' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), um_edit_profile_url() ) . '
'; + if ( um_is_myprofile() ) { + $output .= '' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), esc_url( um_edit_profile_url() ) ) . '
'; } else { $output .= '' . $emo . '' . __( 'This user has not added any information to their profile yet.', 'ultimate-member' ) . '
'; } diff --git a/includes/core/class-permalinks.php b/includes/core/class-permalinks.php index b22185c5..95a82936 100644 --- a/includes/core/class-permalinks.php +++ b/includes/core/class-permalinks.php @@ -88,14 +88,14 @@ if ( ! class_exists( 'um\core\Permalinks' ) ) { if ( !$id = $wp_the_query->get_queried_object_id() ) return; - if( UM()->config()->permalinks['user'] == $id ) { - $link = $this->get_current_url(); + if ( UM()->config()->permalinks['user'] == $id ) { + $link = esc_url( $this->get_current_url() ); echo "\n"; return; } $link = get_permalink( $id ); - if ( $page = get_query_var('cpage') ){ + if ( $page = get_query_var( 'cpage' ) ){ $link = get_comments_pagenum_link( $page ); echo "\n"; } @@ -303,7 +303,7 @@ if ( ! class_exists( 'um\core\Permalinks' ) ) { * @return string */ function add_query( $key, $value ) { - $this->current_url = add_query_arg( $key, $value, $this->get_current_url() ); + $this->current_url = add_query_arg( $key, $value, $this->get_current_url() ); return $this->current_url; } diff --git a/includes/core/class-profile.php b/includes/core/class-profile.php index 85830f79..ac5b6522 100644 --- a/includes/core/class-profile.php +++ b/includes/core/class-profile.php @@ -96,14 +96,14 @@ if ( ! class_exists( 'um\core\Profile' ) ) { * @return array */ function tabs_privacy() { - $privacy = array( + $privacy = apply_filters( 'um_profile_tabs_privacy_list', array( 0 => __( 'Anyone', 'ultimate-member' ), 1 => __( 'Guests only', 'ultimate-member' ), 2 => __( 'Members only', 'ultimate-member' ), 3 => __( 'Only the owner', 'ultimate-member' ), 4 => __( 'Only specific roles', 'ultimate-member' ), 5 => __( 'Owner and specific roles', 'ultimate-member' ), - ); + ) ); return $privacy; } @@ -249,7 +249,7 @@ if ( ! class_exists( 'um\core\Profile' ) ) { break; default: - $can_view = true; + $can_view = apply_filters( 'um_profile_menu_can_view_tab', true, $privacy, $tab, $tab_data, $target_id ); break; } diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php index c9fcd0fe..ae31c36e 100644 --- a/includes/core/class-shortcodes.php +++ b/includes/core/class-shortcodes.php @@ -677,7 +677,10 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) { //not display on admin preview if ( empty( $_POST['act_id'] ) || $_POST['act_id'] != 'um_admin_preview_form' ) { - if ( 'register' == $mode && is_user_logged_in() ) { + + $enable_loggedin_registration = apply_filters( 'um_registration_for_loggedin_users', false, $args ); + + if ( 'register' == $mode && is_user_logged_in() && ! $enable_loggedin_registration ) { ob_get_clean(); return __( 'You are already registered', 'ultimate-member' ); } diff --git a/includes/core/um-actions-profile.php b/includes/core/um-actions-profile.php index f68dcc27..5cbe7365 100644 --- a/includes/core/um-actions-profile.php +++ b/includes/core/um-actions-profile.php @@ -363,6 +363,9 @@ function um_user_edit_profile( $args ) { } + // use this filter after all validations has been completed and we can extends data based on key + $to_update = apply_filters( 'um_change_usermeta_for_update', $to_update, $args, $fields, $key ); + } } } diff --git a/includes/um-short-functions.php b/includes/um-short-functions.php index 5960e2ce..4c16b052 100644 --- a/includes/um-short-functions.php +++ b/includes/um-short-functions.php @@ -31,7 +31,7 @@ function um_dynamic_login_page_redirect( $redirect_to = '' ) { $uri = um_get_core_page( 'login' ); - if (!$redirect_to) { + if ( ! $redirect_to ) { $redirect_to = UM()->permalinks()->get_current_url(); } diff --git a/readme.txt b/readme.txt index a11c06e9..c1f030d8 100644 --- a/readme.txt +++ b/readme.txt @@ -7,7 +7,7 @@ Tags: community, member, membership, user-profile, user-registration Requires PHP: 5.6 Requires at least: 5.0 Tested up to: 5.7 -Stable tag: 2.1.19 +Stable tag: 2.1.20 License: GNU Version 2 or Any Later Version License URI: http://www.gnu.org/licenses/gpl-3.0.txt @@ -155,6 +155,17 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin += 2.1.20: May 7, 2021 = + +* Enhancements: + - Added: Hook to unlock the ability to add new users through the registration form + - Added: Filter hook 'um_change_usermeta_for_update' for extending `$to_update` usermeta array after all profile fields validations + - Added: Filter hook 'um_profile_tabs_privacy_list' and 'um_profile_menu_can_view_tab' for extending privacy options for Profile Tabs + +* Bugfixes: + - Fixed: XSS vulnerability when getting user profile URL + - Fixed: Temp directory size calculation + = 2.1.19: April 20, 2021 = * Bugfixes: diff --git a/ultimate-member.php b/ultimate-member.php index 29090d64..cb4aa3f8 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.1.19 +Version: 2.1.20 Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member