").append(e.siblings(".um-hidden-multi-selects").clone()).html()+'
'+wp.i18n.__("Remove","ultimate-member")+"",e.append(i),e.find("li:last .um-hidden-multi-selects").attr("name",jQuery(this).data("name")).addClass("um-forms-field um-long-field").removeClass("um-hidden-multi-selects").attr("id",e.data("id_attr")+"-"+t))}),jQuery('.um-multi-selects-add-option[data-name="um_metadata[_um_search_exclude_fields][]"]').on("click",function(){jQuery('.um-multi-selects-list[data-field_id="_um_search_include_fields"] li.um-multi-selects-option-line').remove()}),jQuery('.um-multi-selects-add-option[data-name="um_metadata[_um_search_include_fields][]"]').on("click",function(){jQuery('.um-multi-selects-list[data-field_id="_um_search_exclude_fields"] li.um-multi-selects-option-line').remove()});var t,e=-(new Date).getTimezoneOffset()/60,i=(jQuery('input[name="um-gmt-offset"]').val(e),jQuery(".um-admin-metabox").find(".um-slider").each(function(){var e=jQuery(this),a=parseInt(e.data("min")),t=parseInt(e.data("max")),a=[a=void 0!==jQuery("#"+e.data("field_name")+"_min").val()?jQuery("#"+e.data("field_name")+"_min").val():a,t=void 0!==jQuery("#"+e.data("field_name")+"_max").val()?jQuery("#"+e.data("field_name")+"_max").val():t];e.slider({range:!0,min:parseInt(e.data("min")),max:parseInt(e.data("max")),values:a,create:function(e,a){},step:1,slide:function(e,a){s(jQuery(this),a)},stop:function(e,a){}}),s(e)}),jQuery(".um-admin-metabox").find(".um-datepicker-filter").each(function(){var e=jQuery(this),a=new Date(1e3*e.data("date_min")),t=new Date(1e3*e.data("date_max"));e.pickadate({selectYears:!0,min:a,max:t,formatSubmit:"yyyy/mm/dd",hiddenName:!0,onOpen:function(){e.blur(),e.siblings(".picker").find(".picker__button--close").addClass("button")},onClose:function(){e.blur()},onSet:function(e){}}).pickadate("picker").set("select",1e3*e.data("value"))}),jQuery(".um-admin-metabox").find(".um-timepicker-filter").each(function(){var e=jQuery(this),a=e.data("min"),t=e.data("max"),a=a.split(":"),t=t.split(":");e.pickatime({format:e.data("format"),interval:parseInt(e.data("intervals")),min:[a[0],a[1]],max:[t[0],t[1]],formatSubmit:"HH:i",hiddenName:!0,onOpen:function(){e.blur()},onClose:function(){e.blur()},onSet:function(e){}})}),!1);function s(e,a){var t,i="",s=e.siblings(".um-slider-range").data("placeholder-s"),l=e.siblings(".um-slider-range").data("placeholder-p"),a=a?(i=(a.values[0]===a.values[1]?s.replace("{value}",a.values[0]):l.replace("{min_range}",a.values[0]).replace("{max_range}",a.values[1])).replace("{field_label}",e.siblings(".um-slider-range").data("label")),t=a.values[0],a.values[1]):(i=(e.slider("values",0)===e.slider("values",1)?s.replace("{value}",e.slider("values",0)):l.replace("{min_range}",e.slider("values",0)).replace("{max_range}",e.slider("values",1))).replace("{field_label}",e.siblings(".um-slider-range").data("label")),t=e.slider("values",0),e.slider("values",1));e.siblings(".um-slider-range").html(i),e.siblings(".um_range_min").val(t),e.siblings(".um_range_max").val(a)}function a(){jQuery(".um-forms-line").removeClass("um-forms-line-conditioned").each(function(){void 0===jQuery(this).data("conditional")||jQuery(this).hasClass("um-forms-line-conditioned")||(!function i(e){e.addClass("um-forms-line-conditioned");var a=e.data("conditional");var t=a[1];var s=a[2];var l=e.data("prefix");var n=!0;{var u,r;"="===t||"!="===t?-1===a[0].indexOf("||")&&void 0!==(r=jQuery("#"+l+"_"+a[0])).parents(".um-forms-line").data("conditional")&&(n=i(r.parents(".um-forms-line"))):"~"===t?(m=a[0].split("|"),u=[],jQuery.each(m,function(e){u.push(jQuery("#"+l+"_"+m[e]))}),void 0!==u[0].parents(".um-forms-line").data("conditional")&&(n=i(u[0].parents(".um-forms-line")))):"><"===t&&void 0!==(r=jQuery("#"+l+"_"+a[0]+"_"+a[2])).parents(".um-forms-line").data("conditional")&&(n=i(r.parents(".um-forms-line")))}var d=!1;{var m,o,c,p,f,_,h,g;if("="===t)return-1!==a[0].indexOf("||")?(m=a[0].split("||"),o=!1,jQuery.each(m,function(e){var a,e=jQuery("#"+l+"_"+m[e]),t=(n=!(d=!1),void 0!==e.parents(".um-forms-line").data("conditional")&&(n=i(e.parents(".um-forms-line"))),e.prop("tagName").toLowerCase());"input"===t?(a=e.attr("type"),d="checkbox"===a?"1"==s?e.is(":checked"):!e.is(":checked"):Array.isArray(s)?-1!==s.indexOf(e.val()):e.val()==s):"select"===t&&(d=Array.isArray(s)?-1!==s.indexOf(e.val()):e.val()==s),d&&n&&(o=!0)}),o):("input"==(h=r.prop("tagName").toLowerCase())?(g=r.attr("type"),d="checkbox"==g?"1"==s?r.is(":checked"):!r.is(":checked"):Array.isArray(s)?-1!==s.indexOf(r.val()):r.val()==s):"select"==h&&(d=Array.isArray(s)?-1!==s.indexOf(r.val()):r.val()==s),d&&n);if("!="===t)return-1!==a[0].indexOf("||")?(m=a[0].split("||"),o=!1,jQuery.each(m,function(e){var a,e=jQuery("#"+l+"_"+m[e]),t=(n=!(d=!1),void 0!==e.parents(".um-forms-line").data("conditional")&&(n=i(e.parents(".um-forms-line"))),e.prop("tagName").toLowerCase());"input"===t?(a=e.attr("type"),d="checkbox"===a?"1"==s?!e.is(":checked"):e.is(":checked"):e.val()!=s):"select"===t&&(d=e.val()!=s),d&&n&&(o=!0)}),o):("input"==(h=r.prop("tagName").toLowerCase())?(g=r.attr("type"),d="checkbox"==g?"1"==s?!r.is(":checked"):r.is(":checked"):r.val()!=s):"select"==h&&(d=r.val()!=s),d&&n);if("~"===t)return p=[],"sortable_items"===e.data("field_type")?(c=e.find(".um-sortable-items-value").data("field_id"),jQuery.each(u,function(e){var e=u[e],a=e.prop("tagName").toLowerCase();"input"===a?"checkbox"===e.attr("type")&&"1"==s&&e.is(":checked")&&p.push(e.data("fill_"+c)):"select"==a&&!s&&e.val()&&(p=(p=p.concat(e.val())).filter(y))}),f=jQuery('[data-field_id="'+c+'"]'),p.length?(f.siblings(".um-sortable-items-field").find("li").addClass("um-hidden-item"),jQuery.each(p,function(e){f.siblings(".um-sortable-items-field").find('li[data-tab-id="'+p[e]+'"]').removeClass("um-hidden-item")}),_=[],f.siblings(".um-sortable-items-field").find("li").each(function(){jQuery(this).hasClass("um-hidden-item")||_.push(jQuery(this).data("tab-id"))}),f.val(_.join(",")),f.siblings(".um-sortable-items-field").sortable("refresh"),d=!0):f.val(null)):(c=e.find(e.data("field_type")).data("field_id"),jQuery.each(u,function(e){var e=u[e],a=e.prop("tagName").toLowerCase();"input"===a?"checkbox"===e.attr("type")&&"1"==s&&e.is(":checked")&&p.push(e.data("fill_"+c)):"select"==a&&!s&&e.val()&&(p=(p=p.concat(e.val())).filter(y))}),f=jQuery('[data-field_id="'+c+'"]'),p.length?(f.find("option").hide(),jQuery.each(p,function(e){f.find('option[value="'+p[e]+'"]').show()}),-1===p.indexOf(f.val())&&(f.val(p[0]),f.find("option").attr("selected",!1).prop("selected",!1),f.find('option[value="'+p[0]+'"]').attr("selected",!0).prop("selected",!0)),d=!0):(f.val(null),f.find("option").attr("selected",!1).prop("selected",!1))),d&&n;if("><"===t)return h=r.prop("tagName").toLowerCase(),(d="input"==h&&"checkbox"==(g=r.attr("type"))?r.is(":checked"):d)&&n}return!1}(jQuery(this))?jQuery(this).hide():(jQuery(this).show(),um_admin_init_users_select()))})}function y(e,a,t){return t.indexOf(e)===a}jQuery(document.body).on("change",".um-md-default-filters-option-line .um-field-wrapper select",function(){var