From 12dca8b82691fa7997719789fb001d4992d1a271 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Thu, 22 Apr 2021 13:46:51 +0300 Subject: [PATCH 1/8] - fixed getting temp directory size; --- includes/admin/core/class-admin-menu.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/includes/admin/core/class-admin-menu.php b/includes/admin/core/class-admin-menu.php index ad3366f9..6cabd17d 100644 --- a/includes/admin/core/class-admin-menu.php +++ b/includes/admin/core/class-admin-menu.php @@ -275,6 +275,11 @@ if ( ! class_exists( 'um\admin\core\Admin_Menu' ) ) { $size = 0; foreach( new \RecursiveIteratorIterator( new \RecursiveDirectoryIterator( $directory ) ) as $file ) { + $filename = $file->getFilename(); + if ( $filename == '.' || $filename == '..' ) { + continue; + } + $size += $file->getSize(); } return round ( $size / 1048576, 2); From ea496625f87d630a47b908ca8a85f1a5cf784e5f Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Tue, 27 Apr 2021 00:21:32 +0300 Subject: [PATCH 2/8] Added: Hook to unlock the ability to add new users through the registration form --- includes/core/class-shortcodes.php | 5 ++++- readme.txt | 8 ++++++++ ultimate-member.php | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php index c9fcd0fe..ae31c36e 100644 --- a/includes/core/class-shortcodes.php +++ b/includes/core/class-shortcodes.php @@ -677,7 +677,10 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) { //not display on admin preview if ( empty( $_POST['act_id'] ) || $_POST['act_id'] != 'um_admin_preview_form' ) { - if ( 'register' == $mode && is_user_logged_in() ) { + + $enable_loggedin_registration = apply_filters( 'um_registration_for_loggedin_users', false, $args ); + + if ( 'register' == $mode && is_user_logged_in() && ! $enable_loggedin_registration ) { ob_get_clean(); return __( 'You are already registered', 'ultimate-member' ); } diff --git a/readme.txt b/readme.txt index a11c06e9..7331772c 100644 --- a/readme.txt +++ b/readme.txt @@ -155,6 +155,14 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin += 2.1.20: May xx, 2021 = + +* Enhancements: + - Added: Hook to unlock the ability to add new users through the registration form + +* Bugfixes: + - Fixed: Temp directory size calculation + = 2.1.19: April 20, 2021 = * Bugfixes: diff --git a/ultimate-member.php b/ultimate-member.php index 29090d64..c33138f7 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.1.19 +Version: 2.1.20-alpha Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member From 383e563e53dc71f9d166078a9d3984bd5e1a21ba Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 30 Apr 2021 17:05:08 +0300 Subject: [PATCH 3/8] - setting label changed; - added filter hook 'um_change_usermeta_for_update' for extending $to_update usermeta array after all profile fields validations; --- includes/admin/core/class-admin-settings.php | 2 +- includes/core/um-actions-profile.php | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/includes/admin/core/class-admin-settings.php b/includes/admin/core/class-admin-settings.php index b2c97670..6e8eda63 100644 --- a/includes/admin/core/class-admin-settings.php +++ b/includes/admin/core/class-admin-settings.php @@ -652,7 +652,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) { 'id' => 'activation_link_expiry_time', 'type' => 'number', 'label' => __( 'Activation link lifetime', 'ultimate-member' ), - 'tooltip' => __( 'How long does an activation link live? Leave empty for endless links.', 'ultimate-member' ), + 'tooltip' => __( 'How long does an activation link live in seconds? Leave empty for endless links.', 'ultimate-member' ), 'size' => 'small', ), ) diff --git a/includes/core/um-actions-profile.php b/includes/core/um-actions-profile.php index f68dcc27..5cbe7365 100644 --- a/includes/core/um-actions-profile.php +++ b/includes/core/um-actions-profile.php @@ -363,6 +363,9 @@ function um_user_edit_profile( $args ) { } + // use this filter after all validations has been completed and we can extends data based on key + $to_update = apply_filters( 'um_change_usermeta_for_update', $to_update, $args, $fields, $key ); + } } } From bbc30df7df94cc15ee5b8549fa548cb98dedf653 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 30 Apr 2021 17:08:11 +0300 Subject: [PATCH 4/8] - updated readme; --- readme.