10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-17 13:43:38 +09:00
Code Issues Packages Projects Releases Wiki Activity

Refactor password handling to bypass wp_unslash.

Browse Source 
Introduce a dedicated method to handle password fields securely, avoiding `wp_unslash` for these fields. This enhances consistency and security when processing form data across the plugin.
This commit is contained in:
Mykyta Synelnikov
2025-02-12 17:47:19 +02:00
parent cbc8c24b35
commit 422d2b7c67
3 changed files with 102 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-password.php
+7 -6
View File
@@ -339,12 +339,13 @@ if ( ! class_exists( 'um\core\Password' ) ) {
if ( $this->is_change_request() ) {
$formdata = wp_unslash( $_POST );
if ( isset( $_POST['user_password'] ) ) {
$formdata['user_password'] = trim( $_POST['user_password'] );
}
if ( isset( $_POST['confirm_user_password'] ) ) {
$formdata['confirm_user_password'] = trim( $_POST['confirm_user_password'] );
}
// Don't un-slash passwords in manner of WordPress native password field.
$fields_map = array(
'user_password',
'confirm_user_password',
);
$formdata = UM()->form()::ignore_formdata_unslash( $formdata, $fields_map );
UM()->form()->post_form = $formdata;