t,e,a;i||(e=(t=jQuery(this)).val(),a=t.data("member_directory"),i=!0,wp.ajax.send("um_member_directory_default_filter_settings",{data:{key:e,directory_id:a,nonce:um_admin_scripts.nonce},success:function(e){var a=t.parents(".um-md-default-filters-option-line").find(".um-field-wrapper2");a.html(e.field_html),i=!1,a.find(".um-slider").each(function(){var e=jQuery(this),a=[parseInt(e.data("min")),parseInt(e.data("max"))];e.slider({range:!0,min:parseInt(e.data("min")),max:parseInt(e.data("max")),values:a,create:function(e,a){},step:1,slide:function(e,a){s(jQuery(this),a)},stop:function(e,a){}}),s(e)}),a.find(".um-datepicker-filter").each(function(){var e=jQuery(this),a=new Date(1e3*e.data("date_min")),t=new Date(1e3*e.data("date_max"));e.pickadate({selectYears:!0,min:a,max:t,formatSubmit:"yyyy/mm/dd",hiddenName:!0,onOpen:function(){e.blur(),e.siblings(".picker").find(".picker__button--close").addClass("button")},onClose:function(){e.blur()},onSet:function(e){}})}),a.find(".um-timepicker-filter").each(function(){var e=jQuery(this),a=e.data("min"),t=e.data("max"),a=a.split(":"),t=t.split(":");e.pickatime({format:e.data("format"),interval:parseInt(e.data("intervals")),min:[a[0],a[1]],max:[t[0],t[1]],formatSubmit:"HH:i",hiddenName:!0,onOpen:function(){e.blur()},onClose:function(){e.blur()},onSet:function(e){}})})},error:function(e){return!1}}))}),jQuery(".um-md-default-filters-add-option").on("click",function(){var e,a,t;i||((e=jQuery(this).siblings("ul.um-md-default-filters-list")).data("field_id"),(a=0)
").append(e.siblings(".um-hidden-md-default-filters").clone()).html(),e.append(''+t+''+wp.i18n.__("Remove","ultimate-member")+''),e.find("li:last .um-hidden-md-default-filters").attr("name",jQuery(this).data("name")).addClass("um-forms-field um-long-field").removeClass("um-hidden-md-default-filters").attr("id",e.data("id_attr")+"-"+a),e.find("li:last .um-field-wrapper select").trigger("change"))}),jQuery(document.body).on("click",".um-text-delete",function(){jQuery(this).parents("li.um-multi-text-option-line").remove()}),jQuery(".um-multi-text-add-option").on("click",function(){var e=jQuery(this).siblings("ul.um-multi-text-list"),a=0,t=(0").append(e.siblings(".um-hidden-multi-text").clone()).html()),i=e.data("item_class");e.append(''+t+''+wp.i18n.__("Remove","ultimate-member")+""),e.find("li:last .um-hidden-multi-text").attr("name",jQuery(this).data("name")).addClass("um-forms-field um-long-field").removeClass("um-hidden-multi-text").attr("id",e.data("id_attr")+"-"+a)}),jQuery(".um-media-upload").each(function(){var e=jQuery(this).find(".um-forms-field"),a=e.data("default");""!=e.val()&&e.val()!=a?(e.siblings(".um-set-image").hide(),e.siblings(".um-clear-image").show(),e.siblings(".icon_preview").show()):(e.val()==a&&e.siblings(".icon_preview").show(),e.siblings(".um-set-image").show(),e.siblings(".um-clear-image").hide())}),"undefined"!=typeof wp&&wp.media&&wp.media.editor&&(jQuery(".um-set-image").on("click",function(e){var a=jQuery(this);e.preventDefault(),t&&t.remove(),(t=wp.media({title:a.data("upload_frame"),button:{text:wp.i18n.__("Select","ultimate-member")},multiple:!1})).on("select",function(){var e=t.state().get("selection").first().toJSON();a.siblings(".icon_preview").attr("src",e.url).show(),a.siblings(".um-forms-field").val(e.url),a.siblings(".um-media-upload-data-id").val(e.id),a.siblings(".um-media-upload-data-width").val(e.width),a.siblings(".um-media-upload-data-height").val(e.height),a.siblings(".um-media-upload-data-thumbnail").val(e.thumbnail),a.siblings(".um-media-upload-data-url").trigger("change"),a.siblings(".um-media-upload-url").val(e.url),a.siblings(".um-clear-image").show(),a.hide(),jQuery(document).trigger("um_media_upload_select",[a,e])}),t.open()}),jQuery(".icon_preview").on("click",function(e){jQuery(this).siblings(".um-set-image").trigger("click")}),jQuery(".um-clear-image").on("click",function(e){var