From 5f66fd5fe3854d2b62b34366374a36cc50da4a10 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Thu, 8 Aug 2019 00:36:33 +0300 Subject: [PATCH] - added escape functions, security fix for XSS; --- includes/admin/core/class-admin-builder.php | 201 ++-- includes/admin/core/class-admin-columns.php | 5 +- includes/admin/core/class-admin-dragdrop.php | 77 +- includes/admin/core/class-admin-enqueue.php | 7 +- includes/admin/core/class-admin-forms.php | 166 +-- includes/admin/core/class-admin-menu.php | 10 +- includes/admin/core/class-admin-metabox.php | 368 +++--- includes/admin/core/class-admin-notices.php | 12 +- includes/admin/core/class-admin-settings.php | 439 ++++---- includes/admin/core/class-admin-upgrade.php | 7 +- includes/admin/core/class-admin-users.php | 18 +- .../core/list-tables/roles-list-table.php | 26 +- includes/admin/templates/dashboard/cache.php | 7 +- includes/admin/templates/dashboard/feed.php | 3 + includes/admin/templates/dashboard/purge.php | 7 +- .../templates/dashboard/upgrade-request.php | 5 +- includes/admin/templates/dashboard/users.php | 75 +- .../admin/templates/directory/appearance.php | 3 + .../admin/templates/directory/general.php | 4 +- .../admin/templates/directory/pagination.php | 3 + .../admin/templates/directory/profile.php | 3 + includes/admin/templates/directory/search.php | 3 + .../admin/templates/directory/shortcode.php | 3 + includes/admin/templates/extensions.php | 18 +- includes/admin/templates/form/builder.php | 35 +- .../admin/templates/form/login_customize.php | 3 + .../admin/templates/form/login_settings.php | 3 + includes/admin/templates/form/mode.php | 24 +- .../templates/form/profile_customize.php | 3 + .../admin/templates/form/profile_settings.php | 1 + .../templates/form/register_customize.php | 3 + .../admin/templates/form/register_gdpr.php | 3 + includes/admin/templates/form/shortcode.php | 3 + .../templates/modal/dynamic_edit_field.php | 17 +- .../templates/modal/dynamic_edit_row.php | 17 +- .../templates/modal/dynamic_form_preview.php | 13 +- .../templates/modal/dynamic_new_divider.php | 17 +- .../templates/modal/dynamic_new_field.php | 17 +- .../templates/modal/dynamic_new_group.php | 17 +- .../modal/dynamic_registration_preview.php | 11 +- includes/admin/templates/modal/fields.php | 9 +- includes/admin/templates/modal/fonticons.php | 11 +- .../templates/role/admin-permissions.php | 3 + includes/admin/templates/role/delete.php | 3 + includes/admin/templates/role/general.php | 3 + includes/admin/templates/role/home.php | 3 + includes/admin/templates/role/login.php | 3 + includes/admin/templates/role/logout.php | 3 + includes/admin/templates/role/profile.php | 3 + includes/admin/templates/role/publish.php | 24 +- includes/admin/templates/role/register.php | 3 + includes/admin/templates/role/role-edit.php | 18 +- .../admin/templates/role/wp-capabilities.php | 3 + includes/class-init.php | 14 - includes/core/class-account.php | 58 +- includes/core/class-chart.php | 156 --- includes/core/class-fields.php | 1001 ++++++++++------- includes/core/class-members.php | 76 +- includes/core/class-profile.php | 12 +- includes/core/class-uploader.php | 2 +- includes/core/class-user.php | 159 +-- includes/core/class-validation.php | 72 +- includes/core/um-actions-account.php | 19 +- includes/core/um-actions-form.php | 25 +- includes/core/um-actions-global.php | 14 +- includes/core/um-actions-login.php | 60 +- includes/core/um-actions-members.php | 117 +- includes/core/um-actions-profile.php | 67 +- includes/core/um-actions-user.php | 2 +- includes/um-short-functions.php | 498 ++++---- includes/widgets/class-um-search-widget.php | 6 +- templates/account.php | 12 +- templates/email/approved_email.php | 4 +- templates/email/changedaccount_email.php | 4 +- templates/email/changedpw_email.php | 4 +- templates/email/checkmail_email.php | 4 +- templates/email/deletion_email.php | 4 +- templates/email/inactive_email.php | 3 +- templates/email/notification_deletion.php | 4 +- templates/email/notification_new_user.php | 4 +- templates/email/notification_review.php | 4 +- templates/email/pending_email.php | 4 +- templates/email/rejected_email.php | 4 +- templates/email/resetpw_email.php | 4 +- templates/email/welcome_email.php | 4 +- templates/login.php | 4 +- templates/members-grid.php | 20 +- templates/message.php | 4 +- templates/modal/um_upload_single.php | 6 +- templates/modal/um_view_photo.php | 14 +- templates/password-reset.php | 4 +- templates/profile.php | 3 +- templates/profile/comments-single.php | 7 +- templates/profile/comments.php | 15 +- templates/profile/posts.php | 10 +- 95 files changed, 2228 insertions(+), 2026 deletions(-) delete mode 100644 includes/core/class-chart.php diff --git a/includes/admin/core/class-admin-builder.php b/includes/admin/core/class-admin-builder.php index eb3011b2..f469cf57 100644 --- a/includes/admin/core/class-admin-builder.php +++ b/includes/admin/core/class-admin-builder.php @@ -1,9 +1,10 @@ builtin()->unique_field_err( $array['post'][$post_input] ) ) { - $errors[$post_input] = UM()->builtin()->unique_field_err( $array['post'][$post_input] ); + if ( ! isset( $array['post']['edit_mode'] ) ) { + if ( UM()->builtin()->unique_field_err( $array['post'][ $post_input ] ) ) { + $errors[ $post_input ] = UM()->builtin()->unique_field_err( $array['post'][ $post_input ] ); } } break; case 'required': - if ( $array['post'][$post_input] == '' ) - $errors[$post_input] = $validate[$post_input]['error']; + if ( $array['post'][ $post_input ] == '' ) { + $errors[ $post_input ] = $validate[ $post_input ]['error']; + } break; case 'range-start': - if ( UM()->builtin()->date_range_start_err( $array['post'][$post_input] ) && $array['post']['_range'] == 'date_range' ) - $errors[$post_input] = UM()->builtin()->date_range_start_err( $array['post'][$post_input] ); + if ( UM()->builtin()->date_range_start_err( $array['post'][ $post_input ] ) && $array['post']['_range'] == 'date_range' ) { + $errors[ $post_input ] = UM()->builtin()->date_range_start_err( $array['post'][ $post_input ] ); + } break; case 'range-end': - if ( UM()->builtin()->date_range_end_err( $array['post'][$post_input], $array['post']['_range_start'] ) && $array['post']['_range'] == 'date_range' ) - $errors[$post_input] = UM()->builtin()->date_range_end_err( $array['post'][$post_input], $array['post']['_range_start'] ); + if ( UM()->builtin()->date_range_end_err( $array['post'][ $post_input ], $array['post']['_range_start'] ) && $array['post']['_range'] == 'date_range' ) { + $errors[ $post_input ] = UM()->builtin()->date_range_end_err( $array['post'][ $post_input ], $array['post']['_range_start'] ); + } break; } @@ -141,15 +145,17 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { $fields = UM()->query()->get_attr('custom_fields', $form_id); $count = 1; - if ( isset( $fields ) && !empty( $fields) ) $count = count($fields)+1; + if ( ! empty( $fields ) ) { + $count = count( $fields ) + 1; + } // set unique meta key - if ( in_array( $field_type, $fields_without_metakey ) && !isset($array['post']['_metakey']) ) { + if ( in_array( $field_type, $fields_without_metakey ) && ! isset( $array['post']['_metakey'] ) ) { $array['post']['_metakey'] = "um_{$field_type}_{$form_id}_{$count}"; } // set position - if ( !isset( $array['post']['_position'] ) ) { + if ( ! isset( $array['post']['_position'] ) ) { $array['post']['_position'] = $count; } @@ -166,27 +172,27 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { */ function um_admin_pre_save_field_to_form( $array ){ unset( $array['conditions'] ); - if ( isset($array['conditional_field']) && !empty( $array['conditional_action'] ) && !empty( $array['conditional_operator'] ) ) { + if ( isset($array['conditional_field']) && ! empty( $array['conditional_action'] ) && ! empty( $array['conditional_operator'] ) ) { $array['conditional_value'] = isset( $array['conditional_value'] ) ? $array['conditional_value'] : ''; $array['conditions'][] = array( $array['conditional_action'], $array['conditional_field'], $array['conditional_operator'], $array['conditional_value'] ); } - if ( isset($array['conditional_field1']) && !empty( $array['conditional_action1'] ) && !empty( $array['conditional_operator1'] ) ) { + if ( isset( $array['conditional_field1'] ) && ! empty( $array['conditional_action1'] ) && ! empty( $array['conditional_operator1'] ) ) { $array['conditional_value1'] = isset( $array['conditional_value1'] ) ? $array['conditional_value1'] : ''; $array['conditions'][] = array( $array['conditional_action1'], $array['conditional_field1'], $array['conditional_operator1'], $array['conditional_value1'] ); } - if ( isset($array['conditional_field2']) && !empty( $array['conditional_action2'] ) && !empty( $array['conditional_operator2'] ) ) { + if ( isset( $array['conditional_field2'] ) && ! empty( $array['conditional_action2'] ) && ! empty( $array['conditional_operator2'] ) ) { $array['conditional_value2'] = isset( $array['conditional_value2'] ) ? $array['conditional_value2'] : ''; $array['conditions'][] = array( $array['conditional_action2'], $array['conditional_field2'], $array['conditional_operator2'], $array['conditional_value2'] ); } - if ( isset($array['conditional_field3']) && !empty( $array['conditional_action3'] ) && !empty( $array['conditional_operator3'] ) ) { + if ( isset( $array['conditional_field3'] ) && ! empty( $array['conditional_action3'] ) && ! empty( $array['conditional_operator3'] ) ) { $array['conditional_value3'] = isset( $array['conditional_value3'] ) ? $array['conditional_value3'] : ''; $array['conditions'][] = array( $array['conditional_action3'], $array['conditional_field3'], $array['conditional_operator3'], $array['conditional_value3'] ); } - if ( isset($array['conditional_field4']) && !empty( $array['conditional_action4'] ) && !empty( $array['conditional_operator4'] ) ) { + if ( isset( $array['conditional_field4'] ) && ! empty( $array['conditional_action4'] ) && ! empty( $array['conditional_operator4'] ) ) { $array['conditional_value4'] = isset( $array['conditional_value4'] ) ? $array['conditional_value4'] : ''; $array['conditions'][] = array( $array['conditional_action4'], $array['conditional_field4'], $array['conditional_operator4'], $array['conditional_value4'] ); } @@ -224,25 +230,25 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
in_edit = true; $metabox->edit_array = $edit_array; ?> - tooltip( __( 'Here you can setup conditional logic to show/hide this field based on specific fields value or conditions', 'ultimate-member' ) ); ?> + tooltip( __( 'Here you can setup conditional logic to show/hide this field based on specific fields value or conditions', 'ultimate-member' ) ); ?> - tooltip( __( 'Here you can setup conditional logic to show/hide this field based on specific fields value or conditions', 'ultimate-member' ) ); ?> + tooltip( __( 'Here you can setup conditional logic to show/hide this field based on specific fields value or conditions', 'ultimate-member' ) ); ?>
-
+
field_input( '_conditional_action', $form_id ); ?> field_input( '_conditional_field', $form_id ); ?> field_input( '_conditional_operator', $form_id ); ?> field_input( '_conditional_value', $form_id ); ?> -

