Issues (1182)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/settings/class-wc-settings-emails.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * WooCommerce Email Settings
4
 *
5
 * @author      WooThemes
6
 * @category    Admin
7
 * @package     WooCommerce/Admin
8
 * @version     2.1.0
9
 */
10
11
if ( ! defined( 'ABSPATH' ) ) {
12
	exit; // Exit if accessed directly
13
}
14
15
if ( ! class_exists( 'WC_Settings_Emails' ) ) :
16
17
/**
18
 * WC_Settings_Emails.
19
 */
20
class WC_Settings_Emails extends WC_Settings_Page {
21
22
	/**
23
	 * Constructor.
24
	 */
25 View Code Duplication
	public function __construct() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
26
		$this->id    = 'email';
27
		$this->label = __( 'Emails', 'woocommerce' );
28
29
		add_filter( 'woocommerce_settings_tabs_array', array( $this, 'add_settings_page' ), 20 );
30
		add_action( 'woocommerce_sections_' . $this->id, array( $this, 'output_sections' ) );
31
		add_action( 'woocommerce_settings_' . $this->id, array( $this, 'output' ) );
32
		add_action( 'woocommerce_settings_save_' . $this->id, array( $this, 'save' ) );
33
		add_action( 'woocommerce_admin_field_email_notification', array( $this, 'email_notification_setting' ) );
34
	}
35
36
	/**
37
	 * Get sections.
38
	 *
39
	 * @return array
40
	 */
41
	public function get_sections() {
42
		$sections = array(
43
			'' => __( 'Email Options', 'woocommerce' )
44
		);
45
		return apply_filters( 'woocommerce_get_sections_' . $this->id, $sections );
46
	}
47
48
	/**
49
	 * Get settings array.
50
	 *
51
	 * @return array
52
	 */
53
	public function get_settings() {
54
		$settings = apply_filters( 'woocommerce_email_settings', array(
55
56
			array( 'title' => __( 'Email Notifications', 'woocommerce' ),  'desc' => __( 'Email notifications sent from WooCommerce are listed below. Click on an email to configure it.', 'woocommerce' ), 'type' => 'title', 'id' => 'email_notification_settings' ),
57
58
			array( 'type' => 'email_notification' ),
59
60
			array( 'type' => 'sectionend', 'id' => 'email_notification_settings' ),
61
62
			array( 'type' => 'sectionend', 'id' => 'email_recipient_options' ),
63
64
			array( 'title' => __( 'Email Sender Options', 'woocommerce' ), 'type' => 'title', 'desc' => '', 'id' => 'email_options' ),
65
66
			array(
67
				'title'    => __( '"From" Name', 'woocommerce' ),
68
				'desc'     => __( 'How the sender\'s name appears in outgoing WooCommerce emails.', 'woocommerce' ),
69
				'id'       => 'woocommerce_email_from_name',
70
				'type'     => 'text',
71
				'css'      => 'min-width:300px;',
72
				'default'  => esc_attr( get_bloginfo( 'name', 'display' ) ),
73
				'autoload' => false,
74
				'desc_tip' => true
75
			),
76
77
			array(
78
				'title'             => __( '"From" Address', 'woocommerce' ),
79
				'desc'              => __( 'How the sender\'s email appears in outgoing WooCommerce emails.', 'woocommerce' ),
80
				'id'                => 'woocommerce_email_from_address',
81
				'type'              => 'email',
82
				'custom_attributes' => array(
83
					'multiple' => 'multiple'
84
				),
85
				'css'               => 'min-width:300px;',
86
				'default'           => get_option( 'admin_email' ),
87
				'autoload'          => false,
88
				'desc_tip'          => true
89
			),
90
91
			array( 'type' => 'sectionend', 'id' => 'email_options' ),
92
93
			array( 'title' => __( 'Email Template', 'woocommerce' ), 'type' => 'title', 'desc' => sprintf(__( 'This section lets you customize the WooCommerce emails. <a href="%s" target="_blank">Click here to preview your email template</a>.', 'woocommerce' ), wp_nonce_url( admin_url( '?preview_woocommerce_mail=true' ), 'preview-mail' ) ), 'id' => 'email_template_options' ),
