10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-13 19:56:27 +09:00
Code Issues Packages Projects Releases Wiki Activity

- added nonce fields;

Browse Source
This commit is contained in:
nikitozzzzzzz
2018-11-21 14:01:18 +02:00
parent 9b083d8243
commit 0ceab69793
44 changed files with 393 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/admin/assets/js/um-admin-ajax.js
+11 -1
View File
@@ -31,7 +31,17 @@ jQuery(document).ready(function() {
jQuery.ajax({
url: wp.ajax.settings.url,
type: 'POST',
data: { action:'um_do_ajax_action',act_id : act_id, arg1 : arg1, arg2 : arg2, in_row: in_row, in_sub_row: in_sub_row, in_column: in_column, in_group: in_group },
data: {
action:'um_do_ajax_action',
act_id : act_id,
arg1 : arg1,
arg2 : arg2,
in_row: in_row,
in_sub_row: in_sub_row,
in_column: in_column,
in_group: in_group,
nonce: um_admin_scripts.nonce
},
success: function(data){
jQuery('.um-col-demon-settings').data('in_row', '');
includes/admin/assets/js/um-admin-builder.js
+2 -1
View File
@@ -14,7 +14,8 @@ function um_admin_update_builder() {
type: 'POST',
data: {
action:'um_update_builder',
form_id: form_id
form_id: form_id,
nonce: um_admin_scripts.nonce
},
success: function(data){
includes/admin/assets/js/um-admin-field.js
+7 -1
View File
@@ -13,7 +13,13 @@ jQuery(document).ready(function() {
jQuery.ajax({
url: wp.ajax.settings.url,
type: 'POST',
data: {action:'um_do_ajax_action',act_id : 'um_admin_remove_field_global', arg1 : arg1 },
data: {
action:'um_do_ajax_action',
act_id : 'um_admin_remove_field_global',
arg1 : arg1,
nonce: um_admin_scripts.nonce
},
success: function(data){
},
includes/admin/assets/js/um-admin-modal.js
+17 -2
View File
@@ -54,7 +54,18 @@ function um_admin_modal_ajaxcall( act_id, arg1, arg2, arg3 ) {
jQuery.ajax({
url: wp.ajax.settings.url,
type: 'POST',
data: { action:'um_dynamic_modal_content',act_id: act_id, arg1 : arg1, arg2 : arg2, arg3: arg3, in_row: in_row, in_sub_row: in_sub_row, in_column: in_column, in_group: in_group },
data: {
action:'um_dynamic_modal_content',
act_id: act_id,
arg1 : arg1,
arg2 : arg2,
arg3: arg3,
in_row: in_row,
in_sub_row: in_sub_row,
in_column: in_column,
in_group: in_group,
nonce: um_admin_scripts.nonce
},
complete: function(){
um_admin_modal_loaded();
um_admin_modal_responsive();
@@ -386,7 +397,11 @@ jQuery(document).ready(function() {
jQuery.ajax({
url: wp.ajax.settings.url,
type: 'POST',
data: { action:'populate_dropdown_options',um_option_callback: um_option_callback },
data: {
action:'um_populate_dropdown_options',
um_option_callback: um_option_callback,
nonce: um_admin_scripts.nonce
},
complete: function(){
},
includes/admin/class-admin-functions.php
+15
View File
@@ -22,6 +22,21 @@ if ( ! class_exists( 'um\admin\Admin_Functions' ) ) {
}
/**
* Check wp-admin nonce
*
* @param bool $action
*/
function check_ajax_nonce( $action = false ) {
$nonce = isset( $_POST['nonce'] ) ? $_POST['nonce'] : '';
$action = empty( $action ) ? 'um-admin-nonce' : $action;
if ( ! wp_verify_nonce( $nonce, $action ) ) {
wp_send_json_error( esc_js( __( 'Wrong Nonce', 'ultimate-member' ) ) );
}
}
/**
* Boolean check if we're viewing UM backend
*
includes/admin/core/class-admin-builder.php
+16 -9
View File
@@ -292,9 +292,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
* Update the builder area
*/
function update_builder() {
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
die( 'Please login as administrator' );
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
extract( $_POST );
@@ -605,8 +606,11 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
*
*/
function update_field() {
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) )
die( __('Please login as administrator','ultimate-member') );
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
$output['error'] = null;
@@ -757,12 +761,14 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
*
*/
function dynamic_modal_content() {
$metabox = UM()->metabox();
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
die( __( 'Please login as administrator', 'ultimate-member' ) );
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