+

-
-
-

-

+
+
+

+

field_input( '_conditional_operator' . $k, $form_id ); ?> field_input( '_conditional_value' . $k, $form_id ); ?> -

+

@@ -275,7 +281,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { field_input( '_conditional_operator', $form_id ); ?> field_input( '_conditional_value', $form_id ); ?> -

+

@@ -308,7 +314,12 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { $output = ob_get_clean(); - if(is_array($output)){ print_r($output); }else{ echo $output; } die; + if ( is_array( $output ) ) { + print_r( $output ); + } else { + echo $output; + } + die; } @@ -399,19 +410,20 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
- - + + -
+ +
- - - + + +
@@ -437,54 +449,51 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { } else { - if( empty( $fields) || ! is_array( $fields ) ){ + if ( empty( $fields ) || ! is_array( $fields ) ) { $this->global_fields = array(); - }else{ + } else { $this->global_fields = $fields; } - foreach( $this->global_fields as $key => $array ) { + foreach ( $this->global_fields as $key => $array ) { if ( $array['type'] == 'row' ) { - $rows[$key] = $array; + $rows[ $key ] = $array; unset( $this->global_fields[ $key ] ); // not needed now } } - if ( !isset( $rows ) ){ - $rows = array( '_um_row_1' => array( - 'type' => 'row', - 'id' => '_um_row_1', - 'sub_rows' => 1, - 'cols' => 1 - ) + if ( ! isset( $rows ) ) { + $rows = array( + '_um_row_1' => array( + 'type' => 'row', + 'id' => '_um_row_1', + 'sub_rows' => 1, + 'cols' => 1 + ), ); } - foreach ( $rows as $row_id => $array ) { + foreach ( $rows as $row_id => $array ) { ?> - ?> - -
+
- - + + - +
- get_fields_by_row( $row_id ); + get_fields_by_row( $row_id ); $sub_rows = ( isset( $array['sub_rows'] ) ) ? $array['sub_rows'] : 1; - for( $c = 0; $c < $sub_rows; $c++ ) { + for ( $c = 0; $c < $sub_rows; $c++ ) { $subrow_fields = $this->get_fields_in_subrow( $row_fields, $c ); @@ -507,7 +516,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { } for ( $i = 1; $i <= 3; $i++ ) { - echo ''; } @@ -519,8 +528,9 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
- 0 ) { ?> -
+ 0 ) { ?> +
+
@@ -532,6 +542,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { $subrow_fields = $this->array_sort_by_column( $subrow_fields, 'position'); foreach( $subrow_fields as $key => $keyarray ) { + /** + * @var $type + * @var $title + */ extract( $keyarray ); ?> @@ -548,16 +562,16 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
- + - + - + - + @@ -666,6 +680,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { */ $output['error'] = apply_filters( 'um_admin_field_update_error_handling', $output['error'], $array ); + /** + * @var $_metakey + * @var $post_id + */ extract( $array['post'] ); if ( empty( $output['error'] ) ){ @@ -830,12 +848,12 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { ob_start(); ?>
-

+

fonticons()->all as $icon ) { ?> - +
@@ -853,31 +871,35 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {

- builtin()->core_fields ) { + builtin()->core_fields ) { foreach ( UM()->builtin()->core_fields as $field_type => $array ) { - if ( isset( $array['in_fields'] ) && $array['in_fields'] == false ) { } else { - ?> + if ( isset( $array['in_fields'] ) && $array['in_fields'] == false ) { + continue; + } ?> - + - +

- builtin()->predefined_fields ) { + builtin()->predefined_fields ) { foreach ( UM()->builtin()->predefined_fields as $field_key => $array ) { - if ( !isset( $array['account_only'] ) && !isset( $array['private_use'] ) ) {?> + if ( ! isset( $array['account_only'] ) && ! isset( $array['private_use'] ) ) { ?> - data-silent_action="um_admin_add_field_from_predefined" data-arg1="" data-arg2=""> + data-silent_action="um_admin_add_field_from_predefined" data-arg1="" data-arg2=""> - ' . __('None','ultimate-member') . '

'; } ?> + ' . __( 'None', 'ultimate-member' ) . '

'; + } ?>
@@ -886,13 +908,14 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { builtin()->custom_fields ) { - foreach ( UM()->builtin()->custom_fields as $field_key => $array ) { + foreach ( UM()->builtin()->custom_fields as $field_key => $array ) { ?> - ?> + data-silent_action="um_admin_add_field_from_list" data-arg1="" data-arg2=""> () - data-silent_action="um_admin_add_field_from_list" data-arg1="" data-arg2=""> () - - ' . __('You did not create any custom fields', 'ultimate-member') . '

'; } ?> + ' . __( 'You did not create any custom fields', 'ultimate-member' ) . '

'; + } ?>
@@ -921,9 +944,9 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { extract( $args ); - if ( !isset( $col1 ) ) { + if ( ! isset( $col1 ) ) { - echo '

'. __('This field type is not setup correcty.', 'ultimate-member') . '

'; + echo '

'. __( 'This field type is not setup correcty.', 'ultimate-member' ) . '

