10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-20 15:13:55 +09:00
Code Issues Packages Projects Releases Wiki Activity

* fixed CVE-2024-12276;

Browse Source 
* reviewed using $wpdb and WPCS;
* set minimum required version to 6.2 due to using %i for $wpdb->prepare;
This commit is contained in:
Mykyta Synelnikov
2025-02-03 16:17:37 +02:00
parent 26c8aa21e1
commit 4adbe19cbe
19 changed files with 249 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-access.php
+14 -13
View File
@@ -969,13 +969,15 @@ if ( ! class_exists( 'um\core\Access' ) ) {
$restricted_posts = array_unique( $restricted_posts );
foreach ( $restricted_posts as $k => $post_type ) {
if ( 'closed' === get_default_comment_status( $post_type ) ) {
$open_comments = $wpdb->get_var( $wpdb->prepare(
"SELECT ID
FROM {$wpdb->posts}
WHERE post_type = %s AND
comment_status != 'closed'",
$post_type
) );
$open_comments = $wpdb->get_var(
$wpdb->prepare(
"SELECT ID
FROM {$wpdb->posts}
WHERE post_type = %s AND
comment_status != 'closed'",
$post_type
)
);
if ( empty( $open_comments ) ) {
unset( $restricted_posts[ $k ] );
@@ -1070,12 +1072,11 @@ if ( ! class_exists( 'um\core\Access' ) ) {
}
$totals = (array) $wpdb->get_results(
"
SELECT comment_approved, COUNT( * ) AS total
FROM {$wpdb->comments}
{$where}
GROUP BY comment_approved
",
"SELECT comment_approved,
COUNT(*) AS total
FROM {$wpdb->comments}
{$where}
GROUP BY comment_approved",
ARRAY_A
);
includes/core/class-member-directory-meta.php
+1 -1
View File
@@ -169,7 +169,7 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) {
"SELECT umeta_id
FROM {$wpdb->prefix}um_metadata
WHERE user_id = %d AND
um_key = %s
um_key = %s
LIMIT 1",
$object_id,
$meta_key
includes/core/class-member-directory.php
+22 -31
View File
@@ -969,14 +969,17 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
default: {
$meta = $wpdb->get_row( $wpdb->prepare(
"SELECT MIN( CONVERT( meta_value, DECIMAL ) ) as min_meta,
MAX( CONVERT( meta_value, DECIMAL ) ) as max_meta,
COUNT( DISTINCT meta_value ) as amount
FROM {$wpdb->usermeta}
WHERE meta_key = %s",
$filter
), ARRAY_A );
$meta = $wpdb->get_row(
$wpdb->prepare(
"SELECT MIN( CONVERT( meta_value, DECIMAL ) ) as min_meta,
MAX( CONVERT( meta_value, DECIMAL ) ) as max_meta,
COUNT( DISTINCT meta_value ) as amount
FROM {$wpdb->usermeta}
WHERE meta_key = %s",
$filter
),
ARRAY_A
);
if ( isset( $meta['min_meta'] ) && isset( $meta['max_meta'] ) && isset( $meta['amount'] ) && $meta['amount'] > 1 ) {
$range = array( (float) $meta['min_meta'], (float) $meta['max_meta'] );
@@ -988,24 +991,6 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
break;
}
case 'birth_date': {
// $meta = $wpdb->get_col(
// "SELECT meta_value
// FROM {$wpdb->usermeta}
// WHERE meta_key = 'birth_date' AND
// meta_value != ''"
// );
//
// if ( empty( $meta ) || count( $meta ) < 2 ) {
// $range = false;
// } elseif ( is_array( $meta ) ) {
// $birth_dates = array_filter( array_map( 'strtotime', $meta ), 'is_numeric' );
// sort( $birth_dates );
// $min_meta = array_shift( $birth_dates );
// $max_meta = array_pop( $birth_dates );
// $range = array( $this->borndate( $max_meta ), $this->borndate( $min_meta ) );
// }
$meta = $wpdb->get_row(
"SELECT MIN( meta_value ) as min_meta,
MAX( meta_value ) as max_meta,
@@ -1013,7 +998,8 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
FROM {$wpdb->usermeta}
WHERE meta_key = 'birth_date' AND
meta_value != ''",
ARRAY_A );
ARRAY_A
);
if ( isset( $meta['min_meta'] ) && isset( $meta['max_meta'] ) && isset( $meta['amount'] ) && $meta['amount'] > 1 ) {