$metabox = UM()->metabox();
/**
* @var $act_id
* @var $arg1
@@ -1131,12 +1137,14 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
* Retrieves dropdown/multi-select options from a callback function
*/
function populate_dropdown_options() {
$arr_options = array();
UM()->admin()->check_ajax_nonce();
if ( ! current_user_can('manage_options') ) {
wp_die( __( 'This is not possible for security reasons.', 'ultimate-member' ) );
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( __( 'This is not possible for security reasons.', 'ultimate-member' ) );
}
$arr_options = array();
$um_callback_func = $_POST['um_option_callback'];
if ( empty( $um_callback_func ) ) {
$arr_options['status'] = 'empty';
@@ -1145,7 +1153,6 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
}
$arr_options['data'] = array();
if ( function_exists( $um_callback_func ) ) {
$arr_options['data'] = call_user_func( $um_callback_func );
}
includes/admin/core/class-admin-dragdrop.php
+7 -4
View File
@@ -26,9 +26,11 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
* Update order of fields
*/
function update_order() {
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) )
die( 'Please login as administrator' );
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
/**
* @var $form_id
@@ -43,8 +45,8 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
if ( ! empty( $fields ) ) {
foreach ( $fields as $key => $array ) {
if ( $array['type'] == 'row' ) {
$this->row_data[$key] = $array;
unset( $fields[$key] );
$this->row_data[ $key ] = $array;
unset( $fields[ $key ] );
}
}
} else {
@@ -217,6 +219,7 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
<input type="hidden" name="form_id" id="form_id" value="<?php echo get_the_ID(); ?>" />
<input type="hidden" name="action" value="um_update_order" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<div class="um_update_order_fields">
includes/admin/core/class-admin-enqueue.php
+2 -3
View File
@@ -332,9 +332,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Enqueue' ) ) {
* }
* ?>
*/
$localize_data = apply_filters('um_admin_enqueue_localize_data', array(
'ajaxurl' => admin_url( 'admin-ajax.php' ),
'nonce' => wp_create_nonce( "um-admin-nonce" )
$localize_data = apply_filters( 'um_admin_enqueue_localize_data', array(
'nonce' => wp_create_nonce( "um-admin-nonce" )
)
);
includes/admin/core/class-admin-menu.php
+11 -3
View File
@@ -76,7 +76,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Menu' ) ) {
url: wp.ajax.settings.url,
type: 'post',
data: {
action: 'um_rated'
action: 'um_rated',
nonce: um_admin_scripts.nonce
},
success: function(){
@@ -98,8 +99,14 @@ if ( ! class_exists( 'um\admin\core\Admin_Menu' ) ) {
* When user clicks the review link in backend
*/
function ultimatemember_rated() {
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
update_option( 'um_admin_footer_text_rated', 1 );
die();
wp_send_json_success();
}
@@ -109,8 +116,9 @@ if ( ! class_exists( 'um\admin\core\Admin_Menu' ) ) {
public function menu_order_count() {
global $menu, $submenu;
if ( ! current_user_can( 'list_users' ) )
if ( ! current_user_can( 'list_users' ) ) {
return;
}
$count = UM()->user()->get_pending_users_count();
if ( is_array( $menu ) ) {
includes/admin/core/class-admin-notices.php
+1 -5
View File
@@ -666,11 +666,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
function dismiss_notice() {
$nonce = isset( $_POST["nonce"] ) ? $_POST["nonce"] : "";
if ( ! wp_verify_nonce( $nonce, "um-admin-nonce" ) ) {
wp_send_json_error( esc_js( __( "Wrong Nonce", 'ultimate-member' ) ) );
}
UM()->admin()->check_ajax_nonce();
if ( empty( $_POST['key'] ) ) {
wp_send_json_error( __( 'Wrong Data', 'ultimate-member' ) );
includes/admin/core/class-admin-upgrade.php
+8 -2
View File
@@ -260,7 +260,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
type: 'POST',
dataType: 'json',
data: {
action: 'um_get_packages'
action: 'um_get_packages',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
um_packages = response.data.packages;
@@ -290,7 +291,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
dataType: 'html',
data: {
action: 'um_run_package',
