diff --git a/README.md b/README.md index dfc29595..ecebd89d 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ GNU Version 2 or Any Later Version ### IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSION 2.6.7 PATCHES SECURITY PRIVILEGE ESCALATION VULNERABILITY. PLEASE SEE [THIS ARTICLE](https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions) FOR MORE INFORMATION -[Official Release Version: 2.6.7](https://github.com/ultimatemember/ultimatemember/releases/tag/2.6.7). +[Official Release Version: 2.6.8](https://github.com/ultimatemember/ultimatemember/releases/tag/2.6.8). ## Changelog diff --git a/includes/admin/assets/css/um-admin-builder.css b/includes/admin/assets/css/um-admin-builder.css index 832b6def..6a6e4201 100644 --- a/includes/admin/assets/css/um-admin-builder.css +++ b/includes/admin/assets/css/um-admin-builder.css @@ -1,3 +1,35 @@ +@-webkit-keyframes um-ajax-spinning { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); } + 100% { + -webkit-transform: rotate(360deg); + transform: rotate(360deg); } } + +@-moz-keyframes um-ajax-spinning { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); } + 100% { + -webkit-transform: rotate(360deg); + transform: rotate(360deg); } } + +@-ms-keyframes um-ajax-spinning { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); } + 100% { + -webkit-transform: rotate(360deg); + transform: rotate(360deg); } } + +@keyframes um-ajax-spinning { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); } + 100% { + -webkit-transform: rotate(360deg); + transform: rotate(360deg); } } + /* - General */ @@ -101,6 +133,7 @@ position: relative; padding: 60px 20px 20px 20px; margin: 0 0 60px 0; + position: relative; } .um-admin-drag-row:last-child {margin-bottom: 0} @@ -278,10 +311,49 @@ position: relative; } +.um-admin-row-loading { + position: absolute; + width: 100%; + height: calc( 100% + 30px ); + top: -30px; + left: 0; + background: rgba(241, 241, 241, 0.6); + z-index: 999; + display: none; +} +.um-admin-row-loading > span { + display: block; + -webkit-transition: 0.1s opacity; + -moz-transition: 0.1s opacity; + -ms-transition: 0.1s opacity; + -o-transition: 0.1s opacity; + transition: 0.1s opacity; + color: #c6c6c6 !important; + -webkit-animation: um-ajax-spinning 1.1s infinite linear; + animation: um-ajax-spinning 1.1s infinite linear; + border-top: 0.2em solid rgba(0, 0, 0, 1); + border-right: 0.2em solid rgba(0, 0, 0, 1); + border-bottom: 0.2em solid rgba(0, 0, 0, 1); + border-left: 0.2em solid #c6c6c6; + font-size: 1.75em; + filter: alpha(opacity=0); + -ms-transform: translateZ(0); + transform: translateZ(0); + border-radius: 50%; + width: 40px; + height: 40px; + margin: -20px 0 0 -20px; + outline: 0; + padding: 0; + vertical-align: baseline; + position: absolute; + left: 50%; + top: 50%; +} + /* - UI Placeholders */ - .um-row-placeholder { width: 100%; border: 2px dashed #aaa; @@ -315,4 +387,4 @@ #UM_preview_form .um-admin-modal-body { position: relative; -} \ No newline at end of file +} diff --git a/includes/admin/assets/css/um-admin-global.css b/includes/admin/assets/css/um-admin-global.css index c33b5c1f..b38567b6 100644 --- a/includes/admin/assets/css/um-admin-global.css +++ b/includes/admin/assets/css/um-admin-global.css @@ -3,6 +3,11 @@ color: #555; } +.um-admin-notice.notice-warning { + border-color: #dba617 !important; + color: #555; +} + .um-admin-notice.upgraded { border-color: #0085ba !important; color: #555; diff --git a/includes/admin/assets/css/um-admin-settings.css b/includes/admin/assets/css/um-admin-settings.css index 8dab9844..4bcac0c7 100644 --- a/includes/admin/assets/css/um-admin-settings.css +++ b/includes/admin/assets/css/um-admin-settings.css @@ -1,49 +1,52 @@ .um-settings-section .description { - font-style: italic; + font-style: italic; } - - - - - -.um-notification-status { - margin-right: 18px; - font-size: 28px; - line-height: 22px; +.um-block-notice { + background: #fff; + font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen-Sans,Ubuntu,Cantarell,Helvetica Neue,sans-serif; + font-size:13px; + padding: 20px; + border: 1px solid #000; } .um-notification-status { - color: #a00; - float:left; - box-sizing: border-box; - -moz-box-sizing: border-box; - -webkit-box-sizing: border-box; + margin-right: 18px; + font-size: 28px; + line-height: 22px; +} + +.um-notification-status { + color: #a00; + float:left; + box-sizing: border-box; + -moz-box-sizing: border-box; + -webkit-box-sizing: border-box; } .um-notification-status.um-notification-is-active { - color: #46b450; + color: #46b450; } .um-email-configure span { - line-height: 24px; + line-height: 24px; } .um-long-field { - width:100%; + width:100%; } .um-medium-field { - width:50%; + width:50%; } .um-small-field { - width:25%; + width:25%; } .column-configure { - width: 60px; - text-align: center; + width: 60px; + text-align: center; } .wp-list-table.templates .column-core_version { @@ -61,47 +64,47 @@ } th.column-email.column-primary { - padding-left: 48px; + padding-left: 48px; } .um-nav-tab-wrapper { - margin-right: 20px; + margin-right: 20px; } #um-settings-emails { - float:left; - width:calc( 100% - 20px ); - margin-right: 20px; + float:left; + width:calc( 100% - 20px ); + margin-right: 20px; } #um-settings-form { - float:left; - width:calc( 100% - 10px ); - margin-right: 10px; + float:left; + width:calc( 100% - 10px ); + margin-right: 10px; } #um-settings-form .subsubsub { - float:left; - width:100%; + float:left; + width:100%; } .um-settings-line .multi-checkbox-line { - float:left; - width:100%; - clear: both; - margin: 0 0 10px 0; - padding: 0; + float:left; + width:100%; + clear: both; + margin: 0 0 10px 0; + padding: 0; } .um-settings-line .multi-checkbox-column { - float:left; - margin: 0; - padding:0; + float:left; + margin: 0; + padding:0; } .um-settings-line .multi-checkbox-column label { - float:left; - width:100%; + float:left; + width:100%; } @@ -113,120 +116,120 @@ th.column-email.column-primary { .wrap-licenses td, .wrap-licenses th, .wrap-licenses caption { - display: block; + display: block; } .wrap-licenses .form-table tr { - float: left; - margin: 0 15px 15px 0; - background: #fff; - border: 1px solid #ccc; - width: 30.5%; - max-width: 350px; - padding: 14px; - min-height: 240px; - position: relative; - box-sizing: border-box; + float: left; + margin: 0 15px 15px 0; + background: #fff; + border: 1px solid #ccc; + width: 30.5%; + max-width: 350px; + padding: 14px; + min-height: 240px; + position: relative; + box-sizing: border-box; } .wrap-licenses .form-table