- xss security fix;

includes/admin/templates/role/role-edit.php

@@ -77,34 +77,38 @@ if ( ! empty( $_POST['role'] ) ) {
 
 		$data = $_POST['role'];
 
-		if ( empty( $data['name'] ) ) {
+		if ( 'add' == $_GET['tab'] ) {
 
-			$error .= __( 'Title is empty!', 'ultimate-member' ) . '<br />';
+			$data['name'] = trim( esc_html( strip_tags( $data['name'] ) ) );
 
-		} else {
-
-			if ( 'add' == $_GET['tab'] ) {
-
-				if ( preg_match( "/[a-z0-9]+$/i", $data['name'] ) ) {
-					$id = sanitize_title( $data['name'] );
-				} else {
-					$auto_increment = UM()->options()->get( 'custom_roles_increment' );
-					$auto_increment = ! empty( $auto_increment ) ? $auto_increment : 1;
-					$id = 'custom_role_' . $auto_increment;
-				}
-
-				$redirect = add_query_arg( array( 'page'=>'um_roles', 'tab'=>'edit', 'id'=>$id, 'msg'=>'a' ), admin_url( 'admin.php' ) );
-			} elseif ( 'edit' == $_GET['tab'] && ! empty( $_GET['id'] ) ) {
-				$id = $_GET['id'];
-				$redirect = add_query_arg( array( 'page' => 'um_roles', 'tab'=>'edit', 'id'=>$id, 'msg'=>'u' ), admin_url( 'admin.php' ) );
+			if ( empty( $data['name'] ) ) {
+				$error .= __( 'Title is empty!', 'ultimate-member' ) . '<br />';
 			}
 
+			if ( preg_match( "/[a-z0-9]+$/i", $data['name'] ) ) {
+				$id = sanitize_title( $data['name'] );
+			} else {
+				$auto_increment = UM()->options()->get( 'custom_roles_increment' );
+				$auto_increment = ! empty( $auto_increment ) ? $auto_increment : 1;
+				$id = 'custom_role_' . $auto_increment;
+			}
+
+			$redirect = add_query_arg( array( 'page'=>'um_roles', 'tab'=>'edit', 'id'=>$id, 'msg'=>'a' ), admin_url( 'admin.php' ) );
+		} elseif ( 'edit' == $_GET['tab'] && ! empty( $_GET['id'] ) ) {
+			$id = $_GET['id'];
+
+			$pre_role_meta = get_option( "um_role_{$id}_meta", array() );
+			$data['name'] = $pre_role_meta['name'];
+
+			$redirect = add_query_arg( array( 'page' => 'um_roles', 'tab'=>'edit', 'id'=>$id, 'msg'=>'u' ), admin_url( 'admin.php' ) );
 		}
 
+
 		$all_roles = array_keys( get_editable_roles() );
 		if ( 'add' == $_GET['tab'] ) {
-			if ( in_array( 'um_' . $id, $all_roles ) || in_array( $id, $all_roles ) )
+			if ( in_array( 'um_' . $id, $all_roles ) || in_array( $id, $all_roles ) ) {
 				$error .= __( 'Role already exists!', 'ultimate-member' ) . '<br />';
+			}
 		}
 
 		if ( '' == $error ) {
@@ -186,7 +190,6 @@ $screen_id = $current_screen->id; ?>
 								<label for="title" class="screen-reader-text"><?php _e( 'Title', 'ultimate-member' ) ?></label>
 								<input type="text" name="role[name]" placeholder="<?php _e( 'Enter Title Here', 'ultimate-member' ) ?>" id="title" value="<?php echo isset( $data['name'] ) ? $data['name'] : '' ?>" />
 							<?php } else { ?>
-								<input type="hidden" name="role[name]" value="<?php echo isset( $data['name'] ) ? $data['name'] : '' ?>" />
 								<span style="float: left;width:100%;"><?php echo isset( $data['name'] ) ? $data['name'] : '' ?></span>
 							<?php } ?>
 						</div>

includes/core/um-actions-profile.php

@@ -1444,9 +1444,12 @@ function um_profile_menu( $args ) {
 			$active_subnav = ( UM()->profile()->active_subnav() ) ? UM()->profile()->active_subnav() : $tab['subnav_default']; ?>
 
 			<div class="um-profile-subnav">
-				<?php foreach ( $tab['subnav'] as $id_s => $subtab ) { ?>
+				<?php foreach ( $tab['subnav'] as $id_s => $subtab ) {
 
-					<a href="<?php echo add_query_arg( 'subnav', $id_s ); ?>" class="<?php if ( $active_subnav == $id_s ) echo 'active'; ?>">
+					$subnav_link = add_query_arg( 'subnav', $id_s );
+					$subnav_link = apply_filters( 'um_user_profile_subnav_link', $subnav_link, $id_s, $subtab ); ?>
+
+					<a href="<?php echo $subnav_link; ?>" class="<?php if ( $active_subnav == $id_s ) echo 'active'; ?>">
 						<?php echo $subtab; ?>
 					</a>
 

includes/core/um-filters-account.php

@@ -59,4 +59,21 @@ function um_account_disable_name_fields( $fields ){
 	return $fields;
 }
 add_filter( "um_get_field__first_name","um_account_disable_name_fields", 10 ,1 );
-add_filter( "um_get_field__last_name","um_account_disable_name_fields", 10 ,1 );
+add_filter( "um_get_field__last_name","um_account_disable_name_fields", 10 ,1 );
+
+
+/**
+ * Sanitize inputs on Account update
+ *
+ * @param $data
+ *
+ * @return mixed
+ */
+function um_account_sanitize_data( $data ) {
+	foreach ( $data as $key => $value ) {
+		$data[ $key ] = trim( esc_html( strip_tags( $value ) ) );
+	}
+
+	return $data;
+}
+add_filter( 'um_account_pre_updating_profile_array', 'um_account_sanitize_data', 10, 1 );

readme.txt

@@ -6,7 +6,7 @@ Donate link:
 Tags: community, member, membership, user-profile, user-registration
 Requires at least: 4.9
 Tested up to: 5.2
-Stable tag: 2.0.51
+Stable tag: 2.0.52
 License: GNU Version 2 or Any Later Version
 License URI: http://www.gnu.org/licenses/gpl-3.0.txt
 
@@ -137,6 +137,15 @@ The plugin works with popular caching plugins by automatically excluding Ultimat
 
 = Important: UM2.0+ is a significant update to the code base from 1.3.88. Please make sure you take a full-site backup with restore point before updating the plugin =
 
+= 2.0.52: July 11, 2019 =
+
+* Enhancements:
+  - Extended hooks for 3rd party integrations
+
+* Bugfixes:
+  - Fixed UM Roles create/edit XSS security issue
+  - Fixed XSS security issue on account upgrade
+
 = 2.0.51: July 09, 2019 =
 
 * Bugfixes:

ultimate-member.php

@@ -3,7 +3,7 @@
 Plugin Name: Ultimate Member
 Plugin URI: http://ultimatemember.com/
 Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress
-Version: 2.0.51
+Version: 2.0.52
 Author: Ultimate Member
 Author URI: http://ultimatemember.com/
 Text Domain: ultimate-member