Issues (1182)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/settings/class-wc-settings-checkout.php (5 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * WooCommerce Shipping Settings
4
 *
5
 * @author   WooThemes
6
 * @category Admin
7
 * @package  WooCommerce/Admin
8
 * @version  2.5.0
9
 */
10
11
if ( ! defined( 'ABSPATH' ) ) {
12
	exit;
13
}
14
15
if ( ! class_exists( 'WC_Settings_Payment_Gateways' ) ) :
16
17
/**
18
 * WC_Settings_Payment_Gateways.
19
 */
20
class WC_Settings_Payment_Gateways extends WC_Settings_Page {
21
22
	/**
23
	 * Constructor.
24
	 */
25 View Code Duplication
	public function __construct() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
26
27
		$this->id    = 'checkout';
28
		$this->label = _x( 'Checkout', 'Settings tab label', 'woocommerce' );
29
30
		add_filter( 'woocommerce_settings_tabs_array', array( $this, 'add_settings_page' ), 20 );
31
		add_action( 'woocommerce_sections_' . $this->id, array( $this, 'output_sections' ) );
32
		add_action( 'woocommerce_settings_' . $this->id, array( $this, 'output' ) );
33
		add_action( 'woocommerce_admin_field_payment_gateways', array( $this, 'payment_gateways_setting' ) );
34
		add_action( 'woocommerce_settings_save_' . $this->id, array( $this, 'save' ) );
35
	}
36
37
	/**
38
	 * Get sections.
39
	 *
40
	 * @return array
41
	 */
42
	public function get_sections() {
43
		$sections = array(
44
			'' => __( 'Checkout Options', 'woocommerce' )
45
		);
46
47 View Code Duplication
		if ( ! defined( 'WC_INSTALLING' ) ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
48
			// Load shipping methods so we can show any global options they may have.
49
			$payment_gateways = WC()->payment_gateways->payment_gateways();
50
51
			foreach ( $payment_gateways as $gateway ) {
52
				$title = empty( $gateway->method_title ) ? ucfirst( $gateway->id ) : $gateway->method_title;
53
				$sections[ strtolower( $gateway->id ) ] = esc_html( $title );
54
			}
55
		}
56
57
		return apply_filters( 'woocommerce_get_sections_' . $this->id, $sections );
58
	}
59
60
	/**
61
	 * Get settings array.
62
	 *
63
	 * @return array
64
	 */
65
	public function get_settings() {
66
		$settings = apply_filters( 'woocommerce_payment_gateways_settings', array(
67
68
			array(
69
				'title' => __( 'Checkout Process', 'woocommerce' ),
70
				'type'  => 'title',
71
				'id'    => 'checkout_process_options',
72
			),
73
74
			array(
75
				'title'         => __( 'Coupons', 'woocommerce' ),
76
				'desc'          => __( 'Enable the use of coupons', 'woocommerce' ),
77
				'id'            => 'woocommerce_enable_coupons',
78
				'default'       => 'yes',
79
				'type'          => 'checkbox',
80
				'checkboxgroup' => 'start',
81
				'desc_tip'      =>  __( 'Coupons can be applied from the cart and checkout pages.', 'woocommerce' ),
82
			),
83
84
			array(
85
				'desc'          => __( 'Calculate coupon discounts sequentially', 'woocommerce' ),
86
				'id'            => 'woocommerce_calc_discounts_sequentially',
87
				'default'       => 'no',
88
				'type'          => 'checkbox',
89
				'desc_tip'      =>  __( 'When applying multiple coupons, apply the first coupon to the full price and the second coupon to the discounted price and so on.', 'woocommerce' ),
90
				'checkboxgroup' => 'end',
91
				'autoload'      => false,
92
			),
93
94
			array(
95
				'title'         => _x( 'Checkout Process', 'Settings group label', 'woocommerce' ),
96
				'desc'          => __( 'Enable guest checkout', 'woocommerce' ),
97
				'desc_tip'      =>  __( 'Allows customers to checkout without creating an account.', 'woocommerce' ),
98
				'id'            => 'woocommerce_enable_guest_checkout',
99
				'default'       => 'yes',
100
				'type'          => 'checkbox',
101
				'checkboxgroup' => 'start',
102
				'autoload'      => false,
103
			),
104
105
			array(
106
				'desc'            => __( 'Force secure checkout', 'woocommerce' ),
107
				'id'              => 'woocommerce_force_ssl_checkout',
108
				'default'         => 'no',
109
				'type'            => 'checkbox',
110
				'checkboxgroup'   => '',
111
				'show_if_checked' => 'option',
112
				'desc_tip'        => __( 'Force SSL (HTTPS) on the checkout pages (an SSL Certificate is required).', 'woocommerce' ),
113
			),
114
115
			'unforce_ssl_checkout' => array(
116
				'desc'            => __( 'Force HTTP when leaving the checkout', 'woocommerce' ),
117
				'id'              => 'woocommerce_unforce_ssl_checkout',
118
				'default'         => 'no',
119
				'type'            => 'checkbox',
120
				'checkboxgroup'   => 'end',
121
				'show_if_checked' => 'yes',
122
			),
123
124
			array(
125
				'type' => 'sectionend',
126
				'id' => 'checkout_process_options',
127
			),
128
129
			array(
130