th { - background: #f9f9f9; - padding: 14px; - border-bottom: 1px solid #ccc; - margin: -14px -14px 20px; - width: 100%; + background: #f9f9f9; + padding: 14px; + border-bottom: 1px solid #ccc; + margin: -14px -14px 20px; + width: 100%; } .wrap-licenses .form-table td { - padding: 0; + padding: 0; } .wrap-licenses td input.regular-text { - margin: 0 0 8px; - width: 100%; + margin: 0 0 8px; + width: 100%; } .wrap-licenses .edd-license-data[class*="edd-license-"] { - position: absolute; - background: #fafafa; - padding: 14px; - border-top: 1px solid #eee; - margin: 20px -14px -14px; - min-height: 67px; - width: 100%; - bottom: 14px; - box-sizing: border-box; + position: absolute; + background: #fafafa; + padding: 14px; + border-top: 1px solid #eee; + margin: 20px -14px -14px; + min-height: 67px; + width: 100%; + bottom: 14px; + box-sizing: border-box; } .wrap-licenses .edd-license-data[class*="edd-license-"] a { - color: #444; + color: #444; } .wrap-licenses .edd-license-data[class*="edd-license-"] a:hover { - text-decoration: none; + text-decoration: none; } .wrap-licenses .edd-license-data.license-expires-soon-notice { - background-color: #00a0d2; - color: #fff; - border-color: #00a0d2; + background-color: #00a0d2; + color: #fff; + border-color: #00a0d2; } .wrap-licenses .edd-license-data.edd-license-expired { - background-color: #e24e4e; - color: #fff; - border-color: #e24e4e; + background-color: #e24e4e; + color: #fff; + border-color: #e24e4e; } .wrap-licenses .edd-license-data.edd-license-valid { - background-color: #5abc55; - color: #fff; - border-color: #5abc55; + background-color: #5abc55; + color: #fff; + border-color: #5abc55; } .wrap-licenses .edd-license-data.edd-license-error, .wrap-licenses .edd-license-data.edd-license-missing, .wrap-licenses .edd-license-data.edd-license-invalid, .wrap-licenses .edd-license-data.edd-license-site_inactive, .wrap-licenses .edd-license-data.edd-license-item_name_mismatch { - background-color: #ffebcd; - border-color: #ffebcd; + background-color: #ffebcd; + border-color: #ffebcd; } .wrap-licenses .edd-license-data p { - font-size: 13px; - margin-top: 0; + font-size: 13px; + margin-top: 0; } .wrap-licenses .edd-license-data.license-expires-soon-notice a, .wrap-licenses .edd-license-data.edd-license-expired a { - color: #fff; + color: #fff; } .wrap-licenses .edd-license-data.license-expires-soon-notice a:hover, .wrap-licenses .edd-license-data.edd-license-expired a:hover { - text-decoration: none; + text-decoration: none; } .wrap-licenses ~ p.submit { - clear: both; + clear: both; } @media screen and (max-width: 980px) { - .wrap-licenses .form-table tr { - width:calc( 50% - 15px ); - max-width: none; - } + .wrap-licenses .form-table tr { + width:calc( 50% - 15px ); + max-width: none; + } } @media screen and (max-width: 782px) { - .wrap-licenses .form-table tr { - width:100%; - margin-right: 0; - max-width: none; - } + .wrap-licenses .form-table tr { + width:100%; + margin-right: 0; + max-width: none; + } - .um-settings-line .multi-checkbox-column { - width:100% !important; - } - .um-settings-line .multi-checkbox-column label { - line-height: 30px !important; - } + .um-settings-line .multi-checkbox-column { + width:100% !important; + } + .um-settings-line .multi-checkbox-column label { + line-height: 30px !important; + } - .um-medium-field { - width:100%; - } + .um-medium-field { + width:100%; + } - .um-small-field { - width:50%; - } + .um-small-field { + width:50%; + } .wp-list-table.templates .column-core_version { width: auto; @@ -241,30 +244,30 @@ th.column-email.column-primary { /* .email_template_wrapper .copy_button_overlay { - position:absolute; - top:0; - bottom:0; - width:calc( 100% - 30px ); - z-index: 2; - background: rgba( 241, 241, 241, 0.95 ); - text-align: center; - padding-top: 30%; - padding-right: 20px; - padding-left: 20px; + position:absolute; + top:0; + bottom:0; + width:calc( 100% - 30px ); + z-index: 2; + background: rgba( 241, 241, 241, 0.95 ); + text-align: center; + padding-top: 30%; + padding-right: 20px; + padding-left: 20px; } .email_template_wrapper .copy_button_overlay > span { - color: #444; - margin: 0 0 15px 0; - display: inline-block; + color: #444; + margin: 0 0 15px 0; + display: inline-block; } .email_template_wrapper.in_theme .copy_button_overlay { - display: none !important; + display: none !important; } */ .um_setting_ajax_button_response.complete { - color:darkgreen; - font-style: italic; + color:darkgreen; + font-style: italic; } diff --git a/includes/admin/assets/js/um-admin-ajax.js b/includes/admin/assets/js/um-admin-ajax.js index ebca1cb3..adfb5fdf 100644 --- a/includes/admin/assets/js/um-admin-ajax.js +++ b/includes/admin/assets/js/um-admin-ajax.js @@ -1,3 +1,31 @@ +function um_builder_delete_field_ajax( callback ) { + if ( UM.admin.builder.fieldsToDelete.length > 0 ) { + let fieldDelete = UM.admin.builder.fieldsToDelete.shift(); + let arg1 = jQuery( fieldDelete ).find('[data-silent_action="um_admin_remove_field"]').data('arg1'); + let arg2 = jQuery( fieldDelete ).find('[data-silent_action="um_admin_remove_field"]').data('arg2'); + + jQuery.ajax({ + url: wp.ajax.settings.url, + type: 'POST', + data: { + action:'um_do_ajax_action', + act_id : 'um_admin_remove_field', + arg1 : arg1, + arg2 : arg2, + nonce: um_admin_scripts.nonce + }, + success: function( data ) { + um_builder_delete_field_ajax( callback ); + }, + error: function( data ) { + callback(); + } + }); + } else { + callback(); + } +} + jQuery(document).ready(function() { jQuery(document).ajaxStart( function() { @@ -9,6 +37,10 @@ jQuery(document).ready(function() { return false; } + var act_id = jQuery(this).data('silent_action'); + var arg1 = jQuery(this).data('arg1'); + var arg2 = jQuery(this).data('arg2'); + var in_row = ''; var in_sub_row = ''; var in_column = ''; @@ -22,10 +54,6 @@ jQuery(document).ready(function() { in_group = demon_settings.data('in_group'); } - var act_id = jQuery(this).data('silent_action'); - var arg1 = jQuery(this).data('arg1'); - var arg2 = jQuery(this).data('arg2'); - jQuery('.tipsy').hide(); um_admin_remove_modal(); @@ -55,4 +83,4 @@ jQuery(document).ready(function() { return false; }); -}); \ No newline at end of file +}); diff --git a/includes/admin/assets/js/um-admin-builder.js b/includes/admin/assets/js/um-admin-builder.js index 9c797323..d59d22f3 100644 --- a/includes/admin/assets/js/um-admin-builder.js +++ b/includes/admin/assets/js/um-admin-builder.js @@ -42,4 +42,4 @@ jQuery( document ).ready( function() { if ( um_admin_builder_data.hide_footer ) { jQuery('#wpfooter').hide(); } -}); \ No newline at end of file +}); diff --git a/includes/admin/assets/js/um-admin-dragdrop.js b/includes/admin/assets/js/um-admin-dragdrop.js index 0e05c389..e6933112 100644 --- a/includes/admin/assets/js/um-admin-dragdrop.js +++ b/includes/admin/assets/js/um-admin-dragdrop.js @@ -1,3 +1,16 @@ +if ( typeof (window.UM) !