Issues (197)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

woocommerce-gateway-stripe.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Plugin Name: WooCommerce Stripe Gateway
4
 * Plugin URI: https://wordpress.org/plugins/woocommerce-gateway-stripe/
5
 * Description: Take credit card payments on your store using Stripe.
6
 * Author: WooCommerce
7
 * Author URI: https://woocommerce.com/
8
 * Version: 4.7.0
9
 * Requires at least: 4.4
10
 * Tested up to: 5.5
11
 * WC requires at least: 3.0
12
 * WC tested up to: 4.3
13
 * Text Domain: woocommerce-gateway-stripe
14
 * Domain Path: /languages
15
 *
16
 */
17
18
if ( ! defined( 'ABSPATH' ) ) {
19
	exit;
20
}
21
22
/**
23
 * Required minimums and constants
24
 */
25
define( 'WC_STRIPE_VERSION', '4.7.0' ); // WRCS: DEFINED_VERSION.
26
define( 'WC_STRIPE_MIN_PHP_VER', '5.6.0' );
27
define( 'WC_STRIPE_MIN_WC_VER', '3.0' );
28
define( 'WC_STRIPE_FUTURE_MIN_WC_VER', '3.0' );
29
define( 'WC_STRIPE_MAIN_FILE', __FILE__ );
30
define( 'WC_STRIPE_PLUGIN_URL', untrailingslashit( plugins_url( basename( plugin_dir_path( __FILE__ ) ), basename( __FILE__ ) ) ) );
31
define( 'WC_STRIPE_PLUGIN_PATH', untrailingslashit( plugin_dir_path( __FILE__ ) ) );
32
33
// phpcs:disable WordPress.Files.FileName
34
35
/**
36
 * WooCommerce fallback notice.
37
 *
38
 * @since 4.1.2
39
 * @return string
40
 */
41
function woocommerce_stripe_missing_wc_notice() {
42
	/* translators: 1. URL link. */
43
	echo '<div class="error"><p><strong>' . sprintf( esc_html__( 'Stripe requires WooCommerce to be installed and active. You can download %s here.', 'woocommerce-gateway-stripe' ), '<a href="https://woocommerce.com/" target="_blank">WooCommerce</a>' ) . '</strong></p></div>';
44
}
45
46
/**
47
 * WooCommerce not supported fallback notice.
48
 *
49
 * @since 4.4.0
50
 * @return string
51
 */
52
function woocommerce_stripe_wc_not_supported() {
53
	/* translators: $1. Minimum WooCommerce version. $2. Current WooCommerce version. */
54
	echo '<div class="error"><p><strong>' . sprintf( esc_html__( 'Stripe requires WooCommerce %1$s or greater to be installed and active. WooCommerce %2$s is no longer supported.', 'woocommerce-gateway-stripe' ), WC_STRIPE_MIN_WC_VER, WC_VERSION ) . '</strong></p></div>';
55
}
56
57
function woocommerce_gateway_stripe() {
58
59
	static $plugin;
60
61
	if ( ! isset( $plugin ) ) {
62
63
		class WC_Stripe {
64
65
			/**
66
			 * @var Singleton The reference the *Singleton* instance of this class
67
			 */
68
			private static $instance;
69
70
			/**
71
			 * Returns the *Singleton* instance of this class.
72
			 *
73
			 * @return Singleton The *Singleton* instance.
74
			 */
75
			public static function get_instance() {
76
				if ( null === self::$instance ) {
77
					self::$instance = new self();
0 ignored issues
show
Documentation Bug introduced by
It seems like new self() of type object<WC_Stripe> is incompatible with the declared type object<Singleton> of property $instance.

Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.

Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..

Loading history...
78
				}
79
				return self::$instance;
0 ignored issues
show
Bug Compatibility introduced by
The expression self::$instance; of type WC_Stripe|Singleton adds the type WC_Stripe to the return on line 79 which is incompatible with the return type documented by WC_Stripe::get_instance of type Singleton.
Loading history...
80
			}
81
82
			/**
83
			 * Stripe Connect API
84
			 *
85
			 * @var WC_Stripe_Connect_API
86
			 */
87
			private $api;
88
89
			/**
90
			 * Stripe Connect
91
			 *
92
			 * @var WC_Stripe_Connect
93
			 */
94
			public $connect;
95
96
			/**
97
			 * Private clone method to prevent cloning of the instance of the
98
			 * *Singleton* instance.
99
			 *
100
			 * @return void
101
			 */
102
			public function __clone() {}
103
104
			/**
105
			 * Private unserialize method to prevent unserializing of the *Singleton*
106
			 * instance.
