From 19ffd41e225eb58913a57f2f1fef6cdd85c336c4 Mon Sep 17 00:00:00 2001
From: nikitasinelnikov <nsinelnikov.work@gmail.com>
Date: Mon, 11 Mar 2019 16:01:11 +0200
Subject: [PATCH] - update account issue;

---
 includes/core/class-account.php      | 36 +++++++++++++++++++++-------
 includes/core/um-actions-account.php |  7 +++++-
 2 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/includes/core/class-account.php b/includes/core/class-account.php
index bc82e29a..99eddf23 100644
--- a/includes/core/class-account.php
+++ b/includes/core/class-account.php
@@ -364,14 +364,13 @@ if ( ! class_exists( 'um\core\Account' ) ) {
 				 */
 				do_action( 'um_submit_account_errors_hook', UM()->form()->post_form );
 
+				if ( um_is_core_page( 'account' ) && get_query_var( 'um_tab' ) ) {
+					$this->current_tab = get_query_var( 'um_tab' );
+				} else {
+					$this->current_tab = UM()->form()->post_form['_um_account_tab'];
+				}
+
 				if ( ! isset( UM()->form()->errors ) ) {
-
-					if ( um_is_core_page( 'account' ) && get_query_var( 'um_tab' ) ) {
-						$this->current_tab = get_query_var( 'um_tab' );
-					} else {
-						$this->current_tab = UM()->form()->post_form['_um_account_tab'];
-					}
-
 					/**
 					 * UM hook
 					 *
@@ -393,6 +392,25 @@ if ( ! class_exists( 'um\core\Account' ) ) {
 					 */
 					do_action( 'um_submit_account_details', UM()->form()->post_form );
 
+				} elseif ( UM()->form()->has_error( 'um_account_security' ) ) {
+					$url = '';
+					if ( um_is_core_page( 'account' ) ) {
+
+						$url = UM()->account()->tab_link( $this->current_tab );
+
+						$url = add_query_arg( 'err', 'account', $url );
+
+						if ( function_exists( 'icl_get_current_language' ) ) {
+							if ( icl_get_current_language() != icl_get_default_language() ) {
+								$url = UM()->permalinks()->get_current_url( true );
+								$url = add_query_arg( 'err', 'account', $url );
+
+								exit( wp_redirect( $url ) );
+							}
+						}
+					}
+
+					exit( wp_redirect( $url ) );
 				}
 
 			}
@@ -759,7 +777,9 @@ if ( ! class_exists( 'um\core\Account' ) ) {
 
 					<div class="um-col-alt um-col-alt-b">
 						<div class="um-left">
-							<input type="submit" name="um_account_submit" id="um_account_submit_<?php echo $tab_id ?>"  class="um-button" value="<?php echo ! empty( $tab_data['submit_title'] ) ? $tab_data['submit_title'] : $tab_data['title']; ?>" />
+							<?php $submit_title = ! empty( $tab_data['submit_title'] ) ? $tab_data['submit_title'] : $tab_data['title']; ?>
+							<input type="hidden" name="um_account_nonce_<?php echo esc_attr( $tab_id ) ?>" value="<?php echo esc_attr( wp_create_nonce( 'um_update_account_' . $tab_id ) ) ?>" />
+							<input type="submit" name="um_account_submit" id="um_account_submit_<?php echo $tab_id ?>"  class="um-button" value="<?php echo esc_attr( $submit_title ) ?>" />
 						</div>
 
 						<?php
diff --git a/includes/core/um-actions-account.php b/includes/core/um-actions-account.php
index 8ee00b93..0552ccad 100644
--- a/includes/core/um-actions-account.php
+++ b/includes/core/um-actions-account.php
@@ -9,8 +9,13 @@ if ( ! defined( 'ABSPATH' ) ) exit;
  */
 function um_submit_account_errors_hook( $args ) {
 
-	if ( ! isset( $_POST['um_account_submit'] ) )
+	if ( ! isset( $_POST['um_account_submit'] ) ) {
 		return;
+	}
+
+	if ( ! wp_verify_nonce( $_POST[ 'um_account_nonce_' . $_POST['_um_account_tab'] ], 'um_update_account_' . $_POST['_um_account_tab'] ) ) {
+		UM()->form()->add_error('um_account_security', __( 'Are you hacking? Please try again!', 'ultimate-member' ) );
+	}
 
 	$user = get_user_by( 'login', um_user( 'user_login' ) );