== 'object' ) { + window.UM = {}; +} + +if ( typeof (window.UM.admin) !== 'object' ) { + window.UM.admin = {}; +} + +UM.admin.builder = { + deleteProcess: [], + fieldsToDelete: [], +} + function UM_Drag_and_Drop() { jQuery('.um-admin-drag-col,.um-admin-drag-group').sortable({ items: '.um-admin-drag-fld', @@ -5,66 +18,66 @@ function UM_Drag_and_Drop() { placeholder: "um-fld-placeholder", forcePlaceholderSize:true, update: function(event, ui){ - + jQuery('#publish').attr('disabled','disabled'); - + if ( ui.item.hasClass('um-field-type-group') && ui.item.parents('.um-field-type-group').length > 0 ) { - + jQuery('.um-admin-drag-col,.um-admin-drag-group').sortable('cancel'); - + jQuery('#publish').prop('disabled', false); - + } else { - + UM_Change_Field_Col(); - + UM_Change_Field_Grp(); - + UM_Rows_Refresh(); - + } - + } }); - + jQuery('.um-admin-drag-rowsubs').sortable({ items: '.um-admin-drag-rowsub', placeholder: "um-rowsub-placeholder", forcePlaceholderSize:true, zIndex: 9999999999, update: function(){ - + jQuery('#publish').attr('disabled','disabled'); - + UM_update_subrows(); - + UM_Rows_Refresh(); - + } }).disableSelection(); - + jQuery('.um-admin-drag-rowsub').sortable({ items: '.um-admin-drag-col', zIndex: 9999999999, update: function(){ - + jQuery('#publish').attr('disabled','disabled'); - + row = jQuery(this); row.find('.um-admin-drag-col').removeClass('cols-1 cols-2 cols-3 cols-last cols-middle'); row.find('.um-admin-drag-col').addClass('cols-' + row.find('.um-admin-drag-col').length ); row.find('.um-admin-drag-col:last').addClass('cols-last'); if ( row.find('.um-admin-drag-col').length == 3 ) {row.find('.um-admin-drag-col:eq(1)').addClass('cols-middle');} - + UM_Change_Field_Col(); - + UM_Change_Field_Grp(); - + UM_Rows_Refresh(); - + } }).disableSelection(); - + jQuery('.um-admin-drag-ajax').sortable({ items: '.um-admin-drag-row', handle: ".um-admin-drag-row-start", @@ -75,15 +88,15 @@ function UM_Drag_and_Drop() { jQuery('.tipsy').remove(); }, update: function(){ - + jQuery('#publish').attr('disabled','disabled'); - + UM_update_rows(); - + UM_Change_Field_Col(); - + UM_Change_Field_Grp(); - + UM_Rows_Refresh(); } @@ -152,7 +165,7 @@ function UM_Change_Field_Grp(){ function UM_Rows_Refresh(){ jQuery('.um_update_order_fields').empty(); - + /* ROWS */ var c = 0; jQuery('.um-admin-drag-row').each(function(){ @@ -162,41 +175,41 @@ function UM_Rows_Refresh(){ col_num = ''; row.find('.um-admin-drag-rowsub').each(function(){ - + subrow = jQuery(this); - + subrow.find('.um-admin-drag-col').removeClass('cols-1 cols-2 cols-3 cols-last cols-middle'); subrow.find('.um-admin-drag-col').addClass('cols-' + subrow.find('.um-admin-drag-col').length ); subrow.find('.um-admin-drag-col:last').addClass('cols-last'); if ( subrow.find('.um-admin-drag-col').length == 3 ) {subrow.find('.um-admin-drag-col:eq(1)').addClass('cols-middle');} - + if ( !col_num ) { col_num = subrow.find('.um-admin-drag-col').length; } else { col_num = col_num + ':' + subrow.find('.um-admin-drag-col').length; } - + }); - + jQuery('.um_update_order_fields').append(''); - + sub_rows_count = row.find('.um-admin-drag-rowsub').length; - + var origin_id = jQuery(this).attr('data-original'); jQuery('.um_update_order_fields').append(''); jQuery('.um_update_order_fields').append(''); jQuery('.um_update_order_fields').append(''); - + jQuery(this).attr('data-original', '_um_row_'+c ); - + }); /* FIELDS */ var order; order = 0; jQuery('.um-admin-drag-col .um-admin-drag-fld').each(function(){ - + if ( !jQuery(this).hasClass('group') ) { var group = jQuery(this).data('group'); if ( group != '' ) { @@ -210,14 +223,14 @@ function UM_Rows_Refresh(){ jQuery('.um_update_order_fields').append(''); } } - + order++; row = jQuery(this).parents('.um-admin-drag-row').index()+1; row = '_um_row_'+row; - + saved_col = jQuery(this).data('column'); - + if ( saved_col == 3 ){ jQuery(this).appendTo( jQuery(this).parents('.um-admin-drag-rowsub').find('.um-admin-drag-col:eq(2)') ); } @@ -226,21 +239,21 @@ function UM_Rows_Refresh(){ } sub_row = jQuery(this).parents('.um-admin-drag-rowsub').index(); - + jQuery('.um_update_order_fields').append(''); - + jQuery('.um_update_order_fields').append(''); - + jQuery('.um_update_order_fields').append(''); - + jQuery('.um_update_order_fields').append(''); - + }); - + UM_Drag_and_Drop(); - + UM_Add_Icon(); - + jQuery.ajax({ url: wp.ajax.settings.url, type: 'POST', @@ -249,38 +262,38 @@ function UM_Rows_Refresh(){ jQuery('#publish').prop('disabled', false); } }); - + } function UM_Add_Icon(){ var add_icon_html = ''; - + jQuery('.um-admin-drag-col').each(function(){ if ( jQuery(this).find('.um-admin-drag-add-field').length == 0 ) { jQuery(this).append(add_icon_html); } else { jQuery(this).find('.um-admin-drag-add-field').remove(); - jQuery(this).append(add_icon_html); + jQuery(this).append(add_icon_html); } }); - + jQuery('.um-admin-drag-group').each(function(){ if ( jQuery(this).find('.um-admin-drag-add-field').length == 0 ) { jQuery(this).append(add_icon_html); } else { jQuery(this).find('.um-admin-drag-add-field').remove(); - jQuery(this).append(add_icon_html); + jQuery(this).append(add_icon_html); } }); - + } jQuery(document).ready(function() { if ( !jQuery('.um-admin-drag').length ) { return false; } - + UM_Drag_and_Drop(); /* add field to respected area */ @@ -302,19 +315,19 @@ jQuery(document).ready(function() { in_column = 1; } } - + if ( jQuery(this).parents('.um-admin-drag-group').length ) { in_group = jQuery(this).parents('.um-admin-drag-fld.um-field-type-group').data('key'); } else { in_group = ''; } - + jQuery('.um-col-demon-settings').data('in_row', in_row); jQuery('.um-col-demon-settings').data('in_sub_row', in_sub_row); jQuery('.um-col-demon-settings').data('in_column', in_column); jQuery('.um-col-demon-settings').data('in_group', in_group); }); - + /* add row */ jQuery(document.body).on('click', '*[data-row_action="add_row"]', function(){ var dragg = jQuery('.um-admin-drag-ajax'); @@ -325,7 +338,7 @@ jQuery(document).ready(function() { UM_update_subrows(); UM_Rows_Refresh(); }); - + /* add sub row */ jQuery(document.body).on('click', '*[data-row_action="add_subrow"]', function(){ var