a=jQuery(this);let t=a.siblings(".um-forms-field").data("default");void 0===t&&(t=""),a.siblings(".um-set-image").show(),a.hide(),a.siblings(".icon_preview").attr("src",t),""===t&&a.siblings(".icon_preview").hide(),a.siblings(".um-media-upload-data-id").val(""),a.siblings(".um-media-upload-data-width").val(""),a.siblings(".um-media-upload-data-height").val(""),a.siblings(".um-media-upload-data-thumbnail").val(""),a.siblings(".um-forms-field").val(t),a.siblings(".um-media-upload-data-url").trigger("change"),a.siblings(".um-media-upload-url").val(t),jQuery(document).trigger("um_media_upload_clear",a)})),jQuery(document.body).on("change",".um-forms-field",function(){(0 Privacy setting
+ - Added: Exclude and Include fields for member directory searching
+
+* Bugfixes:
+
+ - Fixed: URL attributes escaping (CVE-2024-2765)
+ - Fixed: wp-admin Ultimate Member > Dashboard layouts
+ - Fixed: Required fields labels
+ - Fixed: Change password and update account email notifications duplicates
+ - Fixed: Clear media JS in wp-admin settings
+
= 2.8.4: March 6, 2024 =
* Enhancements:
diff --git a/includes/admin/templates/directory/search.php b/includes/admin/templates/directory/search.php
index 0e73947c..dce4221d 100644
--- a/includes/admin/templates/directory/search.php
+++ b/includes/admin/templates/directory/search.php
@@ -43,11 +43,11 @@ $_um_search_filters = get_post_meta( $post_id, '_um_search_filters', true
array(
'id' => '_um_search_exclude_fields',
'type' => 'multi_selects',
- 'label' => __( 'Choose fields to exclude from search', 'ultimate-member' ),
+ 'label' => __( 'Exclude fields from search', 'ultimate-member' ),
'value' => $_um_search_exclude_fields,
'conditional' => array( '_um_search', '=', 1 ),
- 'options' => UM()->member_directory()->filter_fields,
- 'add_text' => __( 'Add New Custom Field to Exclude', 'ultimate-member' ),
+ 'options' => UM()->member_directory()->searching_fields,
+ 'add_text' => __( 'Add New', 'ultimate-member' ),
'show_default_number' => 0,
'sorting' => true,
'tooltip' => __( 'Choose fields to exclude them from search. This option will delete all included fields.', 'ultimate-member' ),
@@ -55,11 +55,11 @@ $_um_search_filters = get_post_meta( $post_id, '_um_search_filters', true
array(
'id' => '_um_search_include_fields',
'type' => 'multi_selects',
- 'label' => __( 'Choose fields to only include in the search', 'ultimate-member' ),
+ 'label' => __( 'Fields to search by', 'ultimate-member' ),
'value' => $_um_search_include_fields,
'conditional' => array( '_um_search', '=', 1 ),
- 'options' => UM()->member_directory()->filter_fields,
- 'add_text' => __( 'Add New Custom Field to Include', 'ultimate-member' ),
+ 'options' => UM()->member_directory()->searching_fields,
+ 'add_text' => __( 'Add New', 'ultimate-member' ),
'show_default_number' => 0,
'sorting' => true,
'tooltip' => __( 'Choose fields to only include them in the search. This option will delete all excluded fields.', 'ultimate-member' ),
diff --git a/includes/core/class-member-directory-meta.php b/includes/core/class-member-directory-meta.php
index 3b2f7b57..c3bc651f 100644
--- a/includes/core/class-member-directory-meta.php
+++ b/includes/core/class-member-directory-meta.php
@@ -706,13 +706,29 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) {
// phpcs:enable WordPress.Security.NonceVerification -- verified via `UM()->check_ajax_nonce();`.