				'title' => __( 'Checkout Pages', 'woocommerce' ),
131
				'desc'  => __( 'These pages need to be set so that WooCommerce knows where to send users to checkout.', 'woocommerce' ),
132
				'type'  => 'title',
133
				'id'    => 'checkout_page_options',
134
			),
135
136
			array(
137
				'title'    => __( 'Cart Page', 'woocommerce' ),
138
				'desc'     => __( 'Page contents:', 'woocommerce' ) . ' [' . apply_filters( 'woocommerce_cart_shortcode_tag', 'woocommerce_cart' ) . ']',
139
				'id'       => 'woocommerce_cart_page_id',
140
				'type'     => 'single_select_page',
141
				'default'  => '',
142
				'class'    => 'wc-enhanced-select-nostd',
143
				'css'      => 'min-width:300px;',
144
				'desc_tip' => true,
145
			),
146
147
			array(
148
				'title'    => __( 'Checkout Page', 'woocommerce' ),
149
				'desc'     => __( 'Page contents:', 'woocommerce' ) . ' [' . apply_filters( 'woocommerce_checkout_shortcode_tag', 'woocommerce_checkout' ) . ']',
150
				'id'       => 'woocommerce_checkout_page_id',
151
				'type'     => 'single_select_page',
152
				'default'  => '',
153
				'class'    => 'wc-enhanced-select-nostd',
154
				'css'      => 'min-width:300px;',
155
				'desc_tip' => true,
156
			),
157
158
			array(
159
				'title'    => __( 'Terms and Conditions', 'woocommerce' ),
160
				'desc'     => __( 'If you define a "Terms" page the customer will be asked if they accept them when checking out.', 'woocommerce' ),
161
				'id'       => 'woocommerce_terms_page_id',
162
				'default'  => '',
163
				'class'    => 'wc-enhanced-select-nostd',
164
				'css'      => 'min-width:300px;',
165
				'type'     => 'single_select_page',
166
				'desc_tip' => true,
167
				'autoload' => false,
168
			),
169
170
			array(
171
				'type' => 'sectionend',
172
				'id' => 'checkout_page_options',
173
			),
174
175
			array( 'title' => __( 'Checkout Endpoints', 'woocommerce' ), 'type' => 'title', 'desc' => __( 'Endpoints are appended to your page URLs to handle specific actions during the checkout process. They should be unique.', 'woocommerce' ), 'id' => 'account_endpoint_options' ),
176
177
			array(
178
				'title'    => __( 'Pay', 'woocommerce' ),
179
				'desc'     => __( 'Endpoint for the Checkout &rarr; Pay page', 'woocommerce' ),
180
				'id'       => 'woocommerce_checkout_pay_endpoint',
181
				'type'     => 'text',
182
				'default'  => 'order-pay',
183
				'desc_tip' => true,
184
			),
185
186
			array(
187
				'title'    => __( 'Order Received', 'woocommerce' ),
188
				'desc'     => __( 'Endpoint for the Checkout &rarr; Order Received page', 'woocommerce' ),
189
				'id'       => 'woocommerce_checkout_order_received_endpoint',
190
				'type'     => 'text',
191
				'default'  => 'order-received',
192
				'desc_tip' => true,
193
			),
194
195
			array(
196
				'title'    => __( 'Add Payment Method', 'woocommerce' ),
197
				'desc'     => __( 'Endpoint for the Checkout &rarr; Add Payment Method page', 'woocommerce' ),
198
				'id'       => 'woocommerce_myaccount_add_payment_method_endpoint',
199
				'type'     => 'text',
200
				'default'  => 'add-payment-method',
201
				'desc_tip' => true,
202
			),
203
204
			array(
205
				'title'    => __( 'Delete Payment Method', 'woocommerce' ),
206
				'desc'     => __( 'Endpoint for the delete payment method page', 'woocommerce' ),
207
				'id'       => 'woocommerce_myaccount_delete_payment_method_endpoint',
208
				'type'     => 'text',
209
				'default'  => 'delete-payment-method',
210
				'desc_tip' => true,
211
			),
212
213
			array(
214
				'title'    => __( 'Set Default Payment Method', 'woocommerce' ),
215
				'desc'     => __( 'Endpoint for the setting a default payment method page', 'woocommerce' ),
216
				'id'       => 'woocommerce_myaccount_set_default_payment_method_endpoint',
217
				'type'     => 'text',
218
				'default'  => 'set-default-payment-method',
219
				'desc_tip' => true,
220
			),
221
222
223
			array(
224
				'type' => 'sectionend',
225
				'id' => 'checkout_endpoint_options',
226
			),
227
228
			array(
229
				'title' => __( 'Payment Gateways', 'woocommerce' ),
230
				'desc'  => __( 'Installed gateways are listed below. Drag and drop gateways to control their display order on the frontend.', 'woocommerce' ),
231
				'type'  => 'title',
232
				'id'    => 'payment_gateways_options',
233
			),
234
235
			array(
236
				'type' => 'payment_gateways',
237
			),
238
239
			array(
240
				'type' => 'sectionend',
241
				'id' => 'payment_gateways_options',
242
			),
243
244
		) );
245
246
		if ( wc_site_is_https() ) {
247
			unset( $settings['unforce_ssl_checkout'] );
248
		}
249
250
		return apply_filters( 'woocommerce_get_settings_' . $this->id, $settings );
251
	}
252
253
	/**
254
	 * Output the settings.
