diff --git a/README.md b/README.md index 3a8a3db0..e6e01e29 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Ultimate Member is the #1 user profile & membership plugin for WordPress. The pl | Latest Version |Requires at least|Stable Tag| | :------------: |:------------:|:------------:| -| 2.0.33 | WordPress 4.9 or higher| 2.0.33 | +| 2.0.34 | WordPress 4.9 or higher| 2.0.34 | Features of the plugin include: @@ -48,7 +48,7 @@ GNU Version 2 or Any Later Version Releases ==================== -[Official Release Version: 2.0.33](https://github.com/ultimatemember/ultimatemember/releases/tag/2.0.33). +[Official Release Version: 2.0.34](https://github.com/ultimatemember/ultimatemember/releases/tag/2.0.34). Changelog ==================== diff --git a/includes/admin/class-admin.php b/includes/admin/class-admin.php index 48494113..fc1107f4 100644 --- a/includes/admin/class-admin.php +++ b/includes/admin/class-admin.php @@ -79,8 +79,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) { if ( empty( $last_request ) || time() > $last_request + DAY_IN_SECONDS ) { - delete_transient( 'update_plugins' ); - delete_site_transient( 'update_plugins' ); + wp_clean_update_cache(); UM()->plugin_updater()->um_checklicenses(); diff --git a/includes/admin/core/class-admin-forms.php b/includes/admin/core/class-admin-forms.php index 1f227fa2..1a700812 100644 --- a/includes/admin/core/class-admin-forms.php +++ b/includes/admin/core/class-admin-forms.php @@ -393,7 +393,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Forms' ) ) { $name_attr = ' name="' . $name . '" '; $value = $this->get_field_value( $field_data ); - $value_attr = ' value="' . $value . '" '; + $value_attr = ' value="' . esc_attr( $value ) . '" '; $html = ""; diff --git a/includes/core/class-logout.php b/includes/core/class-logout.php index 4547bf7a..27498654 100644 --- a/includes/core/class-logout.php +++ b/includes/core/class-logout.php @@ -1,9 +1,11 @@ config()->permalinks['login']; + return get_permalink( $login_page_id ); } @@ -28,44 +40,44 @@ if ( ! class_exists( 'um\core\Logout' ) ) { * Logout via logout page */ function logout_page() { - - $language_code = ''; - $current_page_ID = get_the_ID(); - $logout_page_id = UM()->config()->permalinks['logout']; - $trid = 0; - - if ( is_home() /*|| is_front_page()*/ ) { + if ( is_home() ) { return; } + $trid = 0; + $language_code = ''; if ( UM()->external_integrations()->is_wpml_active() ) { global $sitepress; $default_lang = $sitepress->get_default_language(); - $language_code = $sitepress->get_current_language(); + $language_code = $sitepress->get_current_language(); + if ( $language_code == $default_lang ) { + $language_code = ''; + } + + $current_page_ID = get_the_ID(); if ( function_exists( 'icl_object_id' ) ) { $trid = icl_object_id( $current_page_ID, 'page', true, $default_lang ); } else { $trid = wpml_object_id_filter( $current_page_ID, 'page', true, $default_lang ); } - - if ( $language_code == $default_lang ) { - $language_code = ''; - } } + $logout_page_id = UM()->config()->permalinks['logout']; if ( um_is_core_page( 'logout' ) || ( $trid > 0 && $trid == $logout_page_id ) ) { if ( is_user_logged_in() ) { + add_filter( 'wp_safe_redirect_fallback', array( &$this, 'safe_redirect_default' ), 10, 2 ); + if ( isset( $_REQUEST['redirect_to'] ) && $_REQUEST['redirect_to'] !== '' ) { wp_logout(); session_unset(); - exit( wp_redirect( $_REQUEST['redirect_to'] ) ); + exit( wp_safe_redirect( $_REQUEST['redirect_to'] ) ); } else if ( um_user('after_logout') == 'redirect_home' ) { wp_logout(); session_unset(); - exit( wp_redirect( home_url( $language_code ) ) ); + exit( wp_safe_redirect( home_url( $language_code ) ) ); } else { /** * UM hook @@ -92,12 +104,12 @@ if ( ! class_exists( 'um\core\Logout' ) ) { $redirect_url = apply_filters( 'um_logout_redirect_url', um_user( 'logout_redirect_url' ), um_user( 'ID' ) ); wp_logout(); session_unset(); - exit( wp_redirect( $redirect_url ) ); - + exit( wp_safe_redirect( $redirect_url ) ); } } else { - exit( wp_redirect( home_url( $language_code ) ) ); + add_filter( 'wp_safe_redirect_fallback', array( &$this, 'safe_redirect_default' ), 10, 2 ); + exit( wp_safe_redirect( home_url( $language_code ) ) ); } } diff --git a/includes/core/class-plugin-updater.php b/includes/core/class-plugin-updater.php index 54c30af3..db5aa261 100644 --- a/includes/core/class-plugin-updater.php +++ b/includes/core/class-plugin-updater.php @@ -126,10 +126,15 @@ if ( ! class_exists( 'um\core\Plugin_Updater' ) ) { // Per site activated $sites = get_sites(); + $sitewide_plugins = get_site_option( 'active_sitewide_plugins' ); + $sitewide_plugins = array_keys( $sitewide_plugins ); + foreach ( $sites as $site ) { switch_to_blog( $site->blog_id ); $the_plugs = get_option( 'active_plugins' ); + $the_plugs = array_merge( $the_plugs, $sitewide_plugins ); + foreach ( $the_plugs as $key => $value ) { if ( in_array( $value, array_keys( $paid_extensions ) ) ) { diff --git a/includes/core/um-actions-login.php b/includes/core/um-actions-login.php index 5e6ec0d1..f6d74f06 100644 --- a/includes/core/um-actions-login.php +++ b/includes/core/um-actions-login.php @@ -386,7 +386,7 @@ function um_add_submit_button_to_login( $args ) { * } * ?> */ - $secondary_btn_word = apply_filters('um_login_form_button_two', $args['secondary_btn_word'], $args ); + $secondary_btn_word = apply_filters( 'um_login_form_button_two', $args['secondary_btn_word'], $args ); $secondary_btn_url = ( isset( $args['secondary_btn_url'] ) && $args['secondary_btn_url'] ) ? $args['secondary_btn_url'] : um_get_core_page('register'); /** @@ -423,18 +423,18 @@ function um_add_submit_button_to_login( $args ) { if ( isset( $args['secondary_btn'] ) && $args['secondary_btn'] != 0 ) { ?>
- +
- +
- +
diff --git a/includes/core/um-actions-profile.php b/includes/core/um-actions-profile.php index 500f28af..6bf5c79a 100644 --- a/includes/core/um-actions-profile.php +++ b/includes/core/um-actions-profile.php @@ -1191,18 +1191,22 @@ function um_add_submit_button_to_profile( $args ) {
- + -
-
+
+ +
+
+ + +
-
+
+ +
diff --git a/includes/core/um-actions-register.php b/includes/core/um-actions-register.php index 5fe71b58..eba640c7 100644 --- a/includes/core/um-actions-register.php +++ b/includes/core/um-actions-register.php @@ -509,7 +509,7 @@ function um_add_submit_button_to_register( $args ) { * } * ?> */ - $secondary_btn_word = apply_filters('um_register_form_button_two', $secondary_btn_word, $args ); + $secondary_btn_word = apply_filters( 'um_register_form_button_two', $secondary_btn_word, $args ); $secondary_btn_url = ( isset( $args['secondary_btn_url'] ) && $args['secondary_btn_url'] ) ? $args['secondary_btn_url'] : um_get_core_page('login'); /** @@ -538,14 +538,22 @@ function um_add_submit_button_to_register( $args ) {
- + -
-
+
+ +
+
+ + + +
-
+
+ +
diff --git a/languages/ultimate-member-en_US.po b/languages/ultimate-member-en_US.po index 525b73a0..3057990d 100644 --- a/languages/ultimate-member-en_US.po +++ b/languages/ultimate-member-en_US.po @@ -1,8 +1,8 @@ msgid "" msgstr "" "Project-Id-Version: Ultimate Member\n" -"POT-Creation-Date: 2018-12-05 10:54+0200\n" -"PO-Revision-Date: 2018-12-05 10:54+0200\n" +"POT-Creation-Date: 2018-12-07 10:26+0200\n" +"PO-Revision-Date: 2018-12-07 10:26+0200\n" "Last-Translator: \n" "Language-Team: \n" "Language: en_US\n" @@ -25,53 +25,53 @@ msgstr "" msgid "Wrong Nonce" msgstr "" -#: includes/admin/class-admin.php:181 +#: includes/admin/class-admin.php:180 #, php-format msgid "Duplicate of %s" msgstr "" -#: includes/admin/class-admin.php:295 +#: includes/admin/class-admin.php:294 msgid "Docs" msgstr "" -#: includes/admin/class-admin.php:296 +#: includes/admin/class-admin.php:295 #: includes/admin/core/class-admin-settings.php:1128 msgid "Settings" msgstr "" -#: includes/admin/class-admin.php:367 includes/admin/class-admin.php:370 +#: includes/admin/class-admin.php:366 includes/admin/class-admin.php:369 msgid "Form updated." msgstr "" -#: includes/admin/class-admin.php:368 +#: includes/admin/class-admin.php:367 msgid "Custom field updated." msgstr "" -#: includes/admin/class-admin.php:369 +#: includes/admin/class-admin.php:368 msgid "Custom field deleted." msgstr "" -#: includes/admin/class-admin.php:371 +#: includes/admin/class-admin.php:370 msgid "Form restored to revision." msgstr "" -#: includes/admin/class-admin.php:372 +#: includes/admin/class-admin.php:371 msgid "Form created." msgstr "" -#: includes/admin/class-admin.php:373 +#: includes/admin/class-admin.php:372 msgid "Form saved." msgstr "" -#: includes/admin/class-admin.php:374 +#: includes/admin/class-admin.php:373 msgid "Form submitted." msgstr "" -#: includes/admin/class-admin.php:375 +#: includes/admin/class-admin.php:374 msgid "Form scheduled." msgstr "" -#: includes/admin/class-admin.php:376 +#: includes/admin/class-admin.php:375 msgid "Form draft updated." msgstr "" @@ -103,7 +103,7 @@ msgstr "" #: includes/admin/core/class-admin-builder.php:767 #: includes/admin/core/class-admin-dragdrop.php:32 #: includes/admin/core/class-admin-menu.php:104 -#: includes/core/class-fields.php:4065 +#: includes/core/class-fields.php:4066 msgid "Please login as administrator" msgstr "" @@ -2514,7 +2514,7 @@ msgid "UM Action" msgstr "" #: includes/admin/core/class-admin-users.php:116 -#: includes/core/class-fields.php:2300 +#: includes/core/class-fields.php:2301 msgid "Apply" msgstr "" @@ -3488,7 +3488,7 @@ msgstr "" #: includes/admin/templates/modal/dynamic_new_group.php:15 #: includes/admin/templates/modal/fonticons.php:11 #: includes/admin/templates/role/publish.php:24 -#: includes/core/class-fields.php:2301 includes/core/class-fields.php:2398 +#: includes/core/class-fields.php:2302 includes/core/class-fields.php:2399 #: includes/core/um-actions-profile.php:554 #: includes/core/um-actions-profile.php:693 #: includes/core/um-actions-profile.php:726 @@ -6205,89 +6205,89 @@ msgstr "" msgid "Add translation to %s" msgstr "" -#: includes/core/class-fields.php:1165 templates/message.php:5 +#: includes/core/class-fields.php:1166 templates/message.php:5 #, php-format msgid "%s" msgstr "" -#: includes/core/class-fields.php:1184 +#: includes/core/class-fields.php:1185 msgid "Custom Field" msgstr "" -#: includes/core/class-fields.php:1481 +#: includes/core/class-fields.php:1482 msgid "Please upload a valid image!" msgstr "" -#: includes/core/class-fields.php:1488 includes/core/class-fields.php:1509 +#: includes/core/class-fields.php:1489 includes/core/class-fields.php:1510 msgid "Upload" msgstr "" -#: includes/core/class-fields.php:1489 +#: includes/core/class-fields.php:1490 msgid "Sorry this is not a valid image." msgstr "" -#: includes/core/class-fields.php:1490 +#: includes/core/class-fields.php:1491 msgid "This image is too large!" msgstr "" -#: includes/core/class-fields.php:1491 +#: includes/core/class-fields.php:1492 msgid "This image is too small!" msgstr "" -#: includes/core/class-fields.php:1492 +#: includes/core/class-fields.php:1493 msgid "You can only upload one image" msgstr "" -#: includes/core/class-fields.php:1959 +#: includes/core/class-fields.php:1960 msgid "Current Password" msgstr "" -#: includes/core/class-fields.php:1988 +#: includes/core/class-fields.php:1989 msgid "New Password" msgstr "" -#: includes/core/class-fields.php:2020 +#: includes/core/class-fields.php:2021 #, php-format msgid "Confirm %s" msgstr "" -#: includes/core/class-fields.php:2255 +#: includes/core/class-fields.php:2256 msgid "Upload Photo" msgstr "" -#: includes/core/class-fields.php:2276 includes/core/class-fields.php:2300 +#: includes/core/class-fields.php:2277 includes/core/class-fields.php:2301 #: includes/core/um-actions-profile.php:724 msgid "Change photo" msgstr "" -#: includes/core/class-fields.php:2300 