dragg = jQuery(this).parents('.um-admin-drag-row').find('.um-admin-drag-rowsubs'); @@ -333,23 +346,69 @@ jQuery(document).ready(function() { UM_update_subrows(); UM_Rows_Refresh(); }); - - /* remove element */ - jQuery(document.body).on('click', 'a[data-remove_element^="um-"]',function(){ - element = jQuery(this).data('remove_element'); - jQuery(this).parents('.' +element).find('.um-admin-drag-fld').each(function(){ - jQuery(this).find('a[data-silent_action="um_admin_remove_field"]').trigger('click'); + /* remove element: Row, Subrow */ + jQuery(document.body).on('click', 'a[data-remove_element^="um-"]',function(){ + let deleteButton = jQuery(this); + let element = jQuery(this).data('remove_element'); + let loadingWrapper = jQuery(this).parents('.' + element ).children('.um-admin-row-loading'); + + let row = jQuery(this).parents('.um-admin-drag-row').index(); + let subrow = jQuery(this).parents('.um-admin-drag-rowsub').index(); + + let fieldPosition= {row,subrow}; + let deleteExists= false; + jQuery.each( UM.admin.builder.deleteProcess, function(i) { + if ( fieldPosition.row === UM.admin.builder.deleteProcess[i].row && fieldPosition.subrow === UM.admin.builder.deleteProcess[i].subrow ) { + deleteExists = true; + return false; + } }); - - jQuery(this).parents('.' +element).remove(); - jQuery('.tipsy').remove(); - UM_Rows_Refresh(); + + if ( deleteExists ) { + return; + } + + loadingWrapper.show(); + + UM.admin.builder.deleteProcess.push({row,subrow}); + + UM.admin.builder.fieldsToDelete = jQuery(this).parents('.' +element).find('.um-admin-drag-fld').toArray(); + + if ( UM.admin.builder.fieldsToDelete.length > 0 ) { + um_builder_delete_field_ajax( function () { + deleteButton.parents('.' +element).remove(); + jQuery('.tipsy').remove(); + UM_Rows_Refresh(); + + jQuery.each( UM.admin.builder.deleteProcess, function(i) { + if ( fieldPosition.row === UM.admin.builder.deleteProcess[i].row && fieldPosition.subrow === UM.admin.builder.deleteProcess[i].subrow ) { + UM.admin.builder.deleteProcess.splice(i, 1); + return false; + } + }); + + loadingWrapper.hide(); + } ); + } else { + jQuery(this).parents('.' +element).remove(); + jQuery('.tipsy').remove(); + UM_Rows_Refresh(); + + jQuery.each( UM.admin.builder.deleteProcess, function(i) { + if ( fieldPosition.row === UM.admin.builder.deleteProcess[i].row && fieldPosition.subrow === UM.admin.builder.deleteProcess[i].subrow ) { + UM.admin.builder.deleteProcess.splice(i, 1); + return false; + } + }); + + loadingWrapper.hide(); + } }); - + /* dynamically change columns */ jQuery(document.body).on('click', '.um-admin-drag-ctrls.columns a', function(){ - + var row = jQuery(this).parents('.um-admin-drag-rowsub'); var tab = jQuery(this); var tabs = jQuery(this).parent(); @@ -358,21 +417,21 @@ jQuery(document).ready(function() { var existing_cols = row.find('.um-admin-drag-col').length; var required_cols = tab.data('cols'); var needed_cols = required_cols - existing_cols; - + if ( needed_cols > 0 ) { - + for (i = 0; i < needed_cols; i++){ row.find('.um-admin-drag-col-dynamic').append('
'); } - + row.find('.um-admin-drag-col').removeClass('cols-1 cols-2 cols-3 cols-last cols-middle'); row.find('.um-admin-drag-col').addClass('cols-' + row.find('.um-admin-drag-col').length ); row.find('.um-admin-drag-col:last').addClass('cols-last'); - + if ( row.find('.um-admin-drag-col').length == 3 ) {row.find('.um-admin-drag-col:eq(1)').addClass('cols-middle');} - + } else if ( needed_cols < 0 ) { - + needed_cols = needed_cols + 3; if ( needed_cols == 2 ) { row.find('.um-admin-drag-col:first').append( row.find('.um-admin-drag-col.cols-last').html() ); @@ -384,25 +443,25 @@ jQuery(document).ready(function() { row.find('.um-admin-drag-col.cols-last').remove(); row.find('.um-admin-drag-col.cols-middle').remove(); } - + row.find('.um-admin-drag-col').removeClass('cols-1 cols-2 cols-3 cols-last cols-middle'); row.find('.um-admin-drag-col').addClass('cols-' + row.find('.um-admin-drag-col:visible').length ); row.find('.um-admin-drag-col:last').addClass('cols-last'); - + } - + if ( allow_update_via_col_click == true ) { UM_Change_Field_Col(); UM_Rows_Refresh(); } }); - + /* trigger columns at start */ allow_update_via_col_click = false; jQuery('.um-admin-drag-ctrls.columns a.active').each(function(){ jQuery(this).trigger('click'); }).promise().done( function(){ allow_update_via_col_click = true; } ); - + UM_Rows_Refresh(); -}); \ No newline at end of file +}); diff --git a/includes/admin/assets/js/um-admin-field.js b/includes/admin/assets/js/um-admin-field.js index 0ff7ef15..cbb6c8e4 100644 --- a/includes/admin/assets/js/um-admin-field.js +++ b/includes/admin/assets/js/um-admin-field.js @@ -91,6 +91,7 @@ jQuery(document).ready(function() { um_admin_modal_responsive(); } else { jQuery('.um-col-demon-settings').data('in_row', '').data('in_sub_row', '').data('in_column', '').data('in_group', ''); + jQuery('.tipsy').hide(); um_admin_remove_modal(); um_admin_update_builder(); } diff --git a/includes/admin/assets/js/um-admin-modal.js b/includes/admin/assets/js/um-admin-modal.js index 48edbe1b..ead883f7 100644 --- a/includes/admin/assets/js/um-admin-modal.js +++ b/includes/admin/assets/js/um-admin-modal.js @@ -22,7 +22,7 @@ function um_admin_new_modal( id, ajax, size ) { jQuery('#' + id).prependTo('.um-admin-modal'); jQuery('#' + id).show(); jQuery('.um-admin-modal').show(); - + jQuery('.um-admin-modal-head').append(''); if ( ajax == true ) { @@ -92,7 +92,7 @@ function um_admin_modal_ajaxcall( act_id, arg1, arg2, arg3 ) { in_sub_row = ''; in_column = ''; in_group = ''; - + if ( jQuery('.um-col-demon-settings').data('in_column') ) { in_row = jQuery('.um-col-demon-settings').data('in_row'); in_sub_row = jQuery('.um-col-demon-settings').data('in_sub_row'); @@ -101,7 +101,7 @@ function um_admin_modal_ajaxcall( act_id, arg1, arg2, arg3 ) { } var form_mode = jQuery('input[type=hidden][id=form__um_mode]').val(); - + jQuery.ajax({ url: wp.ajax.settings.url, type: 'POST', @@ -186,19 +186,23 @@ function um_admin_remove_modal() { /*tinyMCE.execCommand('mceRemoveEditor', true, 'um_editor_edit'); jQuery('.um-hidden-editor-edit').html( jQuery('.um-admin-editor:visible').contents() ); tinyMCE.execCommand('mceAddEditor', true, 'um_editor_edit');*/ - + } else { jQuery('#wp-um_editor_new-wrap').remove(); /*tinyMCE.execCommand('mceRemoveEditor', true, 'um_editor_new'); jQuery('.um-hidden-editor-new').html( jQuery('.um-admin-editor:visible').contents() ); tinyMCE.execCommand('mceAddEditor', true, 'um_editor_new');*/ - + } jQuery('.um_tiny_placeholder').replaceWith( jQuery( $um_tiny_editor ).html() ); } + if ( 'undefined' !== typeof window.UM.admin.allTooltips && window.UM.admin.allTooltips.length > 0 ) { + window.UM.admin.allTooltips.tooltip('close'); + } + jQuery('.tipsy').hide(); jQuery('body').removeClass('um-admin-modal-open'); jQuery('.um-admin-modal div[id^="UM_"]').hide().appendTo('body'); jQuery('.um-admin-modal,.um-admin-overlay').remove(); @@ -226,7 +230,7 @@ function um_admin_modal_add_attr( id, value ) { **/ jQuery(document).ready(function() { - + /** disable link **/ @@ -234,7 +238,7 @@ jQuery(document).ready(function() { e.preventDefault(); return false; }); - + /** toggle area **/ @@ -298,7 +302,7 @@ jQuery(document).ready(function() { } ); }); - + /** reset conditions **/ @@ -311,7 +315,7 @@ jQuery(document).ready(function() { um_admin_live_update_scripts(); um_admin_modal_responsive(); }); - + /** remove a condition **/ @@ -336,14 +340,15 @@ jQuery(document).ready(function() { um_admin_live_update_scripts(); um_admin_modal_responsive(); }); - + /** remove modal via action **/ jQuery(document.body).on('click', '.um-admin-overlay, a[data-action="UM_remove_modal"]', function(){ + jQuery('.tipsy').hide(); um_admin_remove_modal(); }); - + /** fire new modal **/ @@ -353,26 +358,26 @@ jQuery(document).ready(function() { var modal_id = jQuery(this).attr('data-modal'); if ( jQuery(this).attr('data-back') ) { - + jQuery('#UM_fonticons').find('a.um-admin-modal-back').attr("data-modal", jQuery(this).attr('data-back') ); var current_icon = jQuery( '#' + jQuery(this).attr('data-back') ).find('input#_icon').val(); if ( current_icon == '' ) { jQuery('#UM_fonticons').find('.um-admin-icons span').removeClass('highlighted'); } - + } - + if ( jQuery(this).data('dynamic-content') ) { um_admin_new_modal( modal_id, true, jQuery(this).data('modal-size') ); um_admin_modal_ajaxcall( jQuery(this).data('dynamic-content'), jQuery(this).data('arg1'), jQuery(this).data('arg2'), jQuery(this).data('arg3') ); } else { um_admin_new_modal( modal_id ); } - + return false; }); - + /** choose font icon **/ @@ -382,7 +387,7 @@ jQuery(document).ready(function() { jQuery(this).addClass('highlighted'); jQuery('#UM_fonticons').find('a.um-admin-modal-back').attr("data-code", icon); }); - + /** submit font icon **/ @@ -401,10 +406,11 @@ jQuery(document).ready(function() { } jQuery(this).attr('data-code', ''); if ( v_id == '.postbox' ) { + jQuery('.tipsy').hide(); um_admin_remove_modal(); } }); - + /** restore font icon **/ @@ -419,7 +425,7 @@ jQuery(document).ready(function() { element.find('.um-admin-icon-value').html( wp.i18n.__( 'No Icon', 'ultimate-member' ) ); jQuery(this).hide(); }); - + /** search font icons **/ @@ -433,14 +439,14 @@ jQuery(document).ready(function() { um_admin_modal_responsive(); }); - + /** * Retrieve options from a callback function */ jQuery(document.body).on('blur',"#_custom_dropdown_options_source", function(){ var me = jQuery(this); var _options = jQuery('textarea[id=_options]'); - + if( me.val() != '' ){ var um_option_callback = me.val(); jQuery.ajax({ @@ -452,17 +458,17 @@ jQuery(document).ready(function() { nonce: um_admin_scripts.nonce }, complete: function(){ - + }, success: function( response ){ var arr_opts = []; - + for (var key in response.data ){ arr_opts.push( response.data[ key ] ); } _options.val( arr_opts.join('\n') ); - + } }); } diff --git a/includes/admin/assets/js/um-admin-scripts.js b/includes/admin/assets/js/um-admin-scripts.js index d1980756..f9e181ce 100644 --- a/includes/admin/assets/js/um-admin-scripts.js +++ b/includes/admin/assets/js/um-admin-scripts.js @@ -1,3 +1,11 @@ +if ( typeof (window.UM) !== 'object' ) { + window.UM = {}; +} + +if ( typeof (window.UM.admin) !== 'object' ) { + window.UM.admin = {}; +} + function um_admin_init_datetimepicker() { jQuery('.um-datepicker:not(.picker__input)').each(function(){ elem = jQuery(this); @@ -79,7 +87,7 @@ function um_admin_init_datetimepicker() { function um_init_tooltips() { if ( jQuery( '.um_tooltip' ).length > 0 ) { - jQuery( '.um_tooltip' ).tooltip({ + window.UM.admin.allTooltips = jQuery( '.um_tooltip' ).tooltip({ tooltipClass: "um_tooltip", content: function () { return jQuery( this ).attr( 'title' ); @@ -109,7 +117,7 @@ jQuery(document).ready(function() { }); return false; }); - + /** remove a field dropdown **/ @@ -124,7 +132,7 @@ jQuery(document).ready(function() { }); return false; }); - + /** Ajax link **/ @@ -132,7 +140,7 @@ jQuery(document).ready(function() { e.preventDefault(); return false; }); - + /** On/Off Buttons **/ @@ -149,7 +157,7 @@ jQuery(document).ready(function() { } } }); - + /** WP Color Picker **/ @@ -157,12 +165,12 @@ jQuery(document).ready(function() { jQuery('.um-admin-colorpicker').wpColorPicker(); } - + /** Tooltips **/ um_init_tooltips(); - + if( typeof tipsy !== 'undefined' ){ jQuery('.um-admin-tipsy-n').tipsy({gravity: 'n', opacity: 1, live: 'a.live' }); jQuery('.um-admin-tipsy-w').tipsy({gravity: 'w', opacity: 1, live: 'a.live' }); @@ -170,7 +178,7 @@ jQuery(document).ready(function() { jQuery('.um-admin-tipsy-s').tipsy({gravity: 's', opacity: 1, live: 'a.live' }); } - + /** Conditional fields **/ @@ -197,7 +205,7 @@ jQuery(document).ready(function() { jQuery('.' + jQuery(this).data('cond1-hide') ).show(); } } - + if ( jQuery(this).data('cond2') ) { if ( value == jQuery(this).data('cond2') ) { jQuery('.' + jQuery(this).data('cond2-show') ).show(); @@ -212,7 +220,7 @@ jQuery(document).ready(function() { jQuery('.' + jQuery(this).data('cond2-hide') ).show(); } } - + if ( jQuery(this).data('cond3') ) { if ( value == jQuery(this).data('cond3') ) { jQuery('.' + jQuery(this).data('cond3-show') ).show(); @@ -222,16 +230,16 @@ jQuery(document).ready(function() { jQuery('.' + jQuery(this).data('cond3-hide') ).show(); } } - + });jQuery('.um-adm-conditional').each(function(){jQuery(this).trigger('change');}); - + /** Conditional fields for Radio Group **/ jQuery('.um-conditional-radio-group input[type=radio]').on('click', function(){ var holder = jQuery('.um-conditional-radio-group'); - + var val = jQuery(this).val(); var cond1 = holder.data('cond1'); var show1 = holder.data('cond1-show'); @@ -240,7 +248,7 @@ jQuery(document).ready(function() { } else { jQuery('.' + show1).hide(); } - + var val2 = jQuery(this).val(); var cond2 = holder.data('cond2'); var show2 = holder.data('cond2-show'); @@ -249,7 +257,7 @@ jQuery(document).ready(function() { } else { jQuery('.' + show2).hide(); } - + });jQuery('.um-conditional-radio-group