255
	 */
256 View Code Duplication
	public function output() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
257
		global $current_section;
258
259
		// Load shipping methods so we can show any global options they may have.
260
		$payment_gateways = WC()->payment_gateways->payment_gateways();
261
262
		if ( $current_section ) {
263
			foreach ( $payment_gateways as $gateway ) {
264
				if ( in_array( $current_section, array( $gateway->id, sanitize_title( get_class( $gateway ) ) ) ) ) {
265
					$gateway->admin_options();
266
					break;
267
				}
268
			}
269
		} else {
270
			$settings = $this->get_settings();
271
272
			WC_Admin_Settings::output_fields( $settings );
273
		}
274
	}
275
276
	/**
277
	 * Output payment gateway settings.
278
	 */
279
	public function payment_gateways_setting() {
280
		?>
281
		<tr valign="top">
282
			<th scope="row" class="titledesc"><?php _e( 'Gateway Display Order', 'woocommerce' ) ?></th>
283
			<td class="forminp">
284
				<table class="wc_gateways widefat" cellspacing="0">
285
					<thead>
286
						<tr>
287
							<?php
288
								$columns = apply_filters( 'woocommerce_payment_gateways_setting_columns', array(
289
									'sort'     => '',
290
									'name'     => __( 'Gateway', 'woocommerce' ),
291
									'id'       => __( 'Gateway ID', 'woocommerce' ),
292
									'status'   => __( 'Enabled', 'woocommerce' )
293
								) );
294
295 View Code Duplication
								foreach ( $columns as $key => $column ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
296
									echo '<th class="' . esc_attr( $key ) . '">' . esc_html( $column ) . '</th>';
297
								}
298
							?>
299
						</tr>
300
					</thead>
301
					<tbody>
302
						<?php
303
						foreach ( WC()->payment_gateways->payment_gateways() as $gateway ) {
304
305
							echo '<tr>';
306
307
							foreach ( $columns as $key => $column ) {
308
309
								switch ( $key ) {
310
311
									case 'sort' :
312
										echo '<td width="1%" class="sort">
313
											<input type="hidden" name="gateway_order[]" value="' . esc_attr( $gateway->id ) . '" />
314
										</td>';
315
										break;
316
317
									case 'name' :
318
										$method_title = $gateway->get_title() ? $gateway->get_title() : __( '(no title)', 'woocommerce' );
319
										echo '<td class="name">
320
											<a href="' . admin_url( 'admin.php?page=wc-settings&tab=checkout&section=' . strtolower( get_class( $gateway ) ) ) . '">' . esc_html( $method_title ) . '</a>
321
										</td>';
322
										break;
323
324
									case 'id' :
325
										echo '<td class="id">' . esc_html( $gateway->id ) . '</td>';
326
										break;
327
328
									case 'status' :
329
										echo '<td class="status">';
330
331
										if ( $gateway->enabled == 'yes' )
332
											echo '<span class="status-enabled tips" data-tip="' . __ ( 'Yes', 'woocommerce' ) . '">' . __ ( 'Yes', 'woocommerce' ) . '</span>';
333
										else
334
											echo '-';
335
336
										echo '</td>';
337
										break;
338
339
									default :
340
										do_action( 'woocommerce_payment_gateways_setting_column_' . $key, $gateway );
341
										break;
342
								}
343
							}
344
345
							echo '</tr>';
346
						}
347
						?>
348
					</tbody>
349
				</table>
350
			</td>
351
		</tr>
352
		<?php
353
	}
354
355
	/**
356
	 * Save settings.
357
	 */
358 View Code Duplication
	public function save() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
359
		global $current_section;
360
361
		$wc_payment_gateways = WC_Payment_Gateways::instance();
362
363
		if ( ! $current_section ) {
364
			WC_Admin_Settings::save_fields( $this->get_settings() );
365
			$wc_payment_gateways->process_admin_options();
366
367
		} else {
368
			foreach ( $wc_payment_gateways->payment_gateways() as $gateway ) {
369
				if ( in_array( $current_section, array( $gateway->id, sanitize_title( get_class( $gateway ) ) ) ) ) {
370
					do_action( 'woocommerce_update_options_payment_gateways_' . $gateway->id );
371
					$wc_payment_gateways->init();
372
				}
373
			}
374
		}
375
	}
376
}
377
378
endif;
379
380
return new WC_Settings_Payment_Gateways();
381