From 55913212c87a6c556f51a556deca89b77ff37e55 Mon Sep 17 00:00:00 2001 From: nikitozzzzzzz Date: Thu, 11 Jan 2018 11:48:47 +0800 Subject: [PATCH 1/4] - fixed some vulnerabilities with includes shortcode template files; --- includes/core/class-members.php | 4 ++ includes/core/class-shortcodes.php | 65 +++++++++++++++++------------- 2 files changed, 42 insertions(+), 27 deletions(-) diff --git a/includes/core/class-members.php b/includes/core/class-members.php index f87d3f9c..bbecdbd4 100644 --- a/includes/core/class-members.php +++ b/includes/core/class-members.php @@ -177,6 +177,10 @@ if ( ! class_exists( 'Members' ) ) { global $wpdb, $post; + /** + * @var $profiles_per_page + * @var $profiles_per_page_mobile + */ extract($args); $query_args = array(); diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php index 7550907b..2b31a859 100644 --- a/includes/core/class-shortcodes.php +++ b/includes/core/class-shortcodes.php @@ -138,30 +138,38 @@ if ( ! class_exists( 'Shortcodes' ) ) { return $form_id; } - /*** - *** @load a compatible template - */ - function load_template($tpl) { - $loop = ($this->loop) ? $this->loop : array(); - - if (isset($this->set_args) && is_array($this->set_args)) { - $args = $this->set_args; - extract($args); - } + /** + * load a compatible template + * + * @param $tpl + */ + function load_template( $tpl ) { $file = um_path . 'templates/' . $tpl . '.php'; - $theme_file = get_stylesheet_directory() . '/ultimate-member/templates/' . $tpl . '.php'; - if (file_exists($theme_file)) { + $theme_file = get_stylesheet_directory() . '/ultimate-member/templates/' . $tpl . '.php'; + if ( file_exists( $theme_file ) ) { $file = $theme_file; } - if (file_exists($file)) { - include $file; - } + if ( file_exists( $file ) ) { + $loop = ( $this->loop ) ? $this->loop : array(); + + if ( isset( $this->set_args ) && is_array( $this->set_args ) ) { + $args = $this->set_args; + + /** + * @var $tpl + */ + extract( $args ); + } + + include $file; + } } + /*** *** @Add class based on shortcode */ @@ -204,19 +212,19 @@ if ( ! class_exists( 'Shortcodes' ) ) { 'show_lock' => 'yes', ); - $args = wp_parse_args($args, $defaults); + $args = wp_parse_args( $args, $defaults ); - $args['lock_text'] = $this->convert_locker_tags($args['lock_text']); + $args['lock_text'] = $this->convert_locker_tags( $args['lock_text'] ); - if (!is_user_logged_in()) { - if ($args['show_lock'] == 'no') { + if ( ! is_user_logged_in() ) { + if ( $args['show_lock'] == 'no' ) { echo ''; } else { - UM()->shortcodes()->set_args = $args; - UM()->shortcodes()->load_template('login-to-view'); + $this->set_args = $args; + $this->load_template( 'login-to-view' ); } } else { - echo do_shortcode($this->convert_locker_tags(wpautop($content))); + echo do_shortcode( $this->convert_locker_tags( wpautop( $content ) ) ); } $output = ob_get_contents(); @@ -384,14 +392,17 @@ if ( ! class_exists( 'Shortcodes' ) ) { } - /*** - *** @Loads a template file - */ + /** + * Loads a template file + * + * @param $template + * @param array $args + */ function template_load( $template, $args = array() ) { if ( is_array( $args ) ) { - UM()->shortcodes()->set_args = $args; + $this->set_args = $args; } - UM()->shortcodes()->load_template( $template ); + $this->load_template( $template ); } From 0bdb285b59c21eb7bed5e36552b2aab42434a438 Mon Sep 17 00:00:00 2001 From: nikitozzzzzzz Date: Thu, 11 Jan 2018 12:17:26 +0800 Subject: [PATCH 2/4] - fixed division by zero issue in some cases; --- includes/core/class-members.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/core/class-members.php b/includes/core/class-members.php index bbecdbd4..58700fe5 100644 --- a/includes/core/class-members.php +++ b/includes/core/class-members.php @@ -226,7 +226,11 @@ if ( ! class_exists( 'Members' ) ) { $array['page'] = $members_page; - $array['total_pages'] = ceil( $array['total_users'] / $profiles_per_page ); + if ( isset( $profiles_per_page ) && $profiles_per_page > 0 ) { + $array['total_pages'] = ceil( $array['total_users'] / $profiles_per_page ); + } else { + $array['total_pages'] = 1; + } $array['header'] = $this->convert_tags( $header, $array ); $array['header_single'] = $this->convert_tags( $header_single, $array ); From 03c65a82916db21d89166dcd91042abbf481e0c1 Mon Sep 17 00:00:00 2001 From: Denis Baranov Date: Fri, 12 Jan 2018 11:07:15 +0200 Subject: [PATCH 3/4] - fixed RTL styles --- assets/css/um-responsive.css | 10 ++++++++++ assets/css/um.rtl.css | 7 ++++++- includes/admin/core/class-admin-settings.php | 4 ++-- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/assets/css/um-responsive.css b/assets/css/um-responsive.css index 6c4450c3..c125e09b 100644 --- a/assets/css/um-responsive.css +++ b/assets/css/um-responsive.css @@ -656,6 +656,16 @@ div.uimob960 .um-search .um-search-submit .um-button.um-alt {float: right} div.uimob960 .um-member {width: 48%} div.uimob960 .um-gutter-sizer {width: 4%} +div.uimob960 .um-profile-photo { + width: 200px !important; +} + +div.uimob960 .um-profile-photo a.um-profile-photo-img { + width: 140px !important; + height: 140px !important; + top: -70px !important; +} + /************************************************/ @media screen and (max-height: 400px) { diff --git a/assets/css/um.rtl.css b/assets/css/um.rtl.css index 21d01a68..6710d105 100644 --- a/assets/css/um.rtl.css +++ b/assets/css/um.rtl.css @@ -13,15 +13,20 @@ right: 30px; } +div.uimob500 .um-profile-photo a.um-profile-photo-img { + right: auto; +} + .um-profile-edit { right: auto; left: 10px; padding-left: 10px; } +div.uimob960 .um-header .um-profile-meta, div.uimob800 .um-header .um-profile-meta { padding-left: 0 !important; - padding-right: 200px !important; + padding-right: 200px !important; } .um-name { diff --git a/includes/admin/core/class-admin-settings.php b/includes/admin/core/class-admin-settings.php index 69950103..37b3455d 100644 --- a/includes/admin/core/class-admin-settings.php +++ b/includes/admin/core/class-admin-settings.php @@ -485,12 +485,12 @@ if ( ! class_exists( 'Admin_Settings' ) ) { array( 'id' => 'restricted_access_post_metabox', 'type' => 'hidden', - 'value' => '', + 'value' => '', ), array( 'id' => 'restricted_access_taxonomy_metabox', 'type' => 'hidden', - 'value' => '', + 'value' => '', ), array( 'id' => 'restricted_access_post_metabox', From 21e5c397d726c84ca4ac12eef218507c8565983c Mon Sep 17 00:00:00 2001 From: Denis Baranov Date: Fri, 12 Jan 2018 12:32:32 +0200 Subject: [PATCH 4/4] - fixed support for PHP version: 5.4 --- includes/admin/templates/directory/general.php | 5 +++-- includes/admin/templates/directory/search.php | 5 +++-- includes/admin/templates/form/profile_customize.php | 5 +++-- includes/admin/templates/form/register_customize.php | 5 +++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/includes/admin/templates/directory/general.php b/includes/admin/templates/directory/general.php index ffbc02ac..9bde9b62 100644 --- a/includes/admin/templates/directory/general.php +++ b/includes/admin/templates/directory/general.php @@ -9,8 +9,9 @@ foreach( $meta as $k => $v ) { $roles_array = array(); foreach ( UM()->roles()->get_roles() as $key => $value ) { - if ( ! empty( UM()->query()->get_meta_value( '_um_roles', $key ) ) ) - $roles_array[] = UM()->query()->get_meta_value( '_um_roles', $key ); + $_um_roles = UM()->query()->get_meta_value( '_um_roles', $key ); + if ( ! empty( $_um_roles ) ) + $roles_array[] = $_um_roles; } $show_these_users = get_post_meta( get_the_ID(), '_um_show_these_users', true ); diff --git a/includes/admin/templates/directory/search.php b/includes/admin/templates/directory/search.php index 520c0647..0b85ca2a 100644 --- a/includes/admin/templates/directory/search.php +++ b/includes/admin/templates/directory/search.php @@ -2,8 +2,9 @@ roles()->get_roles() as $key => $value ) { - if ( ! empty( UM()->query()->get_meta_value( '_um_roles_can_search', $key ) ) ) - $can_search_array[] = UM()->query()->get_meta_value( '_um_roles_can_search', $key ); + $_um_roles_can_search = UM()->query()->get_meta_value( '_um_roles_can_search', $key ); + if ( ! empty( $_um_roles_can_search ) ) + $can_search_array[] = $_um_roles_can_search; } $custom_search = apply_filters( 'um_admin_custom_search_filters', array() ); diff --git a/includes/admin/templates/form/profile_customize.php b/includes/admin/templates/form/profile_customize.php index 9ed7016a..06964965 100644 --- a/includes/admin/templates/form/profile_customize.php +++ b/includes/admin/templates/form/profile_customize.php @@ -2,8 +2,9 @@ roles()->get_roles( __( 'All roles', 'ultimate-member' ) ) as $key => $value ) { - if ( ! empty( UM()->query()->get_meta_value( '_um_profile_role', $key ) ) ) - $profile_role = UM()->query()->get_meta_value( '_um_profile_role', $key ); + $_um_profile_role = UM()->query()->get_meta_value( '_um_profile_role', $key ); + if ( ! empty( $_um_profile_role ) ) + $profile_role = $_um_profile_role; } UM()->admin_forms( array( diff --git a/includes/admin/templates/form/register_customize.php b/includes/admin/templates/form/register_customize.php index d2628881..98879594 100644 --- a/includes/admin/templates/form/register_customize.php +++ b/includes/admin/templates/form/register_customize.php @@ -2,8 +2,9 @@ roles()->get_roles( __( 'Default', 'ultimate-member' ) ) as $key => $value ) { - if ( ! empty( UM()->query()->get_meta_value( '_um_register_role', $key ) ) ) - $register_role = UM()->query()->get_meta_value( '_um_register_role', $key ); + $_um_register_role = UM()->query()->get_meta_value( '_um_register_role', $key ); + if ( ! empty( $_um_register_role ) ) + $register_role = $_um_register_role; } UM()->admin_forms( array(