10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-14 04:06:36 +09:00
Code Issues Packages Projects Releases Wiki Activity

* maybe fixed CVE-2024-10528;

Browse Source
This commit is contained in:
Mykyta Synelnikov
2024-11-05 11:55:07 +02:00
parent baaf32c278
commit 61ea1b3e8d
6 changed files with 346 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-files.php
+321 -104
View File
@@ -1,6 +1,8 @@
<?php
namespace um\core;
use Exception;
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
@@ -322,16 +324,86 @@ if ( ! class_exists( 'um\core\Files' ) ) {
wp_send_json_error( esc_js( __( 'Invalid coordinates', 'ultimate-member' ) ) );
}
$key = sanitize_text_field( $_REQUEST['key'] );
$coord = sanitize_text_field( $_REQUEST['coord'] );
$user_id = empty( $_REQUEST['user_id'] ) ? get_current_user_id() : absint( $_REQUEST['user_id'] );
$user_id = empty( $_REQUEST['user_id'] ) ? null : absint( $_REQUEST['user_id'] );
if ( $user_id && is_user_logged_in() && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit this user', 'ultimate-member' ) ) );
}
UM()->fields()->set_id = isset( $_POST['set_id'] ) ? absint( $_POST['set_id'] ) : null;
UM()->fields()->set_mode = isset( $_POST['set_mode'] ) ? sanitize_text_field( $_POST['set_mode'] ) : null;
if ( $user_id && ! is_user_logged_in() ) {
wp_send_json_error( esc_js( __( 'Please login to edit this user', 'ultimate-member' ) ) );
}
if ( 'register' !== UM()->fields()->set_mode && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
$ret['error'] = esc_js( __( 'You have no permission to edit this user', 'ultimate-member' ) );
wp_send_json_error( $ret );
$form_id = isset( $_POST['set_id'] ) ? absint( $_POST['set_id'] ) : null;
$mode = isset( $_POST['set_mode'] ) ? sanitize_text_field( $_POST['set_mode'] ) : null;
UM()->fields()->set_id = $form_id;
UM()->fields()->set_mode = $mode;
if ( ! is_user_logged_in() && 'profile' === $mode ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit user profile', 'ultimate-member' ) ) );
}
if ( null !== $user_id && 'register' === $mode ) {
wp_send_json_error( esc_js( __( 'User has to be empty on registration', 'ultimate-member' ) ) );
}
$form_post = get_post( $form_id );
// Invalid post ID. Maybe post doesn't exist.
if ( empty( $form_post ) ) {
wp_send_json_error( esc_js( __( 'Invalid form ID', 'ultimate-member' ) ) );
}
if ( 'um_form' !== $form_post->post_type ) {
wp_send_json_error( esc_js( __( 'Invalid form post type', 'ultimate-member' ) ) );
}
$form_status = get_post_status( $form_id );
if ( 'publish' !== $form_status ) {
wp_send_json_error( esc_js( __( 'Invalid form status', 'ultimate-member' ) ) );
}
$post_data = UM()->query()->post_data( $form_id );
if ( ! array_key_exists( 'mode', $post_data ) || $mode !== $post_data['mode'] ) {
wp_send_json_error( esc_js( __( 'Invalid form type', 'ultimate-member' ) ) );
}
// For profiles only.
if ( 'profile' === $mode && ! empty( $post_data['use_custom_settings'] ) && ! empty( $post_data['role'] ) ) {
// Option "Apply custom settings to this form". Option "Make this profile form role-specific".
// Show the first Profile Form with role selected, don't show profile forms below the page with other role-specific setting.
