Issues in class-sensei-learner-profiles.php (master) - Issues in master - woothemes/sensei - Measure and Improve Code Quality continuously with Scrutinizer

Issues (896)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/class-sensei-learner-profiles.php (1 issue)

Labels

Severity

Major 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly

/**
 * All functionality pertaining to the learner profiles in Sensei.
 *
 * @package Views
 * @author Automattic
 *
 * @since 1.4.0
 */
class Sensei_Learner_Profiles {
    /**
     * @var string
     */
    private $profile_url_base;

	/**
	 * Constructor.
	 * @since  1.4.0
	 */
	public function __construct () {

		// Setup learner profile URL base
		$this->profile_url_base = apply_filters( 'sensei_learner_profiles_url_base', __( 'learner', 'woothemes-sensei') );

		// Setup permalink structure for learner profiles
		add_action( 'init', array( $this, 'setup_permastruct' ) );
		add_filter( 'wp_title', array( $this, 'page_title' ), 10, 2 );

		// Set heading for courses section of learner profiles
		add_action( 'sensei_learner_profile_info', array( $this, 'learner_profile_courses_heading' ), 30, 1 );

		// Add class to body tag
		add_filter( 'body_class', array( $this, 'learner_profile_body_class' ), 10, 1 );
	} // End __construct()

	/**
	 * Setup permalink structure for learner profiles
	 * @since  1.4.0
	 * @return void
	 */
	public function setup_permastruct() {

        if( isset( Sensei()->settings->settings[ 'learner_profile_enable' ] )
            && Sensei()->settings->settings[ 'learner_profile_enable' ] ) {

			add_rewrite_rule( '^' . $this->profile_url_base . '/([^/]*)/?', 'index.php?learner_profile=$matches[1]', 'top' );
			add_rewrite_tag( '%learner_profile%', '([^&]+)' );

		}
	}

	/**
	 * Adding page title for course results page
	 * @param  string $title Original title
	 * @param  string $sep   Seeparator string
	 * @return string        Modified title
	 */
	public function page_title( $title, $sep = null ) {
		global $wp_query;
		if( isset( $wp_query->query_vars['learner_profile'] ) ) {
			$learner_user = get_user_by( 'login', $wp_query->query_vars['learner_profile'] );

            $name = Sensei_Learner::get_full_name( $learner_user->ID );

			$title = apply_filters( 'sensei_learner_profile_courses_heading', sprintf( __( 'Courses %s is taking', 'woothemes-sensei' ), $name ) ) . ' ' . $sep . ' ';
		}
		return $title;
	}

	/**
	 * Get permalink for learner profile
	 * @since  1.4.0
	 * @param  integer $user_id ID of user
	 * @return string           The learner profile permalink
	 */
	public function get_permalink( $user_id = 0 ) {
		$user = false;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
		if( $user_id == 0 ) {
			global $current_user;
			wp_get_current_user();
			$user = $current_user;
		} else {
			$user = get_userdata( $user_id );
		}

		$permalink = '';

		if( $user ) {
			if ( get_option('permalink_structure') ) {
				$permalink = trailingslashit( get_site_url() ) . $this->profile_url_base . '/' . $user->user_nicename;
			} else {
				$permalink = trailingslashit( get_site_url() ) . '?learner_profile=' . $user->user_nicename;
			}
		}

		return $permalink;
	}

	/**
	 * Load content for learner profiles
	 * @since  1.4.0
	 * @return void
	 */
	public function content() {
		global $wp_query,  $learner_user, $current_user;

		if( isset( Sensei()->settings->settings[ 'learner_profile_enable' ] ) && Sensei()->settings->settings[ 'learner_profile_enable' ] ) {

			if( isset( $wp_query->query_vars['learner_profile'] ) ) {

                Sensei_Templates::get_template( 'learner-profile/learner-info.php' );

			}
		}
	}

	/**
	 * Set heading for courses section of learner profiles
	 * @since  1.4.0
	 * @param  object $user Queried user object
	 * @return void
	 */
	public function learner_profile_courses_heading( $user ) {
		if( strlen( $user->first_name ) > 0 ) {
			$name = $user->first_name;
		} else {
			$name = $user->display_name;
		}
		$name = apply_filters( 'sensei_learner_profile_courses_heading_name', $name );
		echo '<h2>' . apply_filters( 'sensei_learner_profile_courses_heading', sprintf( __( 'Courses %s is taking', 'woothemes-sensei' ), $name ) ) . '</h2>';
	}

	/**
	 * Load user info for learner profiles
	 * @since  1.4.0
	 * @param  object $user Queried user object
	 * @return void
	 */
	public static function user_info( $user ) {

        /**
         * This hooke fires inside the Sensei_Learner_Profiles::user_info function.
         * just before the htmls is generated.
         * @since 1.0.0
         */
        do_action( 'sensei_learner_profile_info', $user );

        /**
         * This filter runs inside the Sensei_Learner_Profiles::user_info function.
         * Here you can change the user avatar.
         *
         * @since 1.0.0
         *
         * @param false|string `<img>` $user_avatar
         */
		$learner_avatar = apply_filters( 'sensei_learner_profile_info_avatar', get_avatar( $user->ID, 120 ), $user->ID );

        /**
         * This filter runs inside the Sensei_Learner_Profiles::user_info function.
         * Here you can change the learner profile user display name.
         * @since 1.0.0
         *
         * @param string $user_display_name
         * @param string $user_id
         */
		$learner_name = apply_filters( 'sensei_learner_profile_info_name', $user->display_name, $user->ID );

        /**
         * This filter runs inside the Sensei_Learner_Profiles::user_info function.
         * With this filter can change the users description on the learner user info
         * output.
         *
         * @since 1.0.0
         *
         * @param string $user_description
         * @param string $user_id
         */
		$learner_bio = apply_filters( 'sensei_learner_profile_info_bio', $user->description, $user->ID );
		?>

		<div id="learner-info">

			<div class="learner-avatar"><?php echo $learner_avatar; ?></div>

			<div class="learner-content">

				<h2><?php echo $learner_name; ?></h2>

				<div class="description"><?php echo wpautop( $learner_bio ); ?></div>

			</div>

		</div>

        <?php
	}

	/**
	 * Adding class to body tag
	 * @param  array $classes Existing classes
	 * @return array          Modified classes
	 */
	public function learner_profile_body_class( $classes ) {
		global $wp_query;
		if( isset( $wp_query->query_vars['learner_profile'] ) ) {
			$classes[] = 'learner-profile';
		}
		return $classes;
	}

    /**
     * Deprecate the deprecate_sensei_learner_profile_content hook
     *
     * @since 1.9.0
     */
    public static function deprecate_sensei_learner_profile_content_hook(){

        sensei_do_deprecated_action( 'sensei_learner_profile_content', '1.9.0', 'sensei_learner_profile_content_before' );

    }


} // End Class

/**
 * Class WooThemes_Sensei_Learner_Profiles
 * @ignore only for backward compatibility
 * @since 1.9.0
 */
class WooThemes_Sensei_Learner_Profiles extends Sensei_Learner_Profiles {}