if ( ! empty( $search_line ) ) {
$searches = array();
- foreach ( $this->core_search_fields as $field ) {
- $field = esc_sql( $field );
- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $field is pre-escaped.
- $searches[] = $wpdb->prepare( "u.{$field} LIKE %s", '%' . $wpdb->esc_like( $search_line ) . '%' );
+
+ $exclude_fields = get_post_meta( $directory_id, '_um_search_exclude_fields', true );
+ $include_fields = get_post_meta( $directory_id, '_um_search_include_fields', true );
+
+ $core_search = $this->get_core_search_fields();
+ if ( ! empty( $include_fields ) ) {
+ $core_search = array_intersect( $core_search, $include_fields );
+ }
+ if ( ! empty( $exclude_fields ) ) {
+ $core_search = array_diff( $core_search, $exclude_fields );
+ }
+ if ( ! empty( $core_search ) ) {
+ foreach ( $core_search as $field ) {
+ $field = esc_sql( $field );
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $field is pre-escaped.
+ $searches[] = $wpdb->prepare( "u.{$field} LIKE %s", '%' . $wpdb->esc_like( $search_line ) . '%' );
+ }
}
$core_search = implode( ' OR ', $searches );
+ if ( ! empty( $core_search ) ) {
+ $core_search = ' OR ' . $core_search;
+ }
$this->joins[] = "LEFT JOIN {$wpdb->prefix}um_metadata umm_search ON umm_search.user_id = u.ID";
@@ -720,27 +736,17 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) {
$search_like_string = apply_filters( 'um_member_directory_meta_search_like_type', '%' . $wpdb->esc_like( $search_line ) . '%', $search_line );
- $directory_id = $this->get_directory_by_hash( sanitize_key( $_POST['directory_id'] ) );
- $exclude_fields = get_post_meta( $directory_id, '_um_search_exclude_fields', true );
- $include_fields = get_post_meta( $directory_id, '_um_search_include_fields', true );
+ $custom_fields_sql = '';
+
if ( ! empty( $exclude_fields ) ) {
- $custom_fields_sql = 'AND umm_search.um_key NOT IN (';
- foreach ( $exclude_fields as $exclude_field ) {
- $custom_fields_sql .= "'" . $exclude_field . "',";
- }
- $custom_fields_sql = rtrim( $custom_fields_sql, ',' );
- $custom_fields_sql .= ') ';
+ $custom_fields_sql = " AND umm_search.um_key NOT IN ('" . implode( "','", $exclude_fields ) . "') ";
}
if ( ! empty( $include_fields ) ) {
- $custom_fields_sql = 'AND umm_search.um_key IN (';
- foreach ( $include_fields as $include_field ) {
- $custom_fields_sql .= "'" . $include_field . "',";
- }
- $custom_fields_sql = rtrim( $custom_fields_sql, ',' );
- $custom_fields_sql .= ') ';
+ $custom_fields_sql = " AND umm_search.um_key IN ('" . implode( "','", $include_fields ) . "') ";
}
+
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $core_search and $additional_search are pre-prepared.