$current_user_roles = UM()->roles()->get_all_user_roles( $user_id );
if ( empty( $current_user_roles ) ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit this user through this form', 'ultimate-member' ) ) );
}
if ( is_array( $post_data['role'] ) ) {
if ( ! count( array_intersect( $post_data['role'], $current_user_roles ) ) ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit this user through this form', 'ultimate-member' ) ) );
}
} elseif ( ! in_array( $post_data['role'], $current_user_roles, true ) ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit this user through this form', 'ultimate-member' ) ) );
}
}
$key = sanitize_text_field( $_REQUEST['key'] );
if ( ! array_key_exists( 'custom_fields', $post_data ) || empty( $post_data['custom_fields'] ) ) {
wp_send_json_error( esc_js( __( 'Invalid form fields', 'ultimate-member' ) ) );
}
$custom_fields = maybe_unserialize( $post_data['custom_fields'] );
if ( ! is_array( $custom_fields ) || ! array_key_exists( $key, $custom_fields ) ) {
if ( ! ( 'profile' === $mode && in_array( $key, array( 'cover_photo', 'profile_photo' ), true ) ) ) {
wp_send_json_error( esc_js( __( 'Invalid field metakey', 'ultimate-member' ) ) );
}
}
if ( empty( $custom_fields[ $key ]['crop'] ) && ! in_array( $key, array( 'cover_photo', 'profile_photo' ), true ) ) {
wp_send_json_error( esc_js( __( 'This field doesn\'t support image crop', 'ultimate-member' ) ) );
}
if ( 'profile' === $mode && ! um_can_edit_field( $custom_fields[ $key ] ) ) {
wp_send_json_error( esc_js( __( 'You have no permission to edit this field', 'ultimate-member' ) ) );
}
$src = esc_url_raw( $_REQUEST['src'] );
@@ -340,6 +412,8 @@ if ( ! class_exists( 'um\core\Files' ) ) {
wp_send_json_error( esc_js( __( 'Invalid file ownership', 'ultimate-member' ) ) );
}
$coord = sanitize_text_field( $_REQUEST['coord'] );
UM()->uploader()->replace_upload_dir = true;
$output = UM()->uploader()->resize_image( $image_path, $src, $key, $user_id, $coord );
@@ -354,166 +428,309 @@ if ( ! class_exists( 'um\core\Files' ) ) {
/**
* Image upload by AJAX
*
* @throws \Exception
* @throws Exception
*/
function ajax_image_upload() {
public function ajax_image_upload() {
$ret['error'] = null;
$ret = array();
$id = sanitize_text_field( $_POST['key'] );
$timestamp = absint( $_POST['timestamp'] );
$nonce = sanitize_text_field( $_POST['_wpnonce'] );
$user_id = empty( $_POST['user_id'] ) ? get_current_user_id() : absint( $_POST['user_id'] );
UM()->fields()->set_id = absint( $_POST['set_id'] );
UM()->fields()->set_mode = sanitize_key( $_POST['set_mode'] );
if ( UM()->fields()->set_mode != 'register' && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
$ret['error'] = __( 'You have no permission to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
$ret = array();
/**
* UM hook
* Filters image upload checking nonce.
*
* @type filter
* @title um_image_upload_nonce
* @description Change Image Upload nonce
* @input_vars
* [{"var":"$nonce","type":"bool","desc":"Nonce"}]
* @change_log
* ["Since: 2.0"]
* @usage
* <?php add_filter( 'um_image_upload_nonce', 'function_name', 10, 1 ); ?>
* @example
* <?php
* add_filter( 'um_image_upload_nonce', 'my_image_upload_nonce', 10, 1 );
* function my_image_upload_nonce( $nonce ) {
* @param {bool} $verify_nonce Verify nonce marker. Default true.
*
* @return {bool} Verify nonce marker.
*
* @since 1.3.x
* @hook um_image_upload_nonce
*
* @example <caption>Disable checking nonce on image upload.</caption>
* function my_image_upload_nonce( $verify_nonce ) {
* // your code here
* return $nonce;
* $verify_nonce = false;
* return $verify_nonce;
* }
* ?>
* add_filter( 'um_image_upload_nonce', 'my_image_upload_nonce' );
*/
$um_image_upload_nonce = apply_filters( 'um_image_upload_nonce', true );
if ( $um_image_upload_nonce ) {
$timestamp = absint( $_POST['timestamp'] );
$nonce = sanitize_text_field( $_POST['_wpnonce'] );
if ( ! wp_verify_nonce( $nonce, "um_upload_nonce-{$timestamp}" ) && is_user_logged_in() ) {
// This nonce is not valid.