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/readme.txt b/readme.txt index 7331772c..a2e820d7 100644 --- a/readme.txt +++ b/readme.txt @@ -159,6 +159,7 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * Enhancements: - Added: Hook to unlock the ability to add new users through the registration form + - Added: Filter hook 'um_change_usermeta_for_update' for extending `$to_update` usermeta array after all profile fields validations * Bugfixes: - Fixed: Temp directory size calculation From c2b32c84871a8e01cbbe3fd635c20f3333535d70 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 30 Apr 2021 17:20:32 +0300 Subject: [PATCH 5/8] Added: Filter hook 'um_profile_tabs_privacy_list' for extending privacy options for Profile Tabs --- includes/core/class-profile.php | 4 ++-- readme.txt | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/includes/core/class-profile.php b/includes/core/class-profile.php index 85830f79..414230e3 100644 --- a/includes/core/class-profile.php +++ b/includes/core/class-profile.php @@ -96,14 +96,14 @@ if ( ! class_exists( 'um\core\Profile' ) ) { * @return array */ function tabs_privacy() { - $privacy = array( + $privacy = apply_filters( 'um_profile_tabs_privacy_list', array( 0 => __( 'Anyone', 'ultimate-member' ), 1 => __( 'Guests only', 'ultimate-member' ), 2 => __( 'Members only', 'ultimate-member' ), 3 => __( 'Only the owner', 'ultimate-member' ), 4 => __( 'Only specific roles', 'ultimate-member' ), 5 => __( 'Owner and specific roles', 'ultimate-member' ), - ); + ) ); return $privacy; } diff --git a/readme.txt b/readme.txt index a2e820d7..e509d4e6 100644 --- a/readme.txt +++ b/readme.txt @@ -160,6 +160,7 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * Enhancements: - Added: Hook to unlock the ability to add new users through the registration form - Added: Filter hook 'um_change_usermeta_for_update' for extending `$to_update` usermeta array after all profile fields validations + - Added: Filter hook 'um_profile_tabs_privacy_list' for extending privacy options for Profile Tabs * Bugfixes: - Fixed: Temp directory size calculation From 8e2adccba90bd9e07025ecc00d72d412e2f0d3c5 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 30 Apr 2021 17:50:12 +0300 Subject: [PATCH 6/8] - profile tabs privacy new hooks for integration; --- includes/core/class-profile.php | 2 +- readme.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/core/class-profile.php b/includes/core/class-profile.php index 414230e3..ac5b6522 100644 --- a/includes/core/class-profile.php +++ b/includes/core/class-profile.php @@ -249,7 +249,7 @@ if ( ! class_exists( 'um\core\Profile' ) ) { break; default: - $can_view = true; + $can_view = apply_filters( 'um_profile_menu_can_view_tab', true, $privacy, $tab, $tab_data, $target_id ); break; } diff --git a/readme.txt b/readme.txt index e509d4e6..fd825df6 100644 --- a/readme.txt +++ b/readme.txt @@ -160,7 +160,7 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * Enhancements: - Added: Hook to unlock the ability to add new users through the registration form - Added: Filter hook 'um_change_usermeta_for_update' for extending `$to_update` usermeta array after all profile fields validations - - Added: Filter hook 'um_profile_tabs_privacy_list' for extending privacy options for Profile Tabs + - Added: Filter hook 'um_profile_tabs_privacy_list' and 'um_profile_menu_can_view_tab' for extending privacy options for Profile Tabs * Bugfixes: - Fixed: Temp directory size calculation From 60187cdc6765f109340fa6f859a9bdb088cacc77 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 7 May 2021 13:42:20 +0300 Subject: [PATCH 7/8] - fixed XSS issue with current profile URL --- includes/core/class-fields.php | 6 +++--- includes/core/class-permalinks.php | 8 ++++---- includes/um-short-functions.php | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php index c4a05f35..50efd958 100644 --- a/includes/core/class-fields.php +++ b/includes/core/class-fields.php @@ -4346,14 +4346,14 @@ if ( ! class_exists( 'um\core\Fields' ) ) { if ( UM()->options()->get( 'profile_empty_text' ) ) { $emo = UM()->options()->get( 'profile_empty_text_emo' ); - if ($emo) { + if ( $emo ) { $emo = ''; } else { $emo = false; } - if (um_is_myprofile()) { - $output .= '

' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), um_edit_profile_url() ) . '

'; + if ( um_is_myprofile() ) { + $output .= '

' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), esc_url( um_edit_profile_url() ) ) . '

'; } else { $output .= '

' . $emo . '' . __( 'This user has not added any information to their profile yet.', 'ultimate-member' ) . '

'; } diff --git a/includes/core/class-permalinks.php b/includes/core/class-permalinks.php index b22185c5..95a82936 100644 --- a/includes/core/class-permalinks.php +++ b/includes/core/class-permalinks.php @@ -88,14 +88,14 @@ if ( ! class_exists( 'um\core\Permalinks' ) ) { if ( !$id = $wp_the_query->get_queried_object_id() ) return; - if( UM()->config()->permalinks['user'] == $id ) { - $link = $this->get_current_url(); + if ( UM()->config()->permalinks['user'] == $id ) { + $link = esc_url( $this->get_current_url() ); echo "\n"; return; } $link = get_permalink( $id ); - if ( $page = get_query_var('cpage') ){ + if ( $page = get_query_var( 'cpage' ) ){ $link = get_comments_pagenum_link( $page ); echo "\n"; } @@ -303,7 +303,7 @@ if ( ! class_exists( 'um\core\Permalinks' ) ) { * @return string */ function add_query( $key, $value ) { - $this->current_url = add_query_arg( $key, $value, $this->get_current_url() ); + $this->current_url = add_query_arg( $key, $value, $this->get_current_url() ); return $this->current_url; } diff --git a/includes/um-short-functions.php b/includes/um-short-functions.php index 5960e2ce..4c16b052 100644 --- a/includes/um-short-functions.php +++ b/includes/um-short-functions.php @@ -31,7 +31,7 @@ function um_dynamic_login_page_redirect( $redirect_to = '' ) { $uri = um_get_core_page( 'login' ); - if (!$redirect_to) { + if ( ! $redirect_to ) { $redirect_to = UM()->permalinks()->get_current_url(); } From 9ca720934fa95bce5cbac6cb26047400f33e3627 Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 7 May 2021 14:46:24 +0300 Subject: [PATCH 8/8] - updated version; --- README.md | 2 +- readme.txt | 5 +++-- ultimate-member.php | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 45151d12..cc2c406c 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ GNU Version 2 or Any Later Version ## Releases -[Official Release Version: 2.1.19](https://github.com/ultimatemember/ultimatemember/releases/tag/2.1.19). +[Official Release Version: 2.1.20](https://github.com/ultimatemember/ultimatemember/releases/tag/2.1.20). ## Changelog diff --git a/readme.txt b/readme.txt index fd825df6..c1f030d8 100644 --- a/readme.txt +++ b/readme.txt @@ -7,7 +7,7 @@ Tags: community, member, membership, user-profile, user-registration Requires PHP: 5.6 Requires at least: 5.0 Tested up to: 5.7 -Stable tag: 2.1.19 +Stable tag: 2.1.20 License: GNU Version 2 or Any Later Version License URI: http://www.gnu.org/licenses/gpl-3.0.txt @@ -155,7 +155,7 @@ The plugin works with popular caching plugins by automatically excluding Ultimat * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin -= 2.1.20: May xx, 2021 = += 2.1.20: May 7, 2021 = * Enhancements: - Added: Hook to unlock the ability to add new users through the registration form @@ -163,6 +163,7 @@ The plugin works with popular caching plugins by automatically excluding Ultimat - Added: Filter hook 'um_profile_tabs_privacy_list' and 'um_profile_menu_can_view_tab' for extending privacy options for Profile Tabs * Bugfixes: + - Fixed: XSS vulnerability when getting user profile URL - Fixed: Temp directory size calculation = 2.1.19: April 20, 2021 = diff --git a/ultimate-member.php b/ultimate-member.php index c33138f7..cb4aa3f8 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.1.20-alpha +Version: 2.1.20 Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member