94
95
			array(
96
				'title'       => __( 'Header Image', 'woocommerce' ),
97
				'desc'        => __( 'URL to an image you want to show in the email header. Upload images using the media uploader (Admin > Media).', 'woocommerce' ),
98
				'id'          => 'woocommerce_email_header_image',
99
				'type'        => 'text',
100
				'css'         => 'min-width:300px;',
101
				'placeholder' => __( 'N/A', 'woocommerce' ),
102
				'default'     => '',
103
				'autoload'    => false,
104
				'desc_tip'    => true
105
			),
106
107
			array(
108
				'title'       => __( 'Footer Text', 'woocommerce' ),
109
				'desc'        => __( 'The text to appear in the footer of WooCommerce emails.', 'woocommerce' ),
110
				'id'          => 'woocommerce_email_footer_text',
111
				'css'         => 'width:300px; height: 75px;',
112
				'placeholder' => __( 'N/A', 'woocommerce' ),
113
				'type'        => 'textarea',
114
				'default'     => get_bloginfo( 'name', 'display' ) . ' - ' . __( 'Powered by WooCommerce', 'woocommerce' ),
115
				'autoload'    => false,
116
				'desc_tip'    => true
117
			),
118
119
			array(
120
				'title'    => __( 'Base Colour', 'woocommerce' ),
121
				'desc'     => __( 'The base colour for WooCommerce email templates. Default <code>#557da1</code>.', 'woocommerce' ),
122
				'id'       => 'woocommerce_email_base_color',
123
				'type'     => 'color',
124
				'css'      => 'width:6em;',
125
				'default'  => '#557da1',
126
				'autoload' => false,
127
				'desc_tip' => true
128
			),
129
130
			array(
131
				'title'    => __( 'Background Colour', 'woocommerce' ),
132
				'desc'     => __( 'The background colour for WooCommerce email templates. Default <code>#f5f5f5</code>.', 'woocommerce' ),
133
				'id'       => 'woocommerce_email_background_color',
134
				'type'     => 'color',
135
				'css'      => 'width:6em;',
136
				'default'  => '#f5f5f5',
137
				'autoload' => false,
138
				'desc_tip' => true
139
			),
140
141
			array(
142
				'title'    => __( 'Body Background Colour', 'woocommerce' ),
143
				'desc'     => __( 'The main body background colour. Default <code>#fdfdfd</code>.', 'woocommerce' ),
144
				'id'       => 'woocommerce_email_body_background_color',
145
				'type'     => 'color',
146
				'css'      => 'width:6em;',
147
				'default'  => '#fdfdfd',
148
				'autoload' => false,
149
				'desc_tip' => true
150
			),
151
152
			array(
153
				'title'    => __( 'Body Text Colour', 'woocommerce' ),
154
				'desc'     => __( 'The main body text colour. Default <code>#505050</code>.', 'woocommerce' ),
155
				'id'       => 'woocommerce_email_text_color',
156
				'type'     => 'color',
157
				'css'      => 'width:6em;',
158
				'default'  => '#505050',
159
				'autoload' => false,
160
				'desc_tip' => true
161
			),
162
163
			array( 'type' => 'sectionend', 'id' => 'email_notification_settings' ),
164
165
		) );
166
167
		return apply_filters( 'woocommerce_get_settings_' . $this->id, $settings );
168
	}
169
170
	/**
171
	 * Output the settings.
172
	 */
173
	public function output() {
174
		global $current_section;
175
176
		// Define emails that can be customised here
177
		$mailer          = WC()->mailer();
178
		$email_templates = $mailer->get_emails();
179
180
		if ( $current_section ) {
181
			foreach ( $email_templates as $email_key => $email ) {
182
				if ( strtolower( $email_key ) == $current_section ) {
183
					$email->admin_options();
184
					break;
185
				}
186
			}
187
		} else {
188
			$settings = $this->get_settings();
189
			WC_Admin_Settings::output_fields( $settings );
190
		}
191
	}
192
193
	/**
194
	 * Save settings.