$ret['error'] = __( 'Invalid nonce', 'ultimate-member' );
$ret['error'] = esc_html__( 'Invalid nonce', 'ultimate-member' );
wp_send_json_error( $ret );
}
}
$user_id = empty( $_POST['user_id'] ) ? null : absint( $_POST['user_id'] );
if ( $user_id && is_user_logged_in() && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( $user_id && ! is_user_logged_in() ) {
$ret['error'] = esc_html__( 'Please login to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
$form_id = absint( $_POST['set_id'] );
$mode = sanitize_key( $_POST['set_mode'] );
UM()->fields()->set_id = $form_id;
UM()->fields()->set_mode = $mode;
if ( ! is_user_logged_in() && 'profile' === $mode ) {
$ret['error'] = esc_html__( 'You have no permission to edit user profile', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( null !== $user_id && 'register' === $mode ) {
$ret['error'] = esc_html__( 'User has to be empty on registration', 'ultimate-member' );
wp_send_json_error( $ret );
}
$form_post = get_post( $form_id );
// Invalid post ID. Maybe post doesn't exist.
if ( empty( $form_post ) ) {
$ret['error'] = esc_html__( 'Invalid form ID', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( 'um_form' !== $form_post->post_type ) {
$ret['error'] = esc_html__( 'Invalid form post type', 'ultimate-member' );
wp_send_json_error( $ret );
}
$form_status = get_post_status( $form_id );
if ( 'publish' !== $form_status ) {
$ret['error'] = esc_html__( 'Invalid form status', 'ultimate-member' );
wp_send_json_error( $ret );
}
$post_data = UM()->query()->post_data( $form_id );
if ( ! array_key_exists( 'mode', $post_data ) || $mode !== $post_data['mode'] ) {
$ret['error'] = esc_html__( 'Invalid form type', 'ultimate-member' );
wp_send_json_error( $ret );
}
// For profiles only.
if ( 'profile' === $mode && ! empty( $post_data['use_custom_settings'] ) && ! empty( $post_data['role'] ) ) {
// Option "Apply custom settings to this form". Option "Make this profile form role-specific".
// Show the first Profile Form with role selected, don't show profile forms below the page with other role-specific setting.
$current_user_roles = UM()->roles()->get_all_user_roles( $user_id );
if ( empty( $current_user_roles ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( is_array( $post_data['role'] ) ) {
if ( ! count( array_intersect( $post_data['role'], $current_user_roles ) ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
} elseif ( ! in_array( $post_data['role'], $current_user_roles, true ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
}
$id = sanitize_text_field( $_POST['key'] );
if ( ! array_key_exists( 'custom_fields', $post_data ) || empty( $post_data['custom_fields'] ) ) {
$ret['error'] = esc_html__( 'Invalid form fields', 'ultimate-member' );
wp_send_json_error( $ret );
}
$custom_fields = maybe_unserialize( $post_data['custom_fields'] );
if ( ! is_array( $custom_fields ) || ! array_key_exists( $id, $custom_fields ) ) {
if ( ! ( 'profile' === $mode && in_array( $id, array( 'cover_photo', 'profile_photo' ), true ) ) ) {
$ret['error'] = esc_html__( 'Invalid field metakey', 'ultimate-member' );
wp_send_json_error( $ret );
}
}
if ( 'profile' === $mode && ! um_can_edit_field( $custom_fields[ $id ] ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( isset( $_FILES[ $id ]['name'] ) ) {
if ( ! is_array( $_FILES[ $id ]['name'] ) ) {
UM()->uploader()->replace_upload_dir = true;
$uploaded = UM()->uploader()->upload_image( $_FILES[ $id ], $user_id, $id );
UM()->uploader()->replace_upload_dir = false;
if ( isset( $uploaded['error'] ) ) {
$ret['error'] = $uploaded['error'];
} else {
$ret[] = $uploaded['handle_upload'];
}
}
} else {
$ret['error'] = __( 'A theme or plugin compatibility issue', 'ultimate-member' );
$ret['error'] = esc_html__( 'A theme or plugin compatibility issue', 'ultimate-member' );
}
wp_send_json_success( $ret );
}
/**
* File upload by AJAX
*
* @throws Exception
*/
function ajax_file_upload() {
public function ajax_file_upload() {
$ret['error'] = null;
$ret = array();
/* commented for enable download files on registration form
* if ( ! is_user_logged_in() ) {
$ret['error'] = 'Invalid user';
die( json_encode( $ret ) );
}*/
$nonce = sanitize_text_field( $_POST['_wpnonce'] );
$id = sanitize_text_field( $_POST['key'] );
$timestamp = absint( $_POST['timestamp'] );
UM()->fields()->set_id = absint( $_POST['set_id'] );
UM()->fields()->set_mode = sanitize_key( $_POST['set_mode'] );
$ret = array();
/**
* UM hook
* Filters file upload checking nonce.