'; } else { @@ -1014,13 +1037,13 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
- field_input ( $opt ); } ?> + field_input ( $opt ); } ?>
- field_input ( $opt ); } ?> + field_input ( $opt ); } ?>
@@ -1028,7 +1051,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
- field_input ( $opt ); } ?> + field_input ( $opt ); } ?> modal_footer( $arg2, $args, $metabox ); ?> diff --git a/includes/admin/core/class-admin-columns.php b/includes/admin/core/class-admin-columns.php index 83906d54..2abb66f0 100644 --- a/includes/admin/core/class-admin-columns.php +++ b/includes/admin/core/class-admin-columns.php @@ -1,9 +1,10 @@ post_type == "um_form" ) { - $actions['um_duplicate'] = '' . __( 'Duplicate', 'ultimate-member' ) . ''; + $actions['um_duplicate'] = '' . __( 'Duplicate', 'ultimate-member' ) . ''; } return $actions; } diff --git a/includes/admin/core/class-admin-dragdrop.php b/includes/admin/core/class-admin-dragdrop.php index 56b2dbd5..0c838d0d 100644 --- a/includes/admin/core/class-admin-dragdrop.php +++ b/includes/admin/core/class-admin-dragdrop.php @@ -1,9 +1,10 @@ row_data[ $row_array['origin'] ] ) ) { - foreach( $this->row_data[ $row_array['origin'] ] as $k => $v ){ + foreach ( $this->row_data[ $row_array['origin'] ] as $k => $v ){ if ( $k != 'position' && $k != 'metakey' ) { $update_args[$k] = $v; } @@ -84,55 +85,56 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) { $this->exist_rows[] = $key; } - $fields[$key] = $row_args; + $fields[ $key ] = $row_args; } // change field position if ( 0 === strpos( $key, 'um_position_' ) ) { - $field_key = str_replace('um_position_','',$key); - if ( isset( $fields[$field_key] ) ) { - $fields[$field_key]['position'] = $value; + $field_key = str_replace( 'um_position_', '', $key ); + if ( isset( $fields[ $field_key ] ) ) { + $fields[ $field_key ]['position'] = $value; } } // change field master row if ( 0 === strpos( $key, 'um_row_' ) ) { - $field_key = str_replace('um_row_','',$key); - if ( isset( $fields[$field_key] ) ) { - $fields[$field_key]['in_row'] = $value; + $field_key = str_replace( 'um_row_', '', $key ); + if ( isset( $fields[ $field_key ] ) ) { + $fields[ $field_key ]['in_row'] = $value; } } // change field sub row if ( 0 === strpos( $key, 'um_subrow_' ) ) { - $field_key = str_replace('um_subrow_','',$key); - if ( isset( $fields[$field_key] ) ) { - $fields[$field_key]['in_sub_row'] = $value; + $field_key = str_replace( 'um_subrow_', '', $key ); + if ( isset( $fields[ $field_key ] ) ) { + $fields[ $field_key ]['in_sub_row'] = $value; } } // change field column if ( 0 === strpos( $key, 'um_col_' ) ) { - $field_key = str_replace('um_col_','',$key); - if ( isset( $fields[$field_key] ) ) { - $fields[$field_key]['in_column'] = $value; + $field_key = str_replace( 'um_col_', '', $key ); + if ( isset( $fields[ $field_key ] ) ) { + $fields[ $field_key ]['in_column'] = $value; } } // add field to group if ( 0 === strpos( $key, 'um_group_' ) ) { - $field_key = str_replace('um_group_','',$key); - if ( isset( $fields[$field_key] ) ) { - $fields[$field_key]['in_group'] = $value; + $field_key = str_replace( 'um_group_', '', $key ); + if ( isset( $fields[ $field_key ] ) ) { + $fields[ $field_key ]['in_group'] = $value; } } } foreach ( $this->row_data as $k => $v ) { - if ( ! in_array( $k, $this->exist_rows ) ) - unset( $this->row_data[$k] ); + if ( ! in_array( $k, $this->exist_rows ) ) { + unset( $this->row_data[ $k ] ); + } } update_option( 'um_existing_rows_' . $form_id, $this->exist_rows ); @@ -151,33 +153,34 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) { $screen = get_current_screen(); - if ( ! isset( $screen->id ) || $screen->id != 'um_form' ) return; - - ?> + if ( ! isset( $screen->id ) || $screen->id != 'um_form' ) { + return; + } ?>
+
- - - + + +
- +
@@ -195,14 +198,14 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {