10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-11 18:56:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

Fix improper namespace usage and enhance regex validation due to CVE ID: CVE-2025-1702

Browse Source 
Replaced \WP_User_Query with correctly imported WP_User_Query to ensure proper namespace handling. Added a new regex pattern to block sleep injections, enhancing security within the member directory query validation.
This commit is contained in:
Mykyta Synelnikov
2025-02-28 12:13:15 +02:00
parent d107153244
commit 74647d42cc
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-member-directory.php
+5 -2
View File
@@ -1,6 +1,8 @@
<?php
namespace um\core;
use WP_User_Query;
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
@@ -1708,6 +1710,7 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
$regexp_map = array(
'/select(.*?)from/im',
'/select(.*?)sleep/im',
"/sleep\(\d+\)/im", // avoid any sleep injections
'/select(.*?)database/im',
'/select(.*?)where/im',
'/update(.*?)set/im',
@@ -1768,7 +1771,7 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
* @param $type
* @param $primary_table
* @param $primary_id_column
* @param \WP_User_Query $context
* @param WP_User_Query $context
*
* @return array
*/
@@ -2940,7 +2943,7 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
add_filter( 'pre_user_query', array( &$this, 'pagination_changes' ), 10, 1 );
$user_query = new \WP_User_Query( $this->query_args );
$user_query = new WP_User_Query( $this->query_args );
remove_filter( 'pre_user_query', array( &$this, 'pagination_changes' ), 10 );