107
			 *
108
			 * @return void
109
			 */
110
			public function __wakeup() {}
111
112
			/**
113
			 * Protected constructor to prevent creating a new instance of the
114
			 * *Singleton* via the `new` operator from outside of this class.
115
			 */
116
			public function __construct() {
117
				add_action( 'admin_init', array( $this, 'install' ) );
118
119
				$this->init();
120
121
				$this->api     = new WC_Stripe_Connect_API();
122
				$this->connect = new WC_Stripe_Connect( $this->api );
123
124
				add_action( 'rest_api_init', array( $this, 'register_connect_routes' ) );
125
			}
126
127
			/**
128
			 * Init the plugin after plugins_loaded so environment variables are set.
129
			 *
130
			 * @since 1.0.0
131
			 * @version 4.0.0
132
			 */
133
			public function init() {
134
				if ( is_admin() ) {
135
					require_once dirname( __FILE__ ) . '/includes/admin/class-wc-stripe-privacy.php';
136
				}
137
138
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-exception.php';
139
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-logger.php';
140
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-helper.php';
141
				include_once dirname( __FILE__ ) . '/includes/class-wc-stripe-api.php';
142
				require_once dirname( __FILE__ ) . '/includes/abstracts/abstract-wc-stripe-payment-gateway.php';
143
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-webhook-handler.php';
144
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-sepa-payment-token.php';
145
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-apple-pay-registration.php';
146
				require_once dirname( __FILE__ ) . '/includes/compat/class-wc-stripe-pre-orders-compat.php';
147
				require_once dirname( __FILE__ ) . '/includes/class-wc-gateway-stripe.php';
148
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-bancontact.php';
149
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-sofort.php';
150
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-giropay.php';
151
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-eps.php';
152
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-ideal.php';
153
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-p24.php';
154
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-alipay.php';
155
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-sepa.php';
156
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-gateway-stripe-multibanco.php';
157
				require_once dirname( __FILE__ ) . '/includes/payment-methods/class-wc-stripe-payment-request.php';
158
				require_once dirname( __FILE__ ) . '/includes/compat/class-wc-stripe-subs-compat.php';
159
				require_once dirname( __FILE__ ) . '/includes/compat/class-wc-stripe-sepa-subs-compat.php';
160
				require_once dirname( __FILE__ ) . '/includes/connect/class-wc-stripe-connect.php';
161
				require_once dirname( __FILE__ ) . '/includes/connect/class-wc-stripe-connect-api.php';
162
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-order-handler.php';
163
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-payment-tokens.php';
164
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-customer.php';
165
				require_once dirname( __FILE__ ) . '/includes/class-wc-stripe-intent-controller.php';
166
				require_once dirname( __FILE__ ) . '/includes/admin/class-wc-stripe-inbox-notes.php';
167
168
				if ( is_admin() ) {
169
					require_once dirname( __FILE__ ) . '/includes/admin/class-wc-stripe-admin-notices.php';
170
				}
171
172
				// REMOVE IN THE FUTURE.
173
				require_once dirname( __FILE__ ) . '/includes/deprecated/class-wc-stripe-apple-pay.php';
174
175
				add_filter( 'woocommerce_payment_gateways', array( $this, 'add_gateways' ) );
176
				add_filter( 'pre_update_option_woocommerce_stripe_settings', array( $this, 'gateway_settings_update' ), 10, 2 );
177
				add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_action_links' ) );
178
				add_filter( 'plugin_row_meta', array( $this, 'plugin_row_meta' ), 10, 2 );
179
180
				// Modify emails emails.
181
				add_filter( 'woocommerce_email_classes', array( $this, 'add_emails' ), 20 );
182
183
				if ( version_compare( WC_VERSION, '3.4', '<' ) ) {
184
					add_filter( 'woocommerce_get_sections_checkout', array( $this, 'filter_gateway_order_admin' ) );
185
				}
186
			}
187
188
			/**
189
			 * Updates the plugin version in db
190
			 *
191
			 * @since 3.1.0
192
			 * @version 4.0.0
193
			 */
194
			public function update_plugin_version() {
195
				delete_option( 'wc_stripe_version' );
196
				update_option( 'wc_stripe_version', WC_STRIPE_VERSION );
197
			}
198
199
			/**
200
			 * Handles upgrade routines.