*
* @type filter
* @title um_file_upload_nonce
* @description Change File Upload nonce
* @input_vars
* [{"var":"$nonce","type":"bool","desc":"Nonce"}]
* @change_log
* ["Since: 2.0"]
* @usage
* <?php add_filter( 'um_file_upload_nonce', 'function_name', 10, 1 ); ?>
* @example
* <?php
* add_filter( 'um_file_upload_nonce', 'my_file_upload_nonce', 10, 1 );
* function my_file_upload_nonce( $nonce ) {
* @param {bool} $verify_nonce Verify nonce marker. Default true.
*
* @return {bool} Verify nonce marker.
*
* @since 1.3.x
* @hook um_file_upload_nonce
*
* @example <caption>Disable checking nonce on file upload.</caption>
* function my_file_upload_nonce( $verify_nonce ) {
* // your code here
* return $nonce;
* $verify_nonce = false;
* return $verify_nonce;
* }
* ?>
* add_filter( 'um_file_upload_nonce', 'my_file_upload_nonce' );
*/
$um_file_upload_nonce = apply_filters("um_file_upload_nonce", true );
$um_file_upload_nonce = apply_filters( 'um_file_upload_nonce', true );
if ( $um_file_upload_nonce ) {
$nonce = sanitize_text_field( $_POST['_wpnonce'] );
$timestamp = absint( $_POST['timestamp'] );
if ( $um_file_upload_nonce ) {
if ( ! wp_verify_nonce( $nonce, 'um_upload_nonce-'.$timestamp ) && is_user_logged_in() ) {
if ( ! wp_verify_nonce( $nonce, 'um_upload_nonce-' . $timestamp ) && is_user_logged_in() ) {
// This nonce is not valid.
$ret['error'] = 'Invalid nonce';
$ret['error'] = esc_html__( 'Invalid nonce', 'ultimate-member' );
wp_send_json_error( $ret );
}
}
$user_id = empty( $_POST['user_id'] ) ? null : absint( $_POST['user_id'] );
if ( $user_id && is_user_logged_in() && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
if( isset( $_FILES[ $id ]['name'] ) ) {
if ( $user_id && ! is_user_logged_in() ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( ! is_array( $_FILES[ $id ]['name'] ) ) {
$form_id = absint( $_POST['set_id'] );
$mode = sanitize_key( $_POST['set_mode'] );
$user_id = absint( $_POST['user_id'] );
UM()->fields()->set_id = $form_id;
UM()->fields()->set_mode = $mode;
UM()->uploader()->replace_upload_dir = true;
$uploaded = UM()->uploader()->upload_file( $_FILES[ $id ], $user_id, $id );
UM()->uploader()->replace_upload_dir = false;
if ( isset( $uploaded['error'] ) ){
if ( ! is_user_logged_in() && 'profile' === $mode ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user', 'ultimate-member' );
wp_send_json_error( $ret );
}
$ret['error'] = $uploaded['error'];
if ( null !== $user_id && 'register' === $mode ) {
$ret['error'] = esc_html__( 'User has to be empty on registration', 'ultimate-member' );
wp_send_json_error( $ret );
}
} else {
$form_post = get_post( $form_id );
// Invalid post ID. Maybe post doesn't exist.
