10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-17 13:43:38 +09:00
Code Issues Packages Projects Releases Wiki Activity

- fixed some vulnerabilities with includes shortcode template files;

Browse Source
This commit is contained in:
nikitozzzzzzz
2018-01-11 11:48:47 +08:00
parent 9da2a73bb9
commit 55913212c8
2 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-shortcodes.php
+38 -27
View File
@@ -138,30 +138,38 @@ if ( ! class_exists( 'Shortcodes' ) ) {
return $form_id;
}
/***
*** @load a compatible template
*/
function load_template($tpl) {
$loop = ($this->loop) ? $this->loop : array();
if (isset($this->set_args) && is_array($this->set_args)) {
$args = $this->set_args;
extract($args);
}
/**
* load a compatible template
*
* @param $tpl
*/
function load_template( $tpl ) {
$file = um_path . 'templates/' . $tpl . '.php';
$theme_file = get_stylesheet_directory() . '/ultimate-member/templates/' . $tpl . '.php';
if (file_exists($theme_file)) {
$theme_file = get_stylesheet_directory() . '/ultimate-member/templates/' . $tpl . '.php';
if ( file_exists( $theme_file ) ) {
$file = $theme_file;
}
if (file_exists($file)) {
include $file;
}
if ( file_exists( $file ) ) {
$loop = ( $this->loop ) ? $this->loop : array();
if ( isset( $this->set_args ) && is_array( $this->set_args ) ) {
$args = $this->set_args;
/**
* @var $tpl
*/
extract( $args );
}
include $file;
}
}
/***
*** @Add class based on shortcode
*/
@@ -204,19 +212,19 @@ if ( ! class_exists( 'Shortcodes' ) ) {
'show_lock' => 'yes',
);
$args = wp_parse_args($args, $defaults);
$args = wp_parse_args( $args, $defaults );
$args['lock_text'] = $this->convert_locker_tags($args['lock_text']);
$args['lock_text'] = $this->convert_locker_tags( $args['lock_text'] );
if (!is_user_logged_in()) {
if ($args['show_lock'] == 'no') {
if ( ! is_user_logged_in() ) {
if ( $args['show_lock'] == 'no' ) {
echo '';
} else {
UM()->shortcodes()->set_args = $args;
UM()->shortcodes()->load_template('login-to-view');
$this->set_args = $args;
$this->load_template( 'login-to-view' );
}
} else {
echo do_shortcode($this->convert_locker_tags(wpautop($content)));
echo do_shortcode( $this->convert_locker_tags( wpautop( $content ) ) );
}
$output = ob_get_contents();
@@ -384,14 +392,17 @@ if ( ! class_exists( 'Shortcodes' ) ) {
}
/***
*** @Loads a template file
*/
/**
* Loads a template file
*
* @param $template
* @param array $args
*/
function template_load( $template, $args = array() ) {
if ( is_array( $args ) ) {
UM()->shortcodes()->set_args = $args;
$this->set_args = $args;
}
UM()->shortcodes()->load_template( $template );
$this->load_template( $template );
}