- $this->where_clauses[] = $wpdb->prepare( "( umm_search.um_value = %s OR umm_search.um_value LIKE %s OR umm_search.um_value LIKE %s OR {$core_search}{$additional_search}) {$custom_fields_sql}", $search_line, $search_like_string, '%' . $wpdb->esc_like( maybe_serialize( (string) $search_line ) ) . '%' );
+ $this->where_clauses[] = $wpdb->prepare( "( umm_search.um_value = %s OR umm_search.um_value LIKE %s OR umm_search.um_value LIKE %s{$core_search}{$additional_search}){$custom_fields_sql}", $search_line, $search_like_string, '%' . $wpdb->esc_like( maybe_serialize( (string) $search_line ) ) . '%' );
$this->is_search = true;
}
diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php
index 6f82e7a0..5be87b0d 100644
--- a/includes/core/class-member-directory.php
+++ b/includes/core/class-member-directory.php
@@ -42,6 +42,11 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
*/
var $filter_fields = array();
+ /**
+ * @var array
+ */
+ public $searching_fields = array();
+
/**
* @var array
@@ -122,7 +127,7 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
* Get the WordPress core searching fields in wp_users query.
* @return array
*/
- private function get_core_search_fields() {
+ protected function get_core_search_fields() {
/**
* Filters the WordPress core searching fields in wp_users query for UM Member directory query.
*
@@ -433,6 +438,25 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
$this->filter_supported_fields = apply_filters( 'um_members_directory_custom_field_types_supported_filter', array( 'date', 'time', 'select', 'multiselect', 'radio', 'checkbox', 'rating', 'text', 'textarea', 'number' ) );
+ $core_search_keys = $this->get_core_search_fields();
+
+ $this->searching_fields = array();
+ if ( ! empty( UM()->builtin()->all_user_fields() ) ) {
+ foreach ( UM()->builtin()->all_user_fields() as $key => $data ) {
+ if ( in_array( $key, $core_search_keys, true ) ) {
+ if ( isset( $data['title'] ) && array_search( $data['title'], $this->searching_fields, true ) !== false ) {
+ $data['title'] = $data['title'] . ' (' . $key . ')';
+ }
+
+ $title = isset( $data['title'] ) ? $data['title'] : ( isset( $data['label'] ) ? $data['label'] : '' );
+ if ( empty( $title ) ) {
+ continue;
+ }
+
+ $this->searching_fields[ $key ] = $title;
+ }
+ }
+ }
if ( ! empty( UM()->builtin()->saved_fields ) ) {
foreach ( UM()->builtin()->saved_fields as $key => $data ) {
@@ -459,6 +483,9 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
ksort( $this->filter_fields );
+ $this->searching_fields = array_merge( $this->searching_fields, $this->filter_fields );
+ asort( $this->searching_fields );
+
$this->filter_types = apply_filters( 'um_members_directory_filter_types', array(
'country' => 'select',
'gender' => 'select',
@@ -1757,38 +1784,57 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
$custom_fields[] = $field_key;
}
} else {
- $custom_fields = $include_fields;
+ foreach ( $include_fields as $field_key ) {
+ if ( empty( $field_key ) ) {
+ continue;
+ }
+
+ $data = UM()->fields()->get_field( $field_key );
+ if ( ! um_can_view_field( $data ) ) {
+ continue;
+ }
+
+ $custom_fields[] = $field_key;
+ }
}
$custom_fields = apply_filters( 'um_general_search_custom_fields', $custom_fields );
if ( ! empty( $custom_fields ) ) {
+ if ( ! empty( $exclude_fields ) ) {
+ $custom_fields = array_diff( $custom_fields, $exclude_fields );
+ }
+
$sql['join'] = preg_replace(
'/(' . $meta_join_for_search . ' ON \( ' . $wpdb->users . '\.ID = ' . $meta_join_for_search . '\.user_id )(\))/im',
"$1 AND " . $meta_join_for_search . ".meta_key IN( '" . implode( "','", $custom_fields ) . "' ) $2",
$sql['join']
);
}
-
- if ( ! empty( $exclude_fields ) ) {
- foreach ( $exclude_fields as $field ) {
- $sql['join'] = str_replace( ",'" . $field . "'", '', $sql['join'] );
- }
- }
}
- // Add OR instead AND to search in WP core fields user_email, user_login, user_display_name
- $search_where = $context->get_search_sql( $search, $this->get_core_search_fields(), 'both' );
+ $core_search = $this->get_core_search_fields();
+ if ( ! empty( $include_fields ) ) {
+ $core_search = array_intersect( $core_search, $include_fields );
+ }
+ if ( ! empty( $exclude_fields ) ) {
+ $core_search = array_diff( $core_search, $exclude_fields );
+ }
- $search_where = preg_replace( '/ AND \((.*?)\)/im', "$1 OR", $search_where );
+ if ( ! empty( $core_search ) ) {
+ // Add OR instead AND to search in WP core fields user_email, user_login, user_display_name
+ $search_where = $context->get_search_sql( $search, $core_search, 'both' );
- // str_replace( '/', '\/', wp_slash( $search ) ) means that we add backslashes to special symbols + add backslash to slash(/) symbol for proper regular pattern.