$range = array( $this->borndate( strtotime( $meta['max_meta'] ) ), $this->borndate( strtotime( $meta['min_meta'] ) ) );
@@ -1082,10 +1068,15 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
switch ( $filter ) {
default:
global $wpdb;
$meta = $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT meta_value
FROM {$wpdb->usermeta}
WHERE meta_key = %s
ORDER BY meta_value DESC", $filter ) );
$meta = $wpdb->get_col(
$wpdb->prepare(
"SELECT DISTINCT meta_value
FROM {$wpdb->usermeta}
WHERE meta_key = %s
ORDER BY meta_value DESC",
$filter
)
);
if ( empty( $meta ) || count( $meta ) === 1 ) {
$range = false;
includes/core/class-query.php
+3 -4
View File
@@ -89,13 +89,12 @@ if ( ! class_exists( 'um\core\Query' ) ) {
"SELECT *
FROM {$wpdb->posts}
WHERE post_type = 'page' AND
post_status = 'publish'",
OBJECT
post_status = 'publish'"
);
$array = array();
if( $wpdb->num_rows > 0 ){
foreach ($pages as $page_data) {
if ( $wpdb->num_rows > 0 ) {
foreach ( $pages as $page_data ) {
$array[ $page_data->ID ] = $page_data->post_title;
}
}
includes/core/class-uploader.php
+12 -5
View File
@@ -1379,16 +1379,23 @@ if ( ! class_exists( 'um\core\Uploader' ) ) {
foreach ( $files as $file ) {
$str = basename( $file );
if ( strstr( $str, 'profile_photo' ) || strstr( $str, 'cover_photo' ) || preg_grep( '/' . $str . '/', $_array ) ) {
if ( false !== strpos( $str, 'profile_photo' ) || false !== strpos( $str, 'cover_photo' ) || preg_grep( '/' . $str . '/', $_array ) ) {
continue;
}
// Don't delete photo that belongs to the Social Activity post or Groups post
if ( strstr( $str, 'stream_photo' ) ) {
if ( false !== strpos( $str, 'stream_photo' ) ) {
global $wpdb;
$is_post_image = $wpdb->get_var( "
SELECT COUNT(*) FROM {$wpdb->postmeta}
WHERE `meta_key`='_photo' AND `meta_value`='{$str}';" );
$is_post_image = $wpdb->get_var(
$wpdb->prepare(
"SELECT COUNT(*)
FROM {$wpdb->postmeta}
WHERE meta_key = '_photo' AND
meta_value = %s",
$str
)
);
if ( $is_post_image ) {
continue;
}
includes/core/class-user-posts.php
+9 -1
View File
@@ -211,7 +211,15 @@ if ( ! class_exists( 'um\core\User_posts' ) ) {
return 0;
}
$count = $wpdb->get_var("SELECT COUNT(comment_ID) FROM " . $wpdb->comments. " WHERE user_id = " . $user_id . " AND comment_approved = '1'");
$count = $wpdb->get_var(
$wpdb->prepare(
"SELECT COUNT(comment_ID)
FROM {$wpdb->comments}
WHERE user_id = %d AND
comment_approved = '1'",
$user_id
)
);
return $this->pretty_number_formatting( $count );
}
includes/core/rest/class-api-v1.php
+10 -8
View File
@@ -110,14 +110,16 @@ if ( ! class_exists( 'um\core\rest\API_v1' ) ) {
$user = get_transient( md5( 'um_api_user_' . $key ) );
if ( false === $user ) {
$user = $wpdb->get_var( $wpdb->prepare(
"SELECT user_id
FROM $wpdb->usermeta
WHERE meta_key = 'um_user_public_key' AND
meta_value = %s
LIMIT 1",
$key
) );
$user = $wpdb->get_var(
$wpdb->prepare(
"SELECT user_id
FROM $wpdb->usermeta
WHERE meta_key = 'um_user_public_key' AND
meta_value = %s
LIMIT 1",
$key
)
);
set_transient( md5( 'um_api_user_' . $key ) , $user, DAY_IN_SECONDS );
}
includes/core/rest/class-api-v2.php
+10 -8
View File
@@ -109,14 +109,16 @@ if ( ! class_exists( 'um\core\rest\API_v2' ) ) {
$user = get_transient( md5( 'um_api_user_' . $key ) );
if ( false === $user ) {
$user = $wpdb->get_var( $wpdb->prepare(
"SELECT user_id
FROM $wpdb->usermeta
WHERE meta_key = 'um_user_public_key' AND
meta_value = %s
LIMIT 1",
$key
) );
$user = $wpdb->get_var(
$wpdb->prepare(
"SELECT user_id
FROM $wpdb->usermeta
WHERE meta_key = 'um_user_public_key' AND
meta_value = %s
LIMIT 1",
$key
)
);
set_transient( md5( 'um_api_user_' . $key ) , $user, DAY_IN_SECONDS );
}