input[type=radio]:checked').each(function(){jQuery(this).trigger('click');}); @@ -258,7 +266,7 @@ jQuery(document).ready(function() { Conditional fields for nav-menu editor options **/ - + jQuery('.um-nav-mode').each( function() { if ( jQuery(this).find('select').val() == 2 ) { jQuery(this).parents('.um-nav-edit').find('.um-nav-roles').show(); @@ -275,4 +283,4 @@ jQuery(document).ready(function() { jQuery(this).parents('.um-nav-edit').find('.um-nav-roles').hide(); } }); -}); \ No newline at end of file +}); diff --git a/includes/admin/assets/js/um-admin-secure.js b/includes/admin/assets/js/um-admin-secure.js new file mode 100644 index 00000000..c4bc45d8 --- /dev/null +++ b/includes/admin/assets/js/um-admin-secure.js @@ -0,0 +1,78 @@ +jQuery(document).on("ready", function(){ + + const scan_results_wrapper = jQuery(".um-secure-scan-results"); + const scan_button_elem = jQuery(".um-secure-scan-content"); + const scan_capabilities = jQuery("input[data-field_id^='banned_capabilities']"); + + var UM_Secure = { + init: function() { + scan_results_wrapper.css({ + 'margin-top': '10px', + 'padding': '10px', + 'padding-bottom': '10px', + 'background-color': '#fff', + 'display': 'block', + 'max-height': '200px', + 'height': '500px', + 'overflow-y': 'scroll', + }); + + scan_button_elem.on("click", function(e){ + UM_Secure.effect(); + e.preventDefault(); + var me = jQuery(this); + me.prop("disabled", true); + scan_results_wrapper.empty(); + + UM_Secure.log( wp.i18n.__( 'Scanning site..', 'ultimate-member' ) ); + + UM_Secure.ajax(''); + + }); + scan_capabilities.on("change", function(){ + scan_button_elem.after( ' ' + wp.i18n.__( 'You can start the scan now but you must save the settings to apply the selected capabilities after the scan is complete.', 'ultimate-member' ) + '' ); + scan_capabilities.off("change"); + }) + }, + ajax: function( last_capability ) { + let checkedCaps = []; + let checkedCapsInputs = scan_results_wrapper.parents('.um-form-table').find('input[type="checkbox"][data-field_id^="banned_capabilities_"]:checked'); + checkedCapsInputs.each(function (){ + checkedCaps.push( jQuery(this).data('field_id').replace('banned_capabilities_', '') ); + }); + + var request = { + nonce: um_admin_scripts.nonce, + capabilities: checkedCaps, + last_scanned_capability: last_capability, + }; + + wp.ajax.send('um_secure_scan_affected_users', { + data: request, + success: function (response) { + if ( ! response.completed ) { + UM_Secure.ajax( response.last_scanned_capability ); + UM_Secure.log( response.message ); + } else if ( response.completed ) { + scan_results_wrapper.empty(); + UM_Secure.log( response.recommendations ); + scan_results_wrapper.find('.current').removeClass('current'); + scan_button_elem.removeAttr('disabled'); + } + }, + }); + }, + log: function( str ) { + scan_results_wrapper.find('.current').removeClass('current'); + scan_results_wrapper.append( '' + str + '
' ); + }, + effect: function() { + var blink = function(){ + scan_results_wrapper.find(".current").fadeTo(100, 0.1).fadeTo(200, 1.0); + }; + setInterval(blink, 1000); + } + }; + + UM_Secure.init(); +}); diff --git a/includes/admin/class-admin.php b/includes/admin/class-admin.php index d9131416..ef8f2544 100644 --- a/includes/admin/class-admin.php +++ b/includes/admin/class-admin.php @@ -88,6 +88,10 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { add_filter( 'post_updated_messages', array( &$this, 'post_updated_messages' ) ); } + public function includes() { + $this->notices(); + $this->secure(); + } function init_variables() { $this->role_meta = apply_filters( @@ -1076,7 +1080,6 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { return $value; } - /** * @param $value * @@ -1087,6 +1090,15 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { return $value; } + /** + * @param $value + * + * @return array + */ + public function sanitize_wp_capabilities_assoc( $value ) { + $value = array_map( 'sanitize_key', array_filter( $value ) ); + return $value; + } /** * Sanitize role meta fields when wp-admin form has been submitted @@ -1626,9 +1638,9 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { update_option( 'um_last_manual_upgrades_request', time() ); } - $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'got_updates' ), admin_url( 'admin.php' ) ); + $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_got_updates' ), admin_url( 'admin.php' ) ); } else { - $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'often_updates' ), admin_url( 'admin.php' ) ); + $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_often_updates' ), admin_url( 'admin.php' ) ); } exit( wp_redirect( $url ) ); } @@ -1687,7 +1699,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { $url = add_query_arg( array( 'page' => 'ultimatemember', - 'update' => 'cleared_cache', + 'update' => 'um_cleared_cache', ), admin_url( 'admin.php' ) ); @@ -1725,7 +1737,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { $url = add_query_arg( array( 'page' => 'ultimatemember', - 'update' => 'cleared_status_cache', + 'update' => 'um_cleared_status_cache', ), admin_url( 'admin.php' ) ); @@ -1745,7 +1757,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { UM()->files()->remove_dir( UM()->files()->upload_temp ); - $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'purged_temp' ), admin_url( 'admin.php' ) ); + $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_purged_temp' ), admin_url( 'admin.php' ) ); exit( wp_redirect( $url ) ); } @@ -1796,7 +1808,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { $url = add_query_arg( array( 'post_type' => 'um_form', - 'update' => 'form_duplicated', + 'update' => 'um_form_duplicated', ), admin_url( 'edit.php' ) ); @@ -1879,7 +1891,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { um_reset_user(); - wp_redirect( add_query_arg( 'update', 'user_updated', admin_url( '?page=ultimatemember' ) ) ); + wp_redirect( add_query_arg( 'update', 'um_user_updated', admin_url( '?page=ultimatemember' ) ) ); exit; } @@ -2056,17 +2068,28 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { return $parent_file; } - /** * @since 2.0 * * @return core\Admin_Notices() */ - function notices() { + public function notices() { if ( empty( UM()->classes['admin_notices'] ) ) { UM()->classes['admin_notices'] = new core\Admin_Notices(); } return UM()->classes['admin_notices']; } + + /** + * @since 2.6.8 + * + * @return Secure + */ + public function secure() { + if ( empty( UM()->classes['um\admin\secure'] ) ) { + UM()->classes['um\admin\secure'] = new Secure(); + } + return UM()->classes['um\admin\secure']; + } } } diff --git a/includes/admin/class-secure.php b/includes/admin/class-secure.php new file mode 100644 index 00000000..65f8ec79 --- /dev/null +++ b/includes/admin/class-secure.php @@ -0,0 +1,382 @@ +admin_enqueue()->js_url . 