- $sql['where'] = preg_replace(
- '/(' . $meta_join_for_search . '.meta_value = \'' . str_replace( '/', '\/', wp_slash( $search ) ) . '\')/im',
- trim( $search_where ) . " $1",
- $sql['where'],
- 1
- );
+ $search_where = preg_replace( '/ AND \((.*?)\)/im', "$1 OR", $search_where );
+
+ // str_replace( '/', '\/', wp_slash( $search ) ) means that we add backslashes to special symbols + add backslash to slash(/) symbol for proper regular pattern.
+ $sql['where'] = preg_replace(
+ '/(' . $meta_join_for_search . '.meta_value = \'' . str_replace( '/', '\/', wp_slash( $search ) ) . '\')/im',
+ trim( $search_where ) . " $1",
+ $sql['where'],
+ 1
+ );
+ }
}
}
diff --git a/readme.txt b/readme.txt
index bb89947a..d4fc99c7 100644
--- a/readme.txt
+++ b/readme.txt
@@ -5,8 +5,8 @@ Contributors: ultimatemember, champsupertramp, nsinelnikov
Tags: community, member, membership, user-profile, user-registration
Requires PHP: 5.6
Requires at least: 5.5
-Tested up to: 6.4
-Stable tag: 2.8.4
+Tested up to: 6.5
+Stable tag: 2.8.5
License: GNU Version 2 or Any Later Version
License URI: http://www.gnu.org/licenses/gpl-3.0.txt
@@ -166,9 +166,22 @@ No specific extensions are needed. But we highly recommended keep active these P
IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSION 2.6.7 PATCHES SECURITY PRIVILEGE ESCALATION VULNERABILITY. PLEASE SEE [THIS ARTICLE](https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions) FOR MORE INFORMATION
-= 2.8.5 2024-03-xx =
+= 2.8.5 2024-04-09 =
+**Enhancements**
+* Added: "Hide my last login" via the Account > Privacy setting
+* Added: Exclude and Include fields for member directory searching
+
+**Bugfixes**
+
+* Fixed: URL attributes escaping (CVE-2024-2765)
+* Fixed: wp-admin Ultimate Member > Dashboard layouts
+* Fixed: Required fields labels
+* Fixed: Change password and update account email notifications duplicates
+* Fixed: Clear media JS in wp-admin settings
+
+**Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade**
= 2.8.4 2024-03-06 =
@@ -184,6 +197,8 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
* Fixed: Password reset url for the approved user who didn't set their password after registration without password
* Fixed: Conflict with WebP Uploads
+**Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade**
+
= 2.8.3 2024-02-19 =
**Enhancements**
@@ -316,6 +331,9 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
== Upgrade Notice ==
+= 2.8.5 =
+This version fixes a security related bug. Upgrade immediately.
+
= 2.8.4 =
This version fixes a security related bug. Upgrade immediately.
diff --git a/ultimate-member.php b/ultimate-member.php
index 2e0901db..d7e522b3 100644
--- a/ultimate-member.php
+++ b/ultimate-member.php
@@ -3,7 +3,7 @@
* Plugin Name: Ultimate Member
* Plugin URI: http://ultimatemember.com/
* Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress
- * Version: 2.8.5-alpha
+ * Version: 2.8.5
* Author: Ultimate Member
* Author URI: http://ultimatemember.com/
* Text Domain: ultimate-member