pack: pack
pack: pack,
nonce: um_admin_scripts.nonce
},
success: function( html ) {
um_add_upgrade_log( 'Package "' + pack + '" is ready. Start the execution...' );
@@ -334,6 +336,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
function ajax_run_package() {
UM()->admin()->check_ajax_nonce();
if ( empty( $_POST['pack'] ) ) {
exit('');
} else {
@@ -346,6 +350,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
function ajax_get_packages() {
UM()->admin()->check_ajax_nonce();
$update_versions = $this->need_run_upgrades();
wp_send_json_success( array( 'packages' => $update_versions ) );
}
includes/admin/core/packages/1.3.39/functions.php
Vendored
+2
View File
@@ -1,5 +1,7 @@
<?php
function um_upgrade_usermetaquery1339() {
UM()->admin()->check_ajax_nonce();
include 'usermeta_query.php';
update_option( 'um_last_version_upgrade', '1.3.39' );
includes/admin/core/packages/1.3.39/init.php
Vendored
+3 -2
View File
@@ -5,11 +5,12 @@
um_add_upgrade_log( 'Upgrade Usermeta...' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_usermetaquery1339'
action: 'um_usermetaquery1339',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
includes/admin/core/packages/2.0-beta1/functions.php
+31
View File
@@ -1,5 +1,7 @@
<?php
function um_upgrade_styles20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'styles.php';
@@ -8,6 +10,8 @@ function um_upgrade_styles20beta1() {
function um_upgrade_user_roles20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
/**
* @var $response_roles_data
@@ -19,7 +23,10 @@ function um_upgrade_user_roles20beta1() {
function um_upgrade_get_users_per_role20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
if ( ! empty( $_POST['key_in_meta'] ) ) {
$args = array(
'meta_query' => array(
@@ -43,6 +50,8 @@ function um_upgrade_get_users_per_role20beta1() {
function um_upgrade_update_users_per_page20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
if ( ! empty( $_POST['key_in_meta'] ) && ! empty( $_POST['role_key'] ) && ! empty( $_POST['page'] ) ) {
$users_per_page = 100;
@@ -85,6 +94,8 @@ function um_upgrade_update_users_per_page20beta1() {
function um_upgrade_content_restriction20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'content_restriction.php';
@@ -94,6 +105,8 @@ function um_upgrade_content_restriction20beta1() {
function um_upgrade_settings20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'settings.php';
@@ -102,6 +115,8 @@ function um_upgrade_settings20beta1() {
function um_upgrade_menus20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'menus.php';
@@ -110,6 +125,8 @@ function um_upgrade_menus20beta1() {
function um_upgrade_mc_lists20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'mc_lists.php';
@@ -118,6 +135,8 @@ function um_upgrade_mc_lists20beta1() {
function um_upgrade_social_login20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'social_login.php';
@@ -126,6 +145,8 @@ function um_upgrade_social_login20beta1() {
function um_upgrade_cpt20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'um_cpt.php';
@@ -134,6 +155,8 @@ function um_upgrade_cpt20beta1() {
function um_upgrade_get_forums20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
remove_all_actions( 'pre_get_posts' );
@@ -149,6 +172,8 @@ function um_upgrade_get_forums20beta1() {
function um_upgrade_update_forum_per_page20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
if ( ! empty( $_POST['page'] ) ) {
@@ -205,6 +230,8 @@ function um_upgrade_update_forum_per_page20beta1() {
function um_upgrade_get_products20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
$wc_products = get_posts( array(
@@ -218,6 +245,8 @@ function um_upgrade_get_products20beta1() {
function um_upgrade_update_products_per_page20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
if ( ! empty( $_POST['page'] ) ) {
@@ -296,6 +325,8 @@ function um_upgrade_update_products_per_page20beta1() {
function um_upgrade_email_templates20beta1() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'email_templates.php';
includes/admin/core/packages/2.0-beta1/init.php
+45 -30
View File
