10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-11 18:56:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

- added escape functions, security fix for XSS;

Browse Source
This commit is contained in:
nikitasinelnikov
2019-08-08 00:36:33 +03:00
parent b2e57e8f92
commit 5f66fd5fe3
95 changed files with 2228 additions and 2026 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/admin/core/class-admin-dragdrop.php
+40 -37
View File
@@ -1,9 +1,10 @@
<?php
namespace um\admin\core;
// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) exit;
if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
@@ -73,7 +74,7 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
$row_args = $row_array;
if ( isset( $this->row_data[ $row_array['origin'] ] ) ) {
foreach( $this->row_data[ $row_array['origin'] ] as $k => $v ){
foreach ( $this->row_data[ $row_array['origin'] ] as $k => $v ){
if ( $k != 'position' && $k != 'metakey' ) {
$update_args[$k] = $v;
}
@@ -84,55 +85,56 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
$this->exist_rows[] = $key;
}
$fields[$key] = $row_args;
$fields[ $key ] = $row_args;
}
// change field position
if ( 0 === strpos( $key, 'um_position_' ) ) {
$field_key = str_replace('um_position_','',$key);
if ( isset( $fields[$field_key] ) ) {
$fields[$field_key]['position'] = $value;
$field_key = str_replace( 'um_position_', '', $key );
if ( isset( $fields[ $field_key ] ) ) {
$fields[ $field_key ]['position'] = $value;
}
}
// change field master row
if ( 0 === strpos( $key, 'um_row_' ) ) {
$field_key = str_replace('um_row_','',$key);
if ( isset( $fields[$field_key] ) ) {
$fields[$field_key]['in_row'] = $value;
$field_key = str_replace( 'um_row_', '', $key );
if ( isset( $fields[ $field_key ] ) ) {
$fields[ $field_key ]['in_row'] = $value;
}
}
// change field sub row
if ( 0 === strpos( $key, 'um_subrow_' ) ) {
$field_key = str_replace('um_subrow_','',$key);
if ( isset( $fields[$field_key] ) ) {
$fields[$field_key]['in_sub_row'] = $value;
$field_key = str_replace( 'um_subrow_', '', $key );
if ( isset( $fields[ $field_key ] ) ) {
$fields[ $field_key ]['in_sub_row'] = $value;
}
}
// change field column
if ( 0 === strpos( $key, 'um_col_' ) ) {
$field_key = str_replace('um_col_','',$key);
if ( isset( $fields[$field_key] ) ) {
$fields[$field_key]['in_column'] = $value;
$field_key = str_replace( 'um_col_', '', $key );
if ( isset( $fields[ $field_key ] ) ) {
$fields[ $field_key ]['in_column'] = $value;
}
}
// add field to group
if ( 0 === strpos( $key, 'um_group_' ) ) {
$field_key = str_replace('um_group_','',$key);
if ( isset( $fields[$field_key] ) ) {
$fields[$field_key]['in_group'] = $value;
$field_key = str_replace( 'um_group_', '', $key );
if ( isset( $fields[ $field_key ] ) ) {
$fields[ $field_key ]['in_group'] = $value;
}
}
}
foreach ( $this->row_data as $k => $v ) {
if ( ! in_array( $k, $this->exist_rows ) )
unset( $this->row_data[$k] );
if ( ! in_array( $k, $this->exist_rows ) ) {
unset( $this->row_data[ $k ] );
}
}
update_option( 'um_existing_rows_' . $form_id, $this->exist_rows );
@@ -151,33 +153,34 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
$screen = get_current_screen();
if ( ! isset( $screen->id ) || $screen->id != 'um_form' ) return;
?>
if ( ! isset( $screen->id ) || $screen->id != 'um_form' ) {
return;
} ?>
<div class="um-col-demon-settings" data-in_row="" data-in_sub_row="" data-in_column="" data-in_group=""></div>
<div class="um-col-demon-row" style="display:none;">
<div class="um-admin-drag-row-icons">
<a href="#" class="um-admin-drag-rowsub-add um-admin-tipsy-n" title="<?php _e('Add Row','ultimate-member'); ?>" data-row_action="add_subrow"><i class="um-icon-plus"></i></a>