1		<?php
2		if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
3
4		/**
5		* All functionality pertaining to the learner profiles in Sensei.
6		*
7		* @package Views
8		* @author Automattic
9		*
10		* @since 1.4.0
11		*/
12		class Sensei_Learner_Profiles {
13		/**
14		* @var string
15		*/
16		private $profile_url_base;
17
18		/**
19		* Constructor.
20		* @since 1.4.0
21		*/
22		public function __construct () {
23
24		// Setup learner profile URL base
25		$this->profile_url_base = apply_filters( 'sensei_learner_profiles_url_base', __( 'learner', 'woothemes-sensei') );
26
27		// Setup permalink structure for learner profiles
28		add_action( 'init', array( $this, 'setup_permastruct' ) );
29		add_filter( 'wp_title', array( $this, 'page_title' ), 10, 2 );
30
31		// Set heading for courses section of learner profiles
32		add_action( 'sensei_learner_profile_info', array( $this, 'learner_profile_courses_heading' ), 30, 1 );
33
34		// Add class to body tag
35		add_filter( 'body_class', array( $this, 'learner_profile_body_class' ), 10, 1 );
36		} // End __construct()
37
38		/**
39		* Setup permalink structure for learner profiles
40		* @since 1.4.0
41		* @return void
42		*/
43		public function setup_permastruct() {
44
45		if( isset( Sensei()->settings->settings[ 'learner_profile_enable' ] )
46		&& Sensei()->settings->settings[ 'learner_profile_enable' ] ) {
47
48		add_rewrite_rule( '^' . $this->profile_url_base . '/([^/]*)/?', 'index.php?learner_profile=$matches[1]', 'top' );
49		add_rewrite_tag( '%learner_profile%', '([^&]+)' );
50
51		}
52		}
53
54		/**
55		* Adding page title for course results page
56		* @param string $title Original title
57		* @param string $sep Seeparator string
58		* @return string Modified title
59		*/
60		public function page_title( $title, $sep = null ) {
61		global $wp_query;
62		if( isset( $wp_query->query_vars['learner_profile'] ) ) {
63		$learner_user = get_user_by( 'login', $wp_query->query_vars['learner_profile'] );
64
65		$name = Sensei_Learner::get_full_name( $learner_user->ID );
66
67		$title = apply_filters( 'sensei_learner_profile_courses_heading', sprintf( __( 'Courses %s is taking', 'woothemes-sensei' ), $name ) ) . ' ' . $sep . ' ';
68		}
69		return $title;
70		}
71
72		/**
73		* Get permalink for learner profile
74		* @since 1.4.0
75		* @param integer $user_id ID of user
76		* @return string The learner profile permalink
77		*/
78		public function get_permalink( $user_id = 0 ) {
79		$user = false;
		0 ignored issues – show Unused Code introduced 2015-12-01 16:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$user` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
80		if( $user_id == 0 ) {
81		global $current_user;
82		wp_get_current_user();
83		$user = $current_user;
84		} else {
85		$user = get_userdata( $user_id );
86		}
87
88		$permalink = '';
89
90	View Code Duplication	if( $user ) {
91		if ( get_option('permalink_structure') ) {
92		$permalink = trailingslashit( get_site_url() ) . $this->profile_url_base . '/' . $user->user_nicename;
93		} else {
94		$permalink = trailingslashit( get_site_url() ) . '?learner_profile=' . $user->user_nicename;
95		}
96		}
97
98		return $permalink;
99		}
100
101		/**
102		* Load content for learner profiles
103		* @since 1.4.0
104		* @return void
105		*/
106		public function content() {
107		global $wp_query, $learner_user, $current_user;
108
109		if( isset( Sensei()->settings->settings[ 'learner_profile_enable' ] ) && Sensei()->settings->settings[ 'learner_profile_enable' ] ) {
110
111		if( isset( $wp_query->query_vars['learner_profile'] ) ) {
112
113		Sensei_Templates::get_template( 'learner-profile/learner-info.php' );
114
115		}
116		}
117		}
118
119		/**
120		* Set heading for courses section of learner profiles
121		* @since 1.4.0
122		* @param object $user Queried user object
123		* @return void
124		*/
125		public function learner_profile_courses_heading( $user ) {
126		if( strlen( $user->first_name ) > 0 ) {
127		$name = $user->first_name;
128		} else {
129		$name = $user->display_name;
130		}
131		$name = apply_filters( 'sensei_learner_profile_courses_heading_name', $name );
132		echo '<h2>' . apply_filters( 'sensei_learner_profile_courses_heading', sprintf( __( 'Courses %s is taking', 'woothemes-sensei' ), $name ) ) . '</h2>';
133		}
134
135		/**
136		* Load user info for learner profiles
137		* @since 1.4.0
138		* @param object $user Queried user object
139		* @return void
140		*/
141		public static function user_info( $user ) {
142
143		/**
144		* This hooke fires inside the Sensei_Learner_Profiles::user_info function.
145		* just before the htmls is generated.
146		* @since 1.0.0
147		*/
148		do_action( 'sensei_learner_profile_info', $user );
149
150		/**
151		* This filter runs inside the Sensei_Learner_Profiles::user_info function.
152		* Here you can change the user avatar.
153		*
154		* @since 1.0.0
155		*
156		* @param false\|string `<img>` $user_avatar
157		*/
158		$learner_avatar = apply_filters( 'sensei_learner_profile_info_avatar', get_avatar( $user->ID, 120 ), $user->ID );
159
160		/**
161		* This filter runs inside the Sensei_Learner_Profiles::user_info function.
162		* Here you can change the learner profile user display name.
163		* @since 1.0.0
164		*
165		* @param string $user_display_name
166		* @param string $user_id
167		*/
168		$learner_name = apply_filters( 'sensei_learner_profile_info_name', $user->display_name, $user->ID );
169
170		/**
171		* This filter runs inside the Sensei_Learner_Profiles::user_info function.
172		* With this filter can change the users description on the learner user info
173		* output.
174		*
175		* @since 1.0.0
176		*
177		* @param string $user_description
178		* @param string $user_id
179		*/
180		$learner_bio = apply_filters( 'sensei_learner_profile_info_bio', $user->description, $user->ID );
181		?>
182
183		<div id="learner-info">
184
185		<div class="learner-avatar"><?php echo $learner_avatar; ?></div>
186
187		<div class="learner-content">
188
189		<h2><?php echo $learner_name; ?></h2>
190
191		<div class="description"><?php echo wpautop( $learner_bio ); ?></div>
192
193		</div>
194
195		</div>
196
197		<?php
198		}
199
200		/**
201		* Adding class to body tag
202		* @param array $classes Existing classes
203		* @return array Modified classes
204		*/
205		public function learner_profile_body_class( $classes ) {
206		global $wp_query;
207		if( isset( $wp_query->query_vars['learner_profile'] ) ) {
208		$classes[] = 'learner-profile';
209		}
210		return $classes;
211		}
212
213		/**
214		* Deprecate the deprecate_sensei_learner_profile_content hook
215		*
216		* @since 1.9.0
217		*/
218		public static function deprecate_sensei_learner_profile_content_hook(){
219
220		sensei_do_deprecated_action( 'sensei_learner_profile_content', '1.9.0', 'sensei_learner_profile_content_before' );
221
222		}
223
224
225		} // End Class
226
227		/**
228		* Class WooThemes_Sensei_Learner_Profiles
229		* @ignore only for backward compatibility
230		* @since 1.9.0
231		*/
232		class WooThemes_Sensei_Learner_Profiles extends Sensei_Learner_Profiles {}
233

woothemes / sensei

Issues (896)

Security Analysis not enabled

includes/class-sensei-learner-profiles.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like