple-pay/legal" target="_blank">Stripe</a>',
152
				'<a href="https://developer.apple.com/apple-pay/acceptable-use-guidelines-for-websites/" target="_blank">Apple</a>',
153
				'<a href="https://dashboard.stripe.com/settings/payments/apple_pay" target="_blank">',
154
				'</a>'
155
			),
156
			'type'        => 'checkbox',
157
			'description' => __( 'If enabled, users will be able to pay using Apple Pay or Chrome Payment Request if supported by the browser.', 'woocommerce-gateway-stripe' ),
158
			'default'     => 'yes',
159
			'desc_tip'    => true,
160
		),
161
		'payment_request_button_type'   => array(
162
			'title'       => __( 'Payment Request Button Type', 'woocommerce-gateway-stripe' ),
163
			'label'       => __( 'Button Type', 'woocommerce-gateway-stripe' ),
164
			'type'        => 'select',
165
			'description' => __( 'Select the button type you would like to show.', 'woocommerce-gateway-stripe' ),
166
			'default'     => 'buy',
167
			'desc_tip'    => true,
168
			'options'     => array(
169
				'default' => __( 'Default', 'woocommerce-gateway-stripe' ),
170
				'buy'     => __( 'Buy', 'woocommerce-gateway-stripe' ),
171
				'donate'  => __( 'Donate', 'woocommerce-gateway-stripe' ),
172
				'branded' => __( 'Branded', 'woocommerce-gateway-stripe' ),
173
				'custom'  => __( 'Custom', 'woocommerce-gateway-stripe' ),
174
			),
175
		),
176
		'payment_request_button_theme'  => array(
177
			'title'       => __( 'Payment Request Button Theme', 'woocommerce-gateway-stripe' ),
178
			'label'       => __( 'Button Theme', 'woocommerce-gateway-stripe' ),
179
			'type'        => 'select',
180
			'description' => __( 'Select the button theme you would like to show.', 'woocommerce-gateway-stripe' ),
181
			'default'     => 'dark',
182
			'desc_tip'    => true,
183
			'options'     => array(
184
				'dark'          => __( 'Dark', 'woocommerce-gateway-stripe' ),
185
				'light'         => __( 'Light', 'woocommerce-gateway-stripe' ),
186
				'light-outline' => __( 'Light-Outline', 'woocommerce-gateway-stripe' ),
187
			),
188
		),
189
		'payment_request_button_height' => array(
190
			'title'       => __( 'Payment Request Button Height', 'woocommerce-gateway-stripe' ),
191
			'label'       => __( 'Button Height', 'woocommerce-gateway-stripe' ),
192
			'type'        => 'text',
193
			'description' => __( 'Enter the height you would like the button to be in pixels. Width will always be 100%.', 'woocommerce-gateway-stripe' ),
194
			'default'     => '44',
195
			'desc_tip'    => true,
196
		),
197
		'payment_request_button_label' => array(
198
			'title'       => __( 'Payment Request Button Label', 'woocommerce-gateway-stripe' ),
199
			'label'       => __( 'Button Label', 'woocommerce-gateway-stripe' ),
200
			'type'        => 'text',
201
			'description' => __( 'Enter the custom text you would like the button to have.', 'woocommerce-gateway-stripe' ),
202
			'default'     => __( 'Buy now', 'woocommerce-gateway-stripe' ),
203
			'desc_tip'    => true,
204
		),
205
		'payment_request_button_branded_type' => array(
206
			'title'       => __( 'Payment Request Branded Button Label Format', 'woocommerce-gateway-stripe' ),
207
			'label'       => __( 'Branded Button Label Format', 'woocommerce-gateway-stripe' ),
208
			'type'        => 'select',
209
			'description' => __( 'Select the branded button label format.', 'woocommerce-gateway-stripe' ),
210
			'default'     => 'long',
211
			'desc_tip'    => true,
212
			'options'     => array(
213
				'short' => __( 'Logo only', 'woocommerce-gateway-stripe' ),
214
				'long'  => __( 'Text and logo', 'woocommerce-gateway-stripe' ),
215
			),
216
		),
217
		'saved_cards'                   => array(
218
			'title'       => __( 'Saved Cards', 'woocommerce-gateway-stripe' ),
219
			'label'       => __( 'Enable Payment via Saved Cards', 'woocommerce-gateway-stripe' ),
220
			'type'        => 'checkbox',
221
			'description' => __( 'If enabled, users will be able to pay with a saved card during checkout. Card details are saved on Stripe servers, not on your store.', 'woocommerce-gateway-stripe' ),
222
			'default'     => 'yes',
223
			'desc_tip'    => true,
224
		),
225
		'logging'                       => array(
226
			'title'       => __( 'Logging', 'woocommerce-gateway-stripe' ),
227
			'label'       => __( 'Log debug messages', 'woocommerce-gateway-stripe' ),
228
			'type'        => 'checkbox',
229
			'description' => __( 'Save debug messages to the WooCommerce System Status log.', 'woocommerce-gateway-stripe' ),
230
			'default'     => 'no',
231
			'desc_tip'    => true,
232
		),
233
	)
234
);
235