<a href="#" class="um-admin-drag-row-edit um-admin-tipsy-n" title="<?php _e('Edit Row','ultimate-member'); ?>" data-modal="UM_edit_row" data-modal-size="normal" data-dynamic-content="um_admin_edit_field_popup" data-arg1="row" data-arg2="<?php echo get_the_ID(); ?>"><i class="um-faicon-pencil"></i></a>
<a href="javascript:void(0);" class="um-admin-drag-rowsub-add um-admin-tipsy-n" title="<?php esc_attr_e( 'Add Row', 'ultimate-member' ); ?>" data-row_action="add_subrow"><i class="um-icon-plus"></i></a>
<a href="javascript:void(0);" class="um-admin-drag-row-edit um-admin-tipsy-n" title="<?php esc_attr_e( 'Edit Row', 'ultimate-member' ); ?>" data-modal="UM_edit_row" data-modal-size="normal" data-dynamic-content="um_admin_edit_field_popup" data-arg1="row" data-arg2="<?php echo esc_attr( get_the_ID() ); ?>"><i class="um-faicon-pencil"></i></a>
<span class="um-admin-drag-row-start"><i class="um-icon-arrow-move"></i></span>
<a href="#" class="um-admin-tipsy-n" title="<?php _e('Delete Row','ultimate-member'); ?>" data-remove_element="um-admin-drag-row"><i class="um-faicon-trash-o"></i></a>
</div><div class="um-admin-clear"></div>
<a href="javascript:void(0);" class="um-admin-tipsy-n" title="<?php esc_attr_e( 'Delete Row', 'ultimate-member' ); ?>" data-remove_element="um-admin-drag-row"><i class="um-faicon-trash-o"></i></a>
</div>
<div class="um-admin-clear"></div>
<div class="um-admin-drag-rowsubs">
<div class="um-admin-drag-rowsub">
<div class="um-admin-drag-ctrls columns">
<a href="#" class="active" data-cols="1"></a>
<a href="#" data-cols="2"></a>
<a href="#" data-cols="3"></a>
<a href="javascript:void(0);" class="active" data-cols="1"></a>
<a href="javascript:void(0);" data-cols="2"></a>
<a href="javascript:void(0);" data-cols="3"></a>
</div>
<div class="um-admin-drag-rowsub-icons">
<span class="um-admin-drag-rowsub-start"><i class="um-icon-arrow-move"></i></span>
<a href="#" class="um-admin-tipsy-n" title="<?php _e('Delete Row','ultimate-member'); ?>" data-remove_element="um-admin-drag-rowsub"><i class="um-faicon-trash-o"></i></a>
<a href="javascript:void(0);" class="um-admin-tipsy-n" title="<?php esc_attr_e( 'Delete Row', 'ultimate-member' ); ?>" data-remove_element="um-admin-drag-rowsub"><i class="um-faicon-trash-o"></i></a>
</div><div class="um-admin-clear"></div>
<div class="um-admin-drag-col">
@@ -195,14 +198,14 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
<div class="um-col-demon-subrow" style="display:none;">
<div class="um-admin-drag-ctrls columns">
<a href="#" class="active" data-cols="1"></a>
<a href="#" data-cols="2"></a>
<a href="#" data-cols="3"></a>
<a href="javascript:void(0);" class="active" data-cols="1"></a>
<a href="javascript:void(0);" data-cols="2"></a>
<a href="javascript:void(0);" data-cols="3"></a>
</div>
<div class="um-admin-drag-rowsub-icons">
<span class="um-admin-drag-rowsub-start"><i class="um-icon-arrow-move"></i></span>
<a href="#" class="um-admin-tipsy-n" title="<?php _e('Delete Row','ultimate-member'); ?>" data-remove_element="um-admin-drag-rowsub"><i class="um-faicon-trash-o"></i></a>
<a href="javascript:void(0);" class="um-admin-tipsy-n" title="<?php esc_attr_e( 'Delete Row', 'ultimate-member' ); ?>" data-remove_element="um-admin-drag-rowsub"><i class="um-faicon-trash-o"></i></a>
</div><div class="um-admin-clear"></div>
<div class="um-admin-drag-col">
@@ -217,9 +220,9 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
<form action="" method="post" class="um_update_order">
<input type="hidden" name="form_id" id="form_id" value="<?php echo get_the_ID(); ?>" />
<input type="hidden" name="form_id" id="form_id" value="<?php echo esc_attr( get_the_ID() ); ?>" />
<input type="hidden" name="action" value="um_update_order" />
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'um-admin-nonce' ) ?>" />
<input type="hidden" name="nonce" value="<?php echo esc_attr( wp_create_nonce( 'um-admin-nonce' ) ) ?>" />
<div class="um_update_order_fields">