Issues (1182)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/abstracts/abstract-wc-payment-token.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
if ( ! defined( 'ABSPATH' ) ) {
4
	exit; // Exit if accessed directly
5
}
6
7
/**
8
 * WooCommerce Payment Token.
9
 *
10
 * Representation of a general payment token to be extended by individuals types of tokens
11
 * examples: Credit Card, eCheck.
12
 *
13
 * @class 		WC_Payment_Token
14
 * @since		2.6.0
15
 * @package		WooCommerce/Abstracts
16
 * @category	Abstract Class
17
 * @author		WooThemes
18
 */
19
 abstract class WC_Payment_Token extends WC_Data {
20
21
 	/**
0 ignored issues
show
There is some trailing whitespace on this line which should be avoided as per coding-style.
Loading history...
22
 	 * Token Data (stored in the payment_tokens table).
23
 	 * @var array
24
 	 */
25
 	protected $_data = array(
26
 		'id'         => 0,
27
 		'gateway_id' => '',
28
 		'token'      => '',
29
 		'is_default' => 0,
30
 		'user_id'    => 0,
31
 	);
32
33
 	/**
0 ignored issues
show
There is some trailing whitespace on this line which should be avoided as per coding-style.
Loading history...
34
 	 * Meta type. Payment tokens are a new object type.
35
 	 * @var string
36
 	 */
37
 	protected $_meta_type = 'payment_token';
38
39
 	/**
0 ignored issues
show
There is some trailing whitespace on this line which should be avoided as per coding-style.
Loading history...
40
	 * Initialize a payment token.
41
	 *
42
	 * These fields are accepted by all payment tokens:
43
	 * is_default   - boolean Optional - Indicates this is the default payment token for a user
44
	 * token        - string  Required - The actual token to store
45
	 * gateway_id   - string  Required - Identifier for the gateway this token is associated with
46
	 * user_id      - int     Optional - ID for the user this token is associated with. 0 if this token is not associated with a user
47
	 *
48
	 * @since 2.6.0
49
	 * @param mixed $token
50
	 */
51
	public function __construct( $token = '' ) {
52
		if ( is_numeric( $token ) ) {
53
			$this->read( $token );
54
		} else if ( is_object( $token ) ) {
55
			$token_id = $token->get_id();
56
			if ( ! empty( $token_id ) ) {
57
				$this->read( $token->get_id() );
58
			}
59
		}
60
		// Set token type (cc, echeck)
61
		if ( ! empty( $this->type ) ) {
62
			$this->_data['type'] = $this->type;
63
		}
64
	}
65
66
	/**
67
	 * Returns the payment token ID.
68
	 * @since 2.6.0
69
	 * @return integer Token ID
70
	 */
71
	public function get_id() {
72
		return absint( $this->_data['id'] );
73
	}
74
75
	/**
76
	 * Returns the raw payment token.
77
	 * @since 2.6.0
78
	 * @return string Raw token
79
	 */
80
	public function get_token() {
81
		return $this->_data['token'];
82
	}
83
84
	/**
85
	 * Set the raw payment token.
86
	 * @since 2.6.0
87
	 * @param string $token
88
	 */
89
	public function set_token( $token ) {
90
		$this->_data['token'] = $token;
91
	}
92
93
	/**
94
	 * Returns the type of this payment token (CC, eCheck, or something else).
95
	 * @since 2.6.0
96
	 * @return string Payment Token Type (CC, eCheck)
97
	 */
98
	public function get_type() {
99
		return isset( $this->_data['type'] ) ? $this->_data['type'] : '';
100
	}
101
102
	/**
103
	 * Get type to display to user.
104
	 * @return string
105
	 */
106
	public function get_display_name() {
107
		return $this->get_type();
108
	}
109
110
	/**
111
	 * Returns the user ID associated with the token or false if this token is not associated.
112
	 * @since 2.6.0
113
	 * @return int User ID if this token is associated with a user or 0 if no user is associated
114
	 */
115
	public function get_user_id() {
116
		return ( isset( $this->_data['user_id'] ) && $this->_data['user_id'] > 0 ) ? absint( $this->_data['user_id'] ) : 0;
117
	}
118
119
	/**
120
	 * Set the user ID for the user associated with this order.
121
	 * @since 2.6.0
122
	 * @param int $user_id
123
	 */
124
	public function set_user_id( $user_id ) {
125
		$this->_data['user_id'] = absint( $user_id );
126
	}
127
128
	/**
129
	 * Returns the ID of the gateway associated with this payment token.
130
	 * @since 2.6.0
131
	 * @return string Gateway ID
132
	 */
133
	public function get_gateway_id() {
134
		return $this->_data['gateway_id'];
135
	}
136
137
	/**
138
	 * Set the gateway ID.
139
	 * @since 2.6.0
140
	 * @param string $gateway_id
141
	 */
142
	public function set_gateway_id( $gateway_id ) {
143
		$this->_data['gateway_id'] = $gateway_id;
144
	}
145
146
	/**
147
	 * Returns if the token is marked as default.