201
			 *
202
			 * @since 3.1.0
203
			 * @version 3.1.0
204
			 */
205
			public function install() {
206
				if ( ! is_plugin_active( plugin_basename( __FILE__ ) ) ) {
207
					return;
208
				}
209
210
				if ( ! defined( 'IFRAME_REQUEST' ) && ( WC_STRIPE_VERSION !== get_option( 'wc_stripe_version' ) ) ) {
211
					do_action( 'woocommerce_stripe_updated' );
212
213
					if ( ! defined( 'WC_STRIPE_INSTALLING' ) ) {
214
						define( 'WC_STRIPE_INSTALLING', true );
215
					}
216
217
					$this->update_plugin_version();
218
				}
219
			}
220
221
			/**
222
			 * Add plugin action links.
223
			 *
224
			 * @since 1.0.0
225
			 * @version 4.0.0
226
			 */
227
			public function plugin_action_links( $links ) {
228
				$plugin_links = array(
229
					'<a href="admin.php?page=wc-settings&tab=checkout&section=stripe">' . esc_html__( 'Settings', 'woocommerce-gateway-stripe' ) . '</a>',
230
				);
231
				return array_merge( $plugin_links, $links );
232
			}
233
234
			/**
235
			 * Add plugin action links.
236
			 *
237
			 * @since 4.3.4
238
			 * @param  array  $links Original list of plugin links.
239
			 * @param  string $file  Name of current file.
240
			 * @return array  $links Update list of plugin links.
241
			 */
242
			public function plugin_row_meta( $links, $file ) {
243
				if ( plugin_basename( __FILE__ ) === $file ) {
244
					$row_meta = array(
245
						'docs'    => '<a href="' . esc_url( apply_filters( 'woocommerce_gateway_stripe_docs_url', 'https://docs.woocommerce.com/document/stripe/' ) ) . '" title="' . esc_attr( __( 'View Documentation', 'woocommerce-gateway-stripe' ) ) . '">' . __( 'Docs', 'woocommerce-gateway-stripe' ) . '</a>',
246
						'support' => '<a href="' . esc_url( apply_filters( 'woocommerce_gateway_stripe_support_url', 'https://woocommerce.com/my-account/create-a-ticket?select=18627' ) ) . '" title="' . esc_attr( __( 'Open a support request at WooCommerce.com', 'woocommerce-gateway-stripe' ) ) . '">' . __( 'Support', 'woocommerce-gateway-stripe' ) . '</a>',
247
					);
248
					return array_merge( $links, $row_meta );
249
				}
250
				return (array) $links;
251
			}
252
253
			/**
254
			 * Add the gateways to WooCommerce.
255
			 *
256
			 * @since 1.0.0
257
			 * @version 4.0.0
258
			 */
259
			public function add_gateways( $methods ) {
260
				if ( class_exists( 'WC_Subscriptions_Order' ) && function_exists( 'wcs_create_renewal_order' ) ) {
261
					$methods[] = 'WC_Stripe_Subs_Compat';
262
					$methods[] = 'WC_Stripe_Sepa_Subs_Compat';
263
				} else {
264
					$methods[] = 'WC_Gateway_Stripe';
265
					$methods[] = 'WC_Gateway_Stripe_Sepa';
266
				}
267
268
				$methods[] = 'WC_Gateway_Stripe_Bancontact';
269
				$methods[] = 'WC_Gateway_Stripe_Sofort';
270
				$methods[] = 'WC_Gateway_Stripe_Giropay';
271
				$methods[] = 'WC_Gateway_Stripe_Eps';
272
				$methods[] = 'WC_Gateway_Stripe_Ideal';
273
				$methods[] = 'WC_Gateway_Stripe_P24';
274
				$methods[] = 'WC_Gateway_Stripe_Alipay';
275
				$methods[] = 'WC_Gateway_Stripe_Multibanco';
276
277
				return $methods;
278
			}
279
280
			/**
281
			 * Modifies the order of the gateways displayed in admin.
282
			 *
283
			 * @since 4.0.0
284
			 * @version 4.0.0
285
			 */
286
			public function filter_gateway_order_admin( $sections ) {
287
				unset( $sections['stripe'] );
288
				unset( $sections['stripe_bancontact'] );
289
				unset( $sections['stripe_sofort'] );
290
				unset( $sections['stripe_giropay'] );
291
				unset( $sections['stripe_eps'] );
292
				unset( $sections['stripe_ideal'] );
293
				unset( $sections['stripe_p24'] );
294
				unset( $sections['stripe_alipay'] );
295
				unset( $sections['stripe_sepa'] );
296
				unset( $sections['stripe_multibanco'] );
297
298
				$sections['stripe']            = 'Stripe';
299
				$sections['stripe_bancontact'] = __( 'Stripe Bancontact', 'woocommerce-gateway-stripe' );
300
				$sections['stripe_sofort']     = __( 'Stripe SOFORT', 'woocommerce-gateway-stripe' );
301
				$sections['stripe_giropay']    = __( 'Stripe Giropay', 'woocommerce-gateway-stripe' );
302
				$sections['stripe_eps']        = __( 'Stripe EPS', 'woocommerce-gateway-stripe' );
303
				$sections['stripe_ideal']      = __( 'Stripe iDeal', 'woocommerce-gateway-stripe' );
304
				$sections['stripe_p24']        = __( 'Stripe P24', 'woocommerce-gateway-stripe' );
305
				$sections['stripe_alipay']     = __( 'Stripe Alipay', 'woocommerce-gateway-stripe' );
306
				$sections['stripe_sepa']       = __( 'Stripe SEPA Direct Debit', 'woocommerce-gateway-stripe' );
307
				$sections['stripe_multibanco'] = __( 'Stripe Multibanco', 'woocommerce-gateway-stripe' );
308
309
				return $sections;
310
			}
311
312
			/**
313
			 * Provide default values for missing settings on initial gateway settings save.