if ( empty( $form_post ) ) {
$ret['error'] = esc_html__( 'Invalid form ID', 'ultimate-member' );
wp_send_json_error( $ret );
}
$uploaded_file = $uploaded['handle_upload'];
$ret['url'] = $uploaded_file['file_info']['name'];
$ret['icon'] = UM()->files()->get_fonticon_by_ext( $uploaded_file['file_info']['ext'] );
$ret['icon_bg'] = UM()->files()->get_fonticon_bg_by_ext( $uploaded_file['file_info']['ext'] );
$ret['filename'] = $uploaded_file['file_info']['basename'];
$ret['original_name'] = $uploaded_file['file_info']['original_name'];
if ( 'um_form' !== $form_post->post_type ) {
$ret['error'] = esc_html__( 'Invalid form post type', 'ultimate-member' );
wp_send_json_error( $ret );
}
$form_status = get_post_status( $form_id );
if ( 'publish' !== $form_status ) {
$ret['error'] = esc_html__( 'Invalid form status', 'ultimate-member' );
wp_send_json_error( $ret );
}
$post_data = UM()->query()->post_data( $form_id );
if ( ! array_key_exists( 'mode', $post_data ) || $mode !== $post_data['mode'] ) {
$ret['error'] = esc_html__( 'Invalid form type', 'ultimate-member' );
wp_send_json_error( $ret );
}
// For profiles only.
if ( 'profile' === $mode && ! empty( $post_data['use_custom_settings'] ) && ! empty( $post_data['role'] ) ) {
// Option "Apply custom settings to this form". Option "Make this profile form role-specific".
// Show the first Profile Form with role selected, don't show profile forms below the page with other role-specific setting.
$current_user_roles = UM()->roles()->get_all_user_roles( $user_id );
if ( empty( $current_user_roles ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( is_array( $post_data['role'] ) ) {
if ( ! count( array_intersect( $post_data['role'], $current_user_roles ) ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
} elseif ( ! in_array( $post_data['role'], $current_user_roles, true ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this user through this form', 'ultimate-member' );
wp_send_json_error( $ret );
}
} else {
$ret['error'] = __('A theme or plugin compatibility issue','ultimate-member');
}
$id = sanitize_text_field( $_POST['key'] );
if ( ! array_key_exists( 'custom_fields', $post_data ) || empty( $post_data['custom_fields'] ) ) {
$ret['error'] = esc_html__( 'Invalid form fields', 'ultimate-member' );
wp_send_json_error( $ret );
}
$custom_fields = maybe_unserialize( $post_data['custom_fields'] );
if ( ! is_array( $custom_fields ) || ! array_key_exists( $id, $custom_fields ) ) {
$ret['error'] = esc_html__( 'Invalid field metakey', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( 'profile' === $mode && ! um_can_edit_field( $custom_fields[ $id ] ) ) {
$ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' );
wp_send_json_error( $ret );
}
if ( isset( $_FILES[ $id ]['name'] ) ) {
if ( ! is_array( $_FILES[ $id ]['name'] ) ) {
UM()->uploader()->replace_upload_dir = true;
$uploaded = UM()->uploader()->upload_file( $_FILES[ $id ], $user_id, $id );
UM()->uploader()->replace_upload_dir = false;
if ( isset( $uploaded['error'] ) ) {
$ret['error'] = $uploaded['error'];
} else {
$uploaded_file = $uploaded['handle_upload'];
$ret['url'] = $uploaded_file['file_info']['name'];
$ret['icon'] = UM()->files()->get_fonticon_by_ext( $uploaded_file['file_info']['ext'] );
$ret['icon_bg'] = UM()->files()->get_fonticon_bg_by_ext( $uploaded_file['file_info']['ext'] );
$ret['filename'] = $uploaded_file['file_info']['basename'];
$ret['original_name'] = $uploaded_file['file_info']['original_name'];
}
}
} else {
$ret['error'] = esc_html__( 'A theme or plugin compatibility issue', 'ultimate-member' );
}
wp_send_json_success( $ret );
}
/**
* Allowed image types
*