148
	 * @since 2.6.0
149
	 * @return boolean True if the token is default
150
	 */
151
	public function is_default() {
152
		return ! empty( $this->_data['is_default'] );
153
	}
154
155
	/**
156
	 * Marks the payment as default or non-default.
157
	 * @since 2.6.0
158
	 * @param boolean $is_default True or false
159
	 */
160
	public function set_default( $is_default ) {
161
		$this->_data['is_default'] = (bool) $is_default;
162
	}
163
164
	/**
165
	 * Validate basic token info (token and type are required).
166
	 * @since 2.6.0
167
	 * @return boolean True if the passed data is valid
168
	 */
169
	public function validate() {
170
		if ( empty( $this->_data['token'] ) ) {
171
			return false;
172
		}
173
174
		if ( empty( $this->_data['type'] ) ) {
175
			return false;
176
		}
177
178
		return true;
179
	}
180
181
	/**
182
	 * Get a token from the database.
183
	 * @since 2.6.0
184
	 * @param  int $token_id Token ID
185
	 */
186
	public function read( $token_id ) {
187
		global $wpdb;
188
		if ( $token = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_payment_tokens WHERE token_id = %d LIMIT 1;", $token_id ) ) ) {
189
			$token_id = $token->token_id;
190
			$token = (array) $token;
191
			unset( $token['token_id'] );
192
			$this->_data = $token;
193
			$this->_data['id'] = $token_id;
194
			$this->read_meta_data();
195
		}
196
	}
197
198
	/**
199
	 * Update a payment token.
200
	 * @since 2.6.0
201
	 * @return boolean on success, false if validation failed and a payment token could not be updated
202
	 */
203
	public function update() {
204
		if ( false === $this->validate() ) {
205
			return false;
206
		}
207
208
		global $wpdb;
209
210
		$payment_token_data = array(
211
			'gateway_id' => $this->get_gateway_id(),
212
			'token'      => $this->get_token(),
213
			'user_id'    => $this->get_user_id(),
214
			'type'       => $this->get_type(),
215
		);
216
217
		$wpdb->update(
218
			$wpdb->prefix . 'woocommerce_payment_tokens',
219
			$payment_token_data,
220
			array( 'token_id' => $this->get_id() )
221
		);
222
223
		$this->save_meta_data();
224
225
		// Make sure all other tokens are not set to default
226
		if ( $this->is_default() && $this->get_user_id() > 0 ) {
227
			WC_Payment_Tokens::set_users_default( $this->get_user_id(), $this->get_id() );
228
		}
229
230
		do_action( 'woocommerce_payment_token_updated', $this->get_id() );
231
		return true;
232
	}
233
234
	/**
235
	 * Create a new payment token in the database.
236
	 * @since 2.6.0
237
	 * @return boolean on success, false if validation failed and a payment token could not be created
238
	 */
239
	public function create() {
240
		if ( false === $this->validate() ) {
241
			return false;
242
		}
243
244
		global $wpdb;
245
		// Are there any other tokens? If not, set this token as default
246
		if ( ! $this->is_default() && $this->get_user_id() > 0 ) {
247
			$default_token = WC_Payment_Tokens::get_customer_default_token( $this->get_user_id() );
248
			if ( is_null( $default_token ) ) {
249
				$this->set_default( true );
250
			}
251
		}
252
253
		$payment_token_data = array(
254
			'gateway_id' => $this->get_gateway_id(),
255
			'token'      => $this->get_token(),
256
			'user_id'    => $this->get_user_id(),
257
			'type'       => $this->get_type(),
258
		);
259
260
		$wpdb->insert( $wpdb->prefix . 'woocommerce_payment_tokens', $payment_token_data );
261
		$this->_data['id'] = $token_id = $wpdb->insert_id;
262
		$this->save_meta_data();
263
264
		// Make sure all other tokens are not set to default
265
		if ( $this->is_default() && $this->get_user_id() > 0 ) {
266
			WC_Payment_Tokens::set_users_default( $this->get_user_id(), $token_id );
267
		}
268
269
		do_action( 'woocommerce_payment_token_created', $token_id );
270
		return true;
271
	}
272
273
	/**
274
	 * Saves a payment token to the database - does not require you to know if this is a new token or an update token.
275
	 * @since 2.6.0
276
	 * @return boolean on success, false if validation failed and a payment token could not be saved
277
	 */
278
	public function save() {
279
		if ( $this->get_id() > 0 ) {
280
			return $this->update();
281
		} else {
282
			return $this->create();
283
		}
284
	}
285
286
	/**
287
	 * Remove a payment token from the database.
288
	 * @since 2.6.0
289
	 */
290
	public function delete() {
291
		global $wpdb;
292
		$this->read( $this->get_id() ); // Make sure we have a token to return after deletion
293
		$wpdb->delete( $wpdb->prefix . 'woocommerce_payment_tokens', array( 'token_id' => $this->get_id() ), array( '%d' ) );
294
		$wpdb->delete( $wpdb->prefix . 'woocommerce_payment_tokenmeta', array( 'payment_token_id' => $this->get_id() ), array( '%d' ) );
295
		do_action( 'woocommerce_payment_token_deleted', $this->get_id(), $this );
296
	}
297
298
}
299