includes/core/class-fields.php:2397 +#: includes/core/class-fields.php:2301 includes/core/class-fields.php:2398 msgid "Processing..." msgstr "" -#: includes/core/class-fields.php:2322 +#: includes/core/class-fields.php:2323 msgid "Upload File" msgstr "" -#: includes/core/class-fields.php:2364 includes/core/um-filters-fields.php:243 +#: includes/core/class-fields.php:2365 includes/core/um-filters-fields.php:243 msgid "This file has been removed." msgstr "" -#: includes/core/class-fields.php:2367 includes/core/class-fields.php:2397 +#: includes/core/class-fields.php:2368 includes/core/class-fields.php:2398 msgid "Change file" msgstr "" -#: includes/core/class-fields.php:2397 +#: includes/core/class-fields.php:2398 msgid "Save" msgstr "" -#: includes/core/class-fields.php:3820 +#: includes/core/class-fields.php:3821 #, php-format msgid "" "Your profile is looking a little empty. Why not add some " "information!" msgstr "" -#: includes/core/class-fields.php:3822 +#: includes/core/class-fields.php:3823 msgid "This user has not added any information to their profile yet." msgstr "" @@ -6374,7 +6374,7 @@ msgid "This activation link is expired or have already been used." msgstr "" #. translators: %s: support forums URL -#: includes/core/class-plugin-updater.php:220 +#: includes/core/class-plugin-updater.php:248 #, php-format msgid "" "An unexpected error occurred. Something may be wrong with https://" @@ -6382,7 +6382,7 @@ msgid "" "have problems, please try the support forums." msgstr "" -#: includes/core/class-plugin-updater.php:221 +#: includes/core/class-plugin-updater.php:249 msgid "https://wordpress.org/support/" msgstr "" @@ -6720,35 +6720,35 @@ msgstr "" msgid "Only fill in if you are not human" msgstr "" -#: includes/core/um-actions-login.php:20 +#: includes/core/um-actions-login.php:18 msgid "Please enter your username or email" msgstr "" -#: includes/core/um-actions-login.php:24 +#: includes/core/um-actions-login.php:22 msgid "Please enter your username" msgstr "" -#: includes/core/um-actions-login.php:28 +#: includes/core/um-actions-login.php:26 msgid "Please enter your email" msgstr "" -#: includes/core/um-actions-login.php:61 +#: includes/core/um-actions-login.php:59 msgid "Please enter your password" msgstr "" -#: includes/core/um-actions-login.php:68 +#: includes/core/um-actions-login.php:66 msgid "Password is incorrect. Please try again." msgstr "" -#: includes/core/um-actions-login.php:199 +#: includes/core/um-actions-login.php:195 msgid "This action has been prevented for security measures." msgstr "" -#: includes/core/um-actions-login.php:423 +#: includes/core/um-actions-login.php:419 msgid "Keep me signed in" msgstr "" -#: includes/core/um-actions-login.php:458 +#: includes/core/um-actions-login.php:463 msgid "Forgot your password?" msgstr "" diff --git a/readme.txt b/readme.txt index c47ec432..ebbacc38 100644 --- a/readme.txt +++ b/readme.txt @@ -137,21 +137,25 @@ The plugin works with popular caching plugins by automatically excluding Ultimat = Important: UM2.0+ is a significant update to the code base from 1.3.88. Please make sure you take a full-site backup with restore point before updating the plugin = -= 2.0.34: December , 2018 = += 2.0.34: December 7, 2018 = * Enhancements: - Added new "Extensions" class for future integrations * Bugfixes: + - Fixed logout redirect vulnerability - Fixed modal window responsive position - Fixed class autoloader for Windows servers - Fixed admin forms integration - Fixed empty value for select2 selectbox - Fixed unchecked Remember Me by default on login page + - Fixed admin forms esc_attr value + - Fixed admin forms buttons wp_unslash + - Fixed get/clean plugin upgrades on multisites * Deprecated: - - removed "UM_TEXTDOMAIN" constant; - - removed function UM()->get_ajax_route(); + - removed "UM_TEXTDOMAIN" constant + - removed function UM()->get_ajax_route() for AJAX vulnerability fix = 2.0.33: November 22, 2018 =