@@ -13,11 +13,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Styles...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_styles20beta1'
action: 'um_styles20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -36,11 +37,12 @@
function upgrade_roles() {
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Roles...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_user_roles20beta1'
action: 'um_user_roles20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -70,12 +72,13 @@
var role = um_roles_data.shift();
um_add_upgrade_log( '<?php echo esc_js( __( 'Getting ', 'ultimate-member' ) ) ?>"' + role.role_key + '"<?php echo esc_js( __( ' users...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_get_users_per_role20beta1',
key_in_meta: role.key_in_meta
key_in_meta: role.key_in_meta,
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data.count != 'undefined' ) {
@@ -103,14 +106,15 @@
function update_user_per_page( role_key, key_in_meta ) {
if ( current_page <= users_pages ) {
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_update_users_per_page20beta1',
role_key: role_key,
key_in_meta: key_in_meta,
page: current_page
page: current_page,
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -135,11 +139,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Content Restriction Settings...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_content_restriction20beta1'
action: 'um_content_restriction20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -160,11 +165,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Settings...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_settings20beta1'
action: 'um_settings20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -185,11 +191,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Menu Items...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_menus20beta1'
action: 'um_menus20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -210,11 +217,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Mailchimp Lists...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_mc_lists20beta1'
action: 'um_mc_lists20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -235,11 +243,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Social Login Forms...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_social_login20beta1'
action: 'um_social_login20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -260,11 +269,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade UM Custom Post Types...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_cpt20beta1'
action: 'um_cpt20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -286,11 +296,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Get bbPress Forums count...', 'ultimate-member' ) ) ?>' );
current_page = 1;
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_get_forums20beta1'
action: 'um_get_forums20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -313,12 +324,13 @@
function update_forums_per_page() {
if ( current_page <= forums_pages ) {
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_update_forum_per_page20beta1',
page: current_page
page: current_page,
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -346,11 +358,12 @@
current_page = 1;
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_get_products20beta1'
action: 'um_get_products20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -373,12 +386,13 @@
function update_products_per_page() {
if ( current_page <= products_pages ) {
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_update_products_per_page20beta1',
page: current_page
page: current_page,
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -402,11 +416,12 @@
function upgrade_email_templates() {
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Email Templates...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_email_templates20beta1'
action: 'um_email_templates20beta1',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
includes/admin/core/packages/2.0.10/functions.php
Vendored
+4
View File
@@ -1,5 +1,7 @@
<?php
function um_upgrade_styles2010() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
include 'styles.php';
