10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-11 18:56:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1491 from ultimatemember/security/CVE-2024-2765

Browse Source 
CVE 2024 2765
This commit is contained in:
Mykyta Synelnikov
2024-04-02 17:30:11 +03:00
committed by GitHub
parent a4d20fe4fd d48bcac683
commit 3a36d9df47
9 changed files with 44 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-external-integrations.php
+1 -1
View File
@@ -604,7 +604,7 @@ if ( ! class_exists( 'um\core\External_Integrations' ) ) {
*/
function render_status_icon( $link, $text, $img ) {
$icon_html = '<a href="' . $link . '" title="' . $text . '">';
$icon_html = '<a href="' . esc_url( $link ) . '" title="' . esc_attr( $text ) . '">';
$icon_html .= '<img style="padding:1px;margin:2px;" border="0" src="'
. ICL_PLUGIN_URL . '/res/img/'
. $img . '" alt="'
includes/core/class-fields.php
+1 -1
View File
@@ -3098,7 +3098,7 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$fonticon = UM()->files()->get_fonticon_by_ext( $file_type['ext'] );
$output .= '<div class="um-single-fileinfo">';
$output .= '<a href="' . esc_attr( $file_url ) . '" target="_blank">';
$output .= '<a href="' . esc_url( $file_url ) . '" target="_blank">';
$output .= '<span class="icon" style="background:' . esc_attr( $fonticon_bg ) . '"><i class="' . esc_attr( $fonticon ) . '"></i></span>';
$output .= '<span class="filename">' . esc_html( $file_field_name ) . '</span>';
$output .= '</a></div></div>';
includes/core/um-actions-account.php
+1 -1
View File
@@ -624,7 +624,7 @@ function um_after_account_privacy( $args ) {
$exports_url = wp_privacy_exports_url();
echo '<p>' . esc_html__( 'You could download your previous data:', 'ultimate-member' ) . '</p>';
echo '<a href="' . esc_attr( $exports_url . get_post_meta( $completed['ID'], '_export_file_name', true ) ) . '">' . esc_html__( 'Download Personal Data', 'ultimate-member' ) . '</a>';
echo '<a href="' . esc_url( $exports_url . get_post_meta( $completed['ID'], '_export_file_name', true ) ) . '">' . esc_html__( 'Download Personal Data', 'ultimate-member' ) . '</a>';
echo '<p>' . esc_html__( 'You could send a new request for an export of personal your data.', 'ultimate-member' ) . '</p>';
}
includes/core/um-filters-commenting.php
+19 -18
View File
@@ -1,37 +1,38 @@
<?php if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
<?php
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
/**
* Control comment author display
* Control comment author display.
*
* @param $return
* @param $author
* @param $comment_ID
* @param string $return The HTML-formatted comment author link.
* @param string $author The comment author's username.
* @param string $comment_id The comment ID as a numeric string.
*
* @return string
*/
function um_comment_link_to_profile( $return, $author, $comment_ID ) {
function um_comment_link_to_profile( $return, $author, $comment_id ) {
$comment = get_comment( $comment_id );
$comment = get_comment( $comment_ID );
if( isset( $comment->user_id ) && ! empty( $comment->user_id ) ){
if ( ! empty( $comment->user_id ) ) {
if ( isset( UM()->user()->cached_user[ $comment->user_id ] ) && UM()->user()->cached_user[ $comment->user_id ] ) {
$return = '<a href="'. UM()->user()->cached_user[$comment->user_id]['url'] . '">' . UM()->user()->cached_user[$comment->user_id]['name'] . '</a>';
$return = '<a href="' . esc_url( UM()->user()->cached_user[ $comment->user_id ]['url'] ) . '">' . UM()->user()->cached_user[ $comment->user_id ]['name'] . '</a>';
} else {
um_fetch_user( $comment->user_id );
UM()->user()->cached_user[ $comment->user_id ] = array('url' => um_user_profile_url(), 'name' => um_user('display_name') );
$return = '<a href="'. UM()->user()->cached_user[$comment->user_id]['url'] . '">' . UM()->user()->cached_user[$comment->user_id]['name'] . '</a>';
UM()->user()->cached_user[ $comment->user_id ] = array(
'url' => um_user_profile_url(),
'name' => um_user( 'display_name' ),
);
$return = '<a href="' . esc_url( UM()->user()->cached_user[ $comment->user_id ]['url'] ) . '">' . UM()->user()->cached_user[ $comment->user_id ]['name'] . '</a>';
um_reset_user();
}
}
return $return;
}
add_filter('get_comment_author_link', 'um_comment_link_to_profile', 10000, 3 );
add_filter( 'get_comment_author_link', 'um_comment_link_to_profile', 10000, 3 );
includes/core/um-filters-fields.php
+14 -12
View File
@@ -96,7 +96,7 @@ add_filter( 'um_profile_field_filter_hook__youtube_video', 'um_profile_field_fil