314
			 *
315
			 * @since 4.5.4
316
			 * @version 4.5.4
317
			 *
318
			 * @param array $settings New settings to save
319
			 * @param array|bool $old_settings Existing settings, if any.
320
			 * @return array New value but with defaults initially filled in for missing settings.
321
			 */
322
			public function gateway_settings_update( $settings, $old_settings ) {
323
				if ( false === $old_settings ) {
324
					$gateway  = new WC_Gateway_Stripe();
325
					$fields   = $gateway->get_form_fields();
326
					$defaults = array_merge( array_fill_keys( array_keys( $fields ), '' ), wp_list_pluck( $fields, 'default' ) );
327
					return array_merge( $defaults, $settings );
328
				}
329
				return $settings;
330
			}
331
332
			/**
333
			 * Adds the failed SCA auth email to WooCommerce.
334
			 *
335
			 * @param WC_Email[] $email_classes All existing emails.
336
			 * @return WC_Email[]
337
			 */
338
			public function add_emails( $email_classes ) {
339
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/compat/class-wc-stripe-email-failed-authentication.php';
340
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/compat/class-wc-stripe-email-failed-renewal-authentication.php';
341
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/compat/class-wc-stripe-email-failed-preorder-authentication.php';
342
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/compat/class-wc-stripe-email-failed-authentication-retry.php';
343
344
				// Add all emails, generated by the gateway.
345
				$email_classes['WC_Stripe_Email_Failed_Renewal_Authentication']  = new WC_Stripe_Email_Failed_Renewal_Authentication( $email_classes );
346
				$email_classes['WC_Stripe_Email_Failed_Preorder_Authentication'] = new WC_Stripe_Email_Failed_Preorder_Authentication( $email_classes );
347
				$email_classes['WC_Stripe_Email_Failed_Authentication_Retry'] = new WC_Stripe_Email_Failed_Authentication_Retry( $email_classes );
348
349
				return $email_classes;
350
			}
351
352
			/**
353
			 * Register Stripe connect rest routes.
354
			 */
355
			public function register_connect_routes() {
356
357
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/abstracts/abstract-wc-stripe-connect-rest-controller.php';
358
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/connect/class-wc-stripe-connect-rest-oauth-init-controller.php';
359
				require_once WC_STRIPE_PLUGIN_PATH . '/includes/connect/class-wc-stripe-connect-rest-oauth-connect-controller.php';
360
361
				$oauth_init    = new WC_Stripe_Connect_REST_Oauth_Init_Controller( $this->connect, $this->api );
362
				$oauth_connect = new WC_Stripe_Connect_REST_Oauth_Connect_Controller( $this->connect, $this->api );
363
364
				$oauth_init->register_routes();
365
				$oauth_connect->register_routes();
366
			}
367
		}
368
369
		$plugin = WC_Stripe::get_instance();
370
371
	}
372
373
	return $plugin;
374
}
375
376
add_action( 'plugins_loaded', 'woocommerce_gateway_stripe_init' );
377
378
function woocommerce_gateway_stripe_init() {
379
	load_plugin_textdomain( 'woocommerce-gateway-stripe', false, plugin_basename( dirname( __FILE__ ) ) . '/languages' );
380
381
	if ( ! class_exists( 'WooCommerce' ) ) {
382
		add_action( 'admin_notices', 'woocommerce_stripe_missing_wc_notice' );
383
		return;
384
	}
385
386
	if ( version_compare( WC_VERSION, WC_STRIPE_MIN_WC_VER, '<' ) ) {
387
		add_action( 'admin_notices', 'woocommerce_stripe_wc_not_supported' );
388
		return;
389
	}
390
391
	woocommerce_gateway_stripe();
392
}
393