From 8f3626f42ed59ae18e178ee9a02fc05968bfd951 Mon Sep 17 00:00:00 2001
From: yuriinalivaiko <yuriinalivaiko.work@gmail.com>
Date: Fri, 27 Aug 2021 18:14:24 +0300
Subject: [PATCH] - fixed user role delete action

---
 includes/admin/core/list-tables/roles-list-table.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/includes/admin/core/list-tables/roles-list-table.php b/includes/admin/core/list-tables/roles-list-table.php
index 947159f9..0edff8a5 100644
--- a/includes/admin/core/list-tables/roles-list-table.php
+++ b/includes/admin/core/list-tables/roles-list-table.php
@@ -18,8 +18,8 @@ if ( isset( $_GET['action'] ) ) {
 		case 'delete': {
 			$role_keys = array();
 			if ( isset( $_REQUEST['id'] ) ) {
-				check_admin_referer( 'um_role_delete' . sanitize_key( $_REQUEST['id'] ) . get_current_user_id() );
-				$role_keys = (array) sanitize_key( $_REQUEST['id'] );
+				check_admin_referer( 'um_role_delete' . sanitize_title( $_REQUEST['id'] ) . get_current_user_id() );
+				$role_keys = (array) sanitize_title( $_REQUEST['id'] );
 			} elseif ( isset( $_REQUEST['item'] ) ) {
 				check_admin_referer( 'bulk-' . sanitize_key( __( 'Roles', 'ultimate-member' ) ) );
 				$role_keys = array_map( 'sanitize_key', $_REQUEST['item'] );
@@ -343,21 +343,21 @@ class UM_Roles_List_Table extends WP_List_Table {
 	function column_title( $item ) {
 		$actions = array();
 
-		$actions['