function um_profile_field_filter_hook__spotify( $value, $data ) {
if ( preg_match( '/https:\/\/open.spotify.com\/.*/', $value ) ) {
if ( false !== strpos( $value, '/user/' ) ) {
$value = '<a href="' . esc_attr( $value ) . '" target="_blank">' . esc_html( $value ) . '</a>';
$value = '<a href="' . esc_url( $value ) . '" target="_blank">' . esc_html( $value ) . '</a>';
} else {
$url = str_replace( 'open.spotify.com/', 'open.spotify.com/embed/', $value );
@@ -144,12 +144,10 @@ add_filter( 'um_profile_field_filter_hook__vimeo_video', 'um_profile_field_filte
* @return int|string
*/
function um_profile_field_filter_hook__phone( $value, $data ) {
$value = '<a href="tel:' . esc_attr( $value ) . '" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
$value = '<a href="' . esc_url( 'tel:' . $value ) . '" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
return $value;
}
add_filter( 'um_profile_field_filter_hook__phone_number', 'um_profile_field_filter_hook__phone', 99, 2 );
add_filter( 'um_profile_field_filter_hook__mobile_number', 'um_profile_field_filter_hook__phone', 99, 2 );
add_filter( 'um_profile_field_filter_hook__tel', 'um_profile_field_filter_hook__phone', 99, 2 );
/**
* Outputs a viber link
@@ -160,8 +158,9 @@ add_filter( 'um_profile_field_filter_hook__mobile_number', 'um_profile_field_fil
* @return int|string
*/
function um_profile_field_filter_hook__viber( $value, $data ) {
$value = str_replace('+', '', $value);
$value = '<a href="viber://chat?number=%2B' . esc_attr( $value ) . '" target="_blank" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
$value = str_replace( '+', '', $value );
$url = 'viber://chat?number=%2B' . $value;
$value = '<a href="' . esc_url( $url, array( 'viber' ) ) . '" target="_blank" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
return $value;
}
add_filter( 'um_profile_field_filter_hook__viber', 'um_profile_field_filter_hook__viber', 99, 2 );
@@ -176,8 +175,9 @@ add_filter( 'um_profile_field_filter_hook__viber', 'um_profile_field_filter_hook
* @return int|string
*/
function um_profile_field_filter_hook__whatsapp( $value, $data ) {
$value = str_replace('+', '', $value);
$value = '<a href="https://api.whatsapp.com/send?phone=' . esc_attr( $value ) . '" target="_blank" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
$value = str_replace( '+', '', $value );
$url = add_query_arg( array( 'phone' => $value ), 'https://api.whatsapp.com/send' );
$value = '<a href="' . esc_url( $url ) . '" target="_blank" rel="nofollow" title="' . esc_attr( $data['title'] ) . '">' . esc_html( $value ) . '</a>';
return $value;
}
add_filter( 'um_profile_field_filter_hook__whatsapp', 'um_profile_field_filter_hook__whatsapp', 99, 2 );
@@ -373,7 +373,7 @@ function um_profile_field_filter_hook__file( $value, $data ) {
}
$value = '<div class="um-single-file-preview show">
<div class="um-single-fileinfo">
<a href="' . esc_attr( $uri ) . '" target="_blank">
<a href="' . esc_url( $uri ) . '" target="_blank">
<span class="icon" style="background:'. UM()->files()->get_fonticon_bg_by_ext( $file_type['ext'] ) . '"><i class="'. UM()->files()->get_fonticon_by_ext( $file_type['ext'] ) .'"></i></span>
<span class="filename">' . esc_attr( $value ) . '</span>
</a>
@@ -447,11 +447,13 @@ function um_profile_field_filter_hook__( $value, $data, $type = '' ) {
$url_rel = ( isset( $data['url_rel'] ) && 'nofollow' === $data['url_rel'] ) ? 'rel="nofollow"' : '';
$data['url_target'] = ( isset( $data['url_target'] ) ) ? $data['url_target'] : '_blank';
$protocols = wp_allowed_protocols();
if ( false === strstr( $value, 'join.skype.com' ) ) {
$value = 'skype:' . $value . '?chat';
$protocols[] = 'skype';
}
$value = '<a href="' . esc_attr( $value ) . '" title="' . esc_attr( $alt ) . '" target="' . esc_attr( $data['url_target'] ) . '" ' . $url_rel . '>' . esc_html( $alt ) . '</a>';
$value = '<a href="' . esc_url( $value, $protocols ) . '" title="' . esc_attr( $alt ) . '" target="' . esc_attr( $data['url_target'] ) . '" ' . $url_rel . '>' . esc_html( $alt ) . '</a>';
} else {
// check $value is oEmbed
if ( 'oembed' === $data['type'] ) {
@@ -527,7 +529,7 @@ function um_profile_field_filter_hook__( $value, $data, $type = '' ) {
if ( ! is_array( $value ) ) {
if ( is_email( $value ) ) {
$value = '<a href="mailto:' . $value . '" title="' . $value . '">' . $value . '</a>';
$value = '<a href="' . esc_url( 'mailto:' . $value ) . '" title="' . $value . '">' . $value . '</a>';
}
} else {
$value = implode( ', ', $value );