'um-admin-secure.js', array( 'jquery' ), UM_VERSION, true ); + wp_enqueue_script( 'um_admin_secure' ); + } + + /** + * Filter users by Register Date + * + * @since 2.6.8 + * @param object $query WP query `pre_get_users` + */ + public function filter_users_by_date_registered( $query ) { + global $pagenow; + if ( is_admin() && 'users.php' === $pagenow ) { + // phpcs:disable WordPress.Security.NonceVerification + $date_from = isset( $_GET['um_secure_date_from'] ) ? $_GET['um_secure_date_from'] : null; + $date_to = isset( $_GET['um_secure_date_to'] ) ? $_GET['um_secure_date_to'] : null; + // phpcs:enable WordPress.Security.NonceVerification + if ( ! $date_to ) { + $query->set( + 'date_query', + array( + 'after' => human_time_diff( $date_from, strtotime( current_time( 'mysql' ) ) ) . ' ago', + 'inclusive' => true, + ) + ); + } elseif ( $date_from && $date_to ) { + $query->set( + 'date_query', + array( + 'after' => human_time_diff( $date_from, strtotime( current_time( 'mysql' ) ) ) . ' ago', + 'before' => human_time_diff( $date_to, strtotime( current_time( 'mysql' ) ) ) . ' ago', + 'inclusive' => true, + ) + ); + } + } + + return $query; + } + + /** + * Handle secure actions. + * + * @since 2.6.8 + */ + public function admin_init() { + global $wpdb; + // Dismiss admin notice after the first visit to Secure settings page. + if ( isset( $_REQUEST['page'] ) && isset( $_REQUEST['tab'] ) && + 'um_options' === sanitize_key( $_REQUEST['page'] ) && 'secure' === sanitize_key( $_REQUEST['tab'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification + UM()->admin()->notices()->dismiss( 'secure_settings' ); + } + + if ( isset( $_REQUEST['um_secure_expire_all_sessions'] ) && ! wp_doing_ajax() ) { + if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'um-secure-expire-session-nonce' ) || ! current_user_can( 'manage_options' ) ) { + // This nonce is not valid or current logged-in user has no administrative rights. + wp_die( esc_html__( 'Security check', 'ultimate-member' ) ); + } + + /** + * Destroy all user sessions except the current logged-in user. + */ + $wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->usermeta . ' WHERE meta_key="session_tokens" AND user_id != %d', get_current_user_id() ) ); + + if ( UM()->options()->get( 'display_login_form_notice' ) ) { + global $wpdb; + $wpdb->query( + $wpdb->prepare( + "DELETE FROM {$wpdb->usermeta} WHERE user_id != %d AND ( meta_key = 'um_secure_has_reset_password' OR meta_key = 'um_secure_has_reset_password__timestamp' )", + get_current_user_id() + ) + ); + } + + wp_safe_redirect( add_query_arg( 'update', 'um_secure_expire_sessions', wp_get_referer() ) ); + exit; + } + + if ( isset( $_REQUEST['um_secure_restore_account'], $_REQUEST['user_id'] ) && ! wp_doing_ajax() ) { + $user_id = absint( $_REQUEST['user_id'] ); + if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'um-security-restore-account-nonce-' . $user_id ) || ! current_user_can( 'manage_options' ) ) { + // This nonce is not valid or current logged-in user has no administrative rights. + wp_die( esc_html__( 'Security check', 'ultimate-member' ) ); + } + + $user = get_userdata( $user_id ); + if ( ! $user ) { + wp_die( esc_html__( 'Invalid user.', 'ultimate-member' ) ); + } + + um_fetch_user( $user_id ); + $metadata = get_user_meta( $user_id, 'um_user_blocked__metadata', true ); + $user->update_user_level_from_caps(); + + // Restore Roles. + if ( isset( $metadata['roles'] ) ) { + foreach ( $metadata['roles'] as $role ) { + $user->add_role( $role ); + } + } + // Restore Account Status. + if ( isset( $metadata['account_status'] ) ) { + UM()->user()->set_status( $metadata['account_status'] ); + } + + // Delete blocked meta. + delete_user_meta( $user_id, 'um_user_blocked__metadata' ); + delete_user_meta( $user_id, 'um_user_blocked' ); + delete_user_meta( $user_id, 'um_user_blocked__timestamp' ); + + // Don't need to reset a password. + if ( UM()->options()->get( 'display_login_form_notice' ) ) { + update_user_meta( $user_id, 'um_secure_has_reset_password', true ); + update_user_meta( $user_id, 'um_secure_has_reset_password__timestamp', current_time( 'mysql' ) ); + } + + // Clear Cache. + UM()->user()->remove_cache( $user_id ); + um_reset_user(); + wp_safe_redirect( add_query_arg( 'update', 'um_secure_restore', wp_get_referer() ) ); + exit; + } + } + + /** + * Register Secure Settings + * + * @since 2.6.8 + * + * @param array $settings + * @return array + */ + public function add_settings( $settings ) { + $nonce = wp_create_nonce( 'um-secure-expire-session-nonce' ); + $count_users = count_users(); + + $banned_capabilities = array(); + $banned_admin_capabilities = UM()->common()->secure()->get_banned_capabilities_list(); + foreach ( $banned_admin_capabilities as $cap ) { + $banned_capabilities[ $cap ] = $cap; + } + + $disabled_capabilities = UM()->options()->get_default( 'banned_capabilities' ); + $disabled_capabilities_text = '' . implode( ', ', $disabled_capabilities ) . ''; + + $scanner_content = ''; + $scanner_content .= ''; + $scanner_content .= esc_html__( 'Last scan:', 'ultimate-member' ) . ' '; + $scan_status = get_option( 'um_secure_scan_status' ); + $last_scanned_time = get_option( 'um_secure_last_time_scanned' ); + if ( ! empty( $last_scanned_time ) ) { + $scanner_content .= human_time_diff( strtotime( $last_scanned_time ), strtotime( current_time( 'mysql' ) ) ) . ' ' . esc_html__( 'ago', 'ultimate-member' ); + if ( 'started' === $scan_status ) { + $scanner_content .= ' - ' . esc_html__( 'Not Completed.', 'ultimate-member' ); + } + } else { + $scanner_content .= esc_html__( 'Not Scanned yet.', 'ultimate-member' ); + } + $scanner_content .= ''; + + $secure_fields = array( + array( + 'id' => 'banned_capabilities', + 'type' => 'multi_checkbox', + 'multi' => true, + 'assoc' => true, + 'checkbox_key' => true, + 'columns' => 2, + 'options_disabled' => $disabled_capabilities, + 'options' => $banned_capabilities, + 'label' => __( 'Banned Administrative Capabilities', 'ultimate-member' ), + // translators: %s are disabled default capabilities that are enabled by default. + 'description' => sprintf( __( 'All the above are default Administrator & Super Admin capabilities. When someone tries to inject capabilities to the Account, Profile & Register forms submission, it will be flagged with this option. The %s capabilities are locked to ensure no users will be created with these capabilities.', 'ultimate-member' ), $disabled_capabilities_text ), + ), + array( + 'id' => 'secure_scan_affected_users', + 'type' => 'info_text', + 'label' => __( 'Scanner', 'ultimate-member' ), + 'value' => $scanner_content, + 'description' => __( 'Scan your site to check for vulnerabilities prior to Ultimate Member version 2.6.7 and get recommendations to secure your site.', 'ultimate-member' ), + ), + array( + 'id' => 'lock_register_forms', + 'type' => 'checkbox', + 'label' => __( 'Lock All Register Forms', 'ultimate-member' ), + 'description' => __( 'This prevents all users from registering with Ultimate Member on your site.', 'ultimate-member' ), + ), + array( + 'id' => 'display_login_form_notice', + 'type' => 'checkbox', + 'label' => __( 'Display Login form notice to reset passwords', 'ultimate-member' ), + 'description' => __( 'Enforces users to reset their passwords( one-time ) and prevent from entering old password.', 'ultimate-member' ), + ), + ); + + $count_users_exclude_me = $count_users['total_users'] - 1; + if ( $count_users_exclude_me > 0 ) { + $secure_fields[] = array( + 'id' => 'force_reset_passwords', + 'type' => 'info_text', + 'label' => __( 'Expire All Users Sessions', 'ultimate-member' ), + // translators: %d is the users count. + 'value' => '' . esc_html( sprintf( __( 'Logout Users (%d)', 'ultimate-member' ), $count_users_exclude_me ) ) . '', + 'description' => __( 'This will log out all users on your site and forces them to reset passwords
when "Display Login form notice to reset passwords" is enabled/checked.', 'ultimate-member' ), + ); + } + + $secure_fields = array_merge( + $secure_fields, + array( + array( + 'id' => 'secure_ban_admins_accounts', + 'type' => 'checkbox', + 'label' => __( 'Enable ban for administrative capabilities', 'ultimate-member' ), + 'description' => __( ' When someone tries to inject capabilities to the Account, Profile & Register forms submission, it will be banned.', 'ultimate-member' ), + ), + array( + 'id' => 'secure_notify_admins_banned_accounts', + 'type' => 'checkbox', + 'label' => __( 'Notify Administrators', 'ultimate-member' ), + 'description' => __( 'When enabled, All administrators will be notified when someone has suspicious activities in the Account, Profile & Register forms.', 'ultimate-member' ), + 'conditional' => array( 'secure_ban_admins_accounts', '=', 1 ), + ), + array( + 'id' => 'secure_notify_admins_banned_accounts__interval', + 'type' => 'select', + 'options' => array( + 'instant' => __( 'Send Immediately', 'ultimate-member' ), + 'hourly' => __( 'Hourly', 'ultimate-member' ), + 'daily' => __( 'Daily', 'ultimate-member' ), + ), + 'label' => __( 'Notification Schedule', 'ultimate-member' ), + 'conditional' => array( 'secure_notify_admins_banned_accounts', '=', 1 ), + ), + array( + 'id' => 'secure_allowed_redirect_hosts', + 'type' => 'textarea', + 'label' => __( 'Allowed hosts for safe redirect (one host per line)', 'ultimate-member' ), + 'description' => __( 'Extend allowed hosts for frontend pages redirects', 'ultimate-member' ), + ), + ) + ); + + $settings['secure'] = array( + 'title' => __( 'Secure', 'ultimate-member' ), + 'fields' => $secure_fields, + ); + + return $settings; + } + + /** + * Append blocked status to the `account_status` column rows. + * + * @param string $val Default column row value. + * @param string $column_name Current column name. + * @param int $user_id User ID in loop. + * + * @since 2.6.8 + * + * @return string + */ + public function add_restore_account( $val, $column_name, $user_id ) { + if ( 'account_status' === $column_name ) { + um_fetch_user( $user_id ); + $is_blocked = um_user( 'um_user_blocked' ); + $account_status = um_user( 'account_status' ); + if ( ! empty( $is_blocked ) && in_array( $account_status, array( 'rejected', 'inactive' ), true ) ) { + $datetime = um_user( 'um_user_blocked__timestamp' ); + $val .= '
' . esc_html__( 'Blocked Due to Suspicious Activity', 'ultimate-member' ) . '
'; + $nonce = wp_create_nonce( 'um-security-restore-account-nonce-' . $user_id ); + $restore_account_url = admin_url( 'users.php?user_id=' . $user_id . '&um_secure_restore_account=1&_wpnonce=' . $nonce ); + $action = ' · ' . esc_html__( 'Restore Account', 'ultimate-member' ) . ''; + if ( ! empty( $datetime ) ) { + $val .= '
' . human_time_diff( strtotime( $datetime ), strtotime( current_time( 'mysql' ) ) ) . ' ' . __( 'ago', 'ultimate-member' ) . '' . $action . '
'; + } + } + um_reset_user(); + } + return $val; + } + + /** + * + */ + public function check_secure_changes() { + if ( isset( $_POST['um_options']['display_login_form_notice'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification + $current_option_value = UM()->options()->get( 'display_login_form_notice' ); + if ( empty( $current_option_value ) ) { + return; + } + + if ( empty( $_POST['um_options']['display_login_form_notice'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification + $this->need_flush_meta = true; + } + } + } + + /** + * + */ + public function on_settings_save() { + if ( isset( $_POST['um_options']['display_login_form_notice'] ) && ! empty( $this->need_flush_meta ) ) { //phpcs:ignore WordPress.Security.NonceVerification + global $wpdb; + $wpdb->query( + "DELETE FROM {$wpdb->usermeta} WHERE meta_key = 'um_secure_has_reset_password' OR meta_key = 'um_secure_has_reset_password__timestamp'" + ); + } + + if ( isset( $_POST['um_options']['secure_notify_admins_banned_accounts'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification + if ( ! empty( $_POST['um_options']['secure_notify_admins_banned_accounts'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification + UM()->options()->update( 'suspicious-activity_on', 1 ); + } else { + UM()->options()->update( 'suspicious-activity_on', 0 ); + } + } + } + } +} diff --git a/includes/admin/core/class-admin-builder.php b/includes/admin/core/class-admin-builder.php index 265771e4..1ed73dbc 100644 --- a/includes/admin/core/class-admin-builder.php +++ b/includes/admin/core/class-admin-builder.php @@ -410,6 +410,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { if ( empty( $fields ) ) { ?>
+
@@ -419,6 +420,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
+
@@ -462,6 +464,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { foreach ( $rows as $row_id => $array ) { ?>
+
@@ -481,6 +484,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) { $subrow_fields = $this->get_fields_in_subrow( $row_fields, $c ); ?>
+