@@ -8,6 +10,8 @@ function um_upgrade_styles2010() {
function um_upgrade_cache2010() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
UM()->user()->remove_cache_all_users();
includes/admin/core/packages/2.0.10/init.php
Vendored
+6 -4
View File
@@ -6,11 +6,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Upgrade Styles...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_styles2010'
action: 'um_styles2010',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
@@ -30,11 +31,12 @@
function um_clear_cache2010() {
um_add_upgrade_log( '<?php echo esc_js( __( 'Clear Users Cache...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_cache2010'
action: 'um_cache2010',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
includes/admin/core/packages/2.0.24/functions.php
Vendored
+2
View File
@@ -1,5 +1,7 @@
<?php
function um_upgrade_tempfolder2024() {
UM()->admin()->check_ajax_nonce();
um_maybe_unset_time_limit();
UM()->files()->remove_dir( UM()->files()->upload_temp );
includes/admin/core/packages/2.0.24/init.php
Vendored
+3 -2
View File
@@ -6,11 +6,12 @@
um_add_upgrade_log( '<?php echo esc_js( __( 'Purge temp files dir...', 'ultimate-member' ) ) ?>' );
jQuery.ajax({
url: '<?php echo admin_url( 'admin-ajax.php' ) ?>',
url: wp.ajax.settings.url,
type: 'POST',
dataType: 'json',
data: {
action: 'um_tempfolder2024'
action: 'um_tempfolder2024',
nonce: um_admin_scripts.nonce
},
success: function( response ) {
if ( typeof response.data != 'undefined' ) {
includes/admin/templates/modal/dynamic_edit_field.php
+1
View File
@@ -11,6 +11,7 @@
<div class="um-admin-modal-foot">
<input type="submit" value="<?php _e('Update','ultimate-member'); ?>" class="button-primary" />
<input type="hidden" name="action" value="um_update_field" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<a href="#" data-action="UM_remove_modal" class="button"><?php _e('Cancel','ultimate-member'); ?></a>
</div>
includes/admin/templates/modal/dynamic_edit_row.php
+1
View File
@@ -11,6 +11,7 @@
<div class="um-admin-modal-foot">
<input type="submit" value="<?php _e('Update','ultimate-member'); ?>" class="button-primary" />
<input type="hidden" name="action" value="um_update_field" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<a href="#" data-action="UM_remove_modal" class="button"><?php _e('Cancel','ultimate-member'); ?></a>
</div>
includes/admin/templates/modal/dynamic_new_divider.php
+1
View File
@@ -11,6 +11,7 @@
<div class="um-admin-modal-foot">
<input type="submit" value="<?php _e('Add','ultimate-member'); ?>" class="button-primary" />
<input type="hidden" name="action" value="um_update_field" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<a href="#" data-action="UM_remove_modal" class="button"><?php _e('Cancel','ultimate-member'); ?></a>
</div>
includes/admin/templates/modal/dynamic_new_field.php
+1
View File
@@ -11,6 +11,7 @@
<div class="um-admin-modal-foot">
<input type="submit" value="<?php _e('Add','ultimate-member'); ?>" class="button-primary" />
<input type="hidden" name="action" value="um_update_field" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<a href="#" data-modal="UM_fields" class="button"><?php _e('Cancel','ultimate-member'); ?></a>
</div>
includes/admin/templates/modal/dynamic_new_group.php
+1
View File
@@ -11,6 +11,7 @@
<div class="um-admin-modal-foot">
<input type="submit" value="<?php _e('Add','ultimate-member'); ?>" class="button-primary" />
<input type="hidden" name="action" value="um_update_field" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<a href="#" data-action="UM_remove_modal" class="button"><?php _e('Cancel','ultimate-member'); ?></a>
</div>
includes/class-functions.php
+15
View File
@@ -16,6 +16,21 @@ if ( ! class_exists( 'UM_Functions' ) ) {
}
/**
* Check frontend nonce
*
* @param bool $action
*/
function check_ajax_nonce( $action = false ) {
$nonce = isset( $_POST['nonce'] ) ? $_POST['nonce'] : '';
$action = empty( $action ) ? 'um-frontend-nonce' : $action;
if ( ! wp_verify_nonce( $nonce, $action ) ) {
wp_send_json_error( esc_js( __( 'Wrong Nonce', 'ultimate-member' ) ) );
}
}
/**
* What type of request is this?
