10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-13 03:36:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

* fixed security issue CVE ID: CVE-2025-0308

Browse Source
This commit is contained in:
Mykyta Synelnikov
2025-01-10 02:17:18 +02:00
parent e5fe05503a
commit 5ebefde6b8
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-member-directory.php
+7 -1
View File
@@ -1716,6 +1716,9 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
// Make the search line empty if it contains the mySQL query statements.
$regexp_map = array(
'/select(.*?)from/im',
'/select(.*?)sleep/im',
'/select(.*?)database/im',
'/select(.*?)where/im',
'/update(.*?)set/im',
'/delete(.*?)from/im',
);
@@ -1873,8 +1876,11 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
$search_where = preg_replace( '/ AND \((.*?)\)/im', "$1 OR", $search_where );
// str_replace( '/', '\/', wp_slash( $search ) ) means that we add backslashes to special symbols + add backslash to slash(/) symbol for proper regular pattern.
$pattern = $wpdb->prepare( $meta_join_for_search . '.meta_value = %s', $search );
$pattern = '/(' . str_replace( '/', '\/', wp_slash( $pattern ) ) . ')/im';
$sql['where'] = preg_replace(
'/(' . $meta_join_for_search . '.meta_value = \'' . str_replace( '/', '\/', wp_slash( $search ) ) . '\')/im',
$pattern,
trim( $search_where ) . " $1",
$sql['where'],
1