195
	 */
196
	public function save() {
197
		global $current_section;
198
199
		if ( ! $current_section ) {
200
			WC_Admin_Settings::save_fields( $this->get_settings() );
201
202
		} else {
203
			$wc_emails = WC_Emails::instance();
204
205
			if ( in_array( $current_section, array_map( 'sanitize_title', array_keys( $wc_emails->get_emails() ) ) ) ) {
206
				foreach ( $wc_emails->get_emails() as $email_id => $email ) {
207
					if ( $current_section === sanitize_title( $email_id ) ) {
208
						do_action( 'woocommerce_update_options_' . $this->id . '_' . $email->id );
209
					}
210
				}
211
			} else {
212
				do_action( 'woocommerce_update_options_' . $this->id . '_' . $current_section );
213
			}
214
		}
215
	}
216
217
	/**
218
	 * Output email notification settings.
219
	 */
220
	public function email_notification_setting() {
221
		// Define emails that can be customised here
222
		$mailer          = WC()->mailer();
223
		$email_templates = $mailer->get_emails();
224
		?>
225
		<tr valign="top">
226
		    <td class="wc_emails_wrapper" colspan="2">
227
				<table class="wc_emails widefat" cellspacing="0">
228
					<thead>
229
						<tr>
230
							<?php
231
								$columns = apply_filters( 'woocommerce_email_setting_columns', array(
232
									'status'     => '',
233
									'name'       => __( 'Email', 'woocommerce' ),
234
									'email_type' => __( 'Content Type', 'woocommerce' ),
235
									'recipient'  => __( 'Recipient(s)', 'woocommerce' ),
236
									'actions'    => ''
237
								) );
238 View Code Duplication
								foreach ( $columns as $key => $column ) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
239
									echo '<th class="wc-email-settings-table-' . esc_attr( $key ) . '">' . esc_html( $column ) . '</th>';
240
								}
241
							?>
242
						</tr>
243
					</thead>
244
					<tbody>
245
						<?php
246
						foreach ( $email_templates as $email_key => $email ) {
247
							echo '<tr>';
248
249
							foreach ( $columns as $key => $column ) {
250
251
								switch ( $key ) {
252
									case 'name' :
253
										echo '<td class="wc-email-settings-table-' . esc_attr( $key ) . '">
254
											<a href="' . admin_url( 'admin.php?page=wc-settings&tab=email&section=' . strtolower( $email_key ) ) . '">' . $email->get_title() . '</a>
255
											' . wc_help_tip( $email->get_description() ) . '
256
										</td>';
257
									break;
258
									case 'recipient' :
259
										echo '<td class="wc-email-settings-table-' . esc_attr( $key ) . '">
260
											' . esc_html( $email->is_customer_email() ? __( 'Customer', 'woocommerce' ) : $email->get_recipient() ) . '
261
										</td>';
262
									break;
263
									case 'status' :
264
										echo '<td class="wc-email-settings-table-' . esc_attr( $key ) . '">';
265
266
										if ( $email->is_manual() ) {
267
											echo '<span class="status-manual tips" data-tip="' . __( 'Manually sent', 'woocommerce' ) . '">' . __( 'Manual', 'woocommerce' ) . '</span>';
268
										} elseif ( $email->is_enabled() ) {
269
											echo '<span class="status-enabled tips" data-tip="' . __( 'Enabled', 'woocommerce' ) . '">' . __( 'Yes', 'woocommerce' ) . '</span>';
270
										} else {
271
											echo '<span class="status-disabled tips" data-tip="' . __( 'Disabled', 'woocommerce' ) . '">-</span>';
272
										}
273
274
										echo '</td>';
275
									break;
276
									case 'email_type' :
277
										echo '<td class="wc-email-settings-table-' . esc_attr( $key ) . '">
278
											' . esc_html( $email->get_content_type() ) . '
279
										</td>';
280
									break;
281
									case 'actions' :
282
										echo '<td class="wc-email-settings-table-' . esc_attr( $key ) . '">
283
											<a class="button alignright tips" data-tip="' . __( 'Configure', 'woocommerce' ) . '" href="' . admin_url( 'admin.php?page=wc-settings&tab=email&section=' . strtolower( $email_key ) ) . '">' . __( 'Configure', 'woocommerce' ) . '</a>
284
										</td>';
285
									break;
286
									default :
287
										do_action( 'woocommerce_email_setting_column_' . $key, $email );
288
									break;
289
								}
290
							}
291
292
							echo '</tr>';
293
						}
294
						?>
295
					</tbody>
296
				</table>
297
			</td>
298
		</tr>
299
		<?php
300
	}
301
}
302
303
endif;
304
305
return new WC_Settings_Emails();
306