*
includes/core/class-enqueue.php
+3 -1
View File
@@ -129,7 +129,9 @@ if ( ! class_exists( 'um\core\Enqueue' ) ) {
* }
* ?>
*/
$localize_data = apply_filters( 'um_enqueue_localize_data', array() );
$localize_data = apply_filters( 'um_enqueue_localize_data', array(
'nonce' => wp_create_nonce( "um-frontend-nonce" ),
) );
wp_localize_script( 'um_scripts', 'um_scripts', $localize_data );
wp_register_script('um_members', $this->js_baseurl . 'um-members' . $this->suffix . '.js', array( 'jquery' ), ultimatemember_version, true );
includes/core/class-fields.php
+7 -3
View File
@@ -4059,21 +4059,25 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
*
*/
function do_ajax_action() {
if (!is_user_logged_in() || !current_user_can( 'manage_options' )) die( __( 'Please login as administrator', 'ultimate-member' ) );
UM()->admin()->check_ajax_nonce();
if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( __( 'Please login as administrator', 'ultimate-member' ) );
}
extract( $_POST );
$output = null;
$position = array();
if (!empty( $in_column )) {
if ( ! empty( $in_column ) ) {
$position['in_row'] = '_um_row_' . ( (int)$in_row + 1 );
$position['in_sub_row'] = $in_sub_row;
$position['in_column'] = $in_column;
$position['in_group'] = $in_group;
}
switch ($act_id) {
switch ( $act_id ) {
case 'um_admin_duplicate_field':
$this->duplicate_field( $arg1, $arg2 );
includes/core/class-files.php
+4
View File
@@ -241,6 +241,8 @@ if ( ! class_exists( 'um\core\Files' ) ) {
* Remove file by AJAX
*/
function ajax_remove_file() {
UM()->check_ajax_nonce();
/**
* @var $src
*/
@@ -255,6 +257,8 @@ if ( ! class_exists( 'um\core\Files' ) ) {
* Resize image AJAX handler
*/
function ajax_resize_image() {
UM()->check_ajax_nonce();
/**
* @var $key
* @var $src
includes/core/class-form.php
+3 -1
View File
@@ -50,6 +50,8 @@ if ( ! class_exists( 'um\core\Form' ) ) {
*
*/
function ajax_muted_action() {
UM()->check_ajax_nonce();
extract( $_REQUEST );
if ( ! UM()->roles()->um_current_user_can( 'edit', $user_id ) )
@@ -86,7 +88,7 @@ if ( ! class_exists( 'um\core\Form' ) ) {
*
*/
function ajax_select_options() {
UM()->check_ajax_nonce();
$arr_options = array();
$arr_options['status'] = 'success';
includes/core/class-profile.php
+4
View File
@@ -45,6 +45,8 @@ if ( ! class_exists( 'um\core\Profile' ) ) {
* Delete profile avatar AJAX handler
*/
function ajax_delete_profile_photo() {
UM()->check_ajax_nonce();
/**
* @var $user_id
*/
@@ -61,6 +63,8 @@ if ( ! class_exists( 'um\core\Profile' ) ) {
* Delete cover photo AJAX handler
*/
function ajax_delete_cover_photo() {
UM()->check_ajax_nonce();
/**
* @var $user_id
*/
includes/core/class-query.php
+2
View File
@@ -39,6 +39,8 @@ if ( ! class_exists( 'um\core\Query' ) ) {
* Ajax pagination for posts
*/
function ajax_paginate() {
UM()->check_ajax_nonce();
/**
* @var $hook
* @var $args
includes/core/class-user-posts.php
+2
View File
@@ -82,6 +82,8 @@ if ( ! class_exists( 'um\core\User_posts' ) ) {
*
*/
function load_posts() {
UM()->check_ajax_nonce();
$author = ! empty( $_POST['author'] ) ? $_POST['author'] : get_current_user_id();
$page = ! empty( $_POST['page'] ) ? $_POST['page'] : 0;
includes/core/class-user.php
+7 -2
View File
@@ -87,8 +87,11 @@ if ( ! class_exists( 'um\core\User' ) ) {
add_action( 'init', array( &$this, 'check_membership' ), 10 );
add_action( 'delete_user', array( &$this, 'delete_user_handler' ), 10, 1 );
add_action( 'wpmu_delete_user', array( &$this, 'delete_user_handler' ), 10, 1 );
if ( is_multisite() ) {
add_action( 'delete_user', array( &$this, 'delete_user_handler' ), 10, 1 );
} else {
add_action( 'wpmu_delete_user', array( &$this, 'delete_user_handler' ), 10, 1 );
}
}
@@ -96,6 +99,8 @@ if ( ! class_exists( 'um\core\User' ) ) {
* @param $user_id
*/
function delete_user_handler( $user_id ) {
error_log( '----------------' );
error_log( $user_id );
um_fetch_user( $user_id );
includes/core/um-actions-ajax.php
+2
View File
@@ -8,6 +8,8 @@ if ( ! defined( 'ABSPATH' ) ) exit;
* @return boolean
*/
function ultimatemember_check_username_exists() {
UM()->check_ajax_nonce();
$username = isset($_REQUEST['username']) ? $_REQUEST['username'] : '';
$exists = username_exists( $username );