From 7bff69f52b10ac137fb5e53dc1c0569664431d86 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Mon, 26 Sep 2022 13:59:45 +0300 Subject: [PATCH] - fixed admin upgrade scripts and upgrades pack validation; --- includes/admin/core/class-admin-upgrade.php | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/includes/admin/core/class-admin-upgrade.php b/includes/admin/core/class-admin-upgrade.php index bff5b63b..e6d0c39c 100644 --- a/includes/admin/core/class-admin-upgrade.php +++ b/includes/admin/core/class-admin-upgrade.php @@ -356,10 +356,20 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) { if ( empty( $_POST['pack'] ) ) { exit(''); } else { - ob_start(); - include_once $this->packages_dir . sanitize_text_field( $_POST['pack'] ) . DIRECTORY_SEPARATOR . 'init.php'; - ob_get_flush(); - exit; + $pack = sanitize_text_field( $_POST['pack'] ); + if ( in_array( $pack, $this->necessary_packages, true ) ) { + $file = $this->packages_dir . $pack . DIRECTORY_SEPARATOR . 'init.php'; + if ( file_exists( $file ) ) { + ob_start(); + include_once $file; + ob_get_flush(); + exit; + } else { + exit(''); + } + } else { + exit(''); + } } } @@ -407,4 +417,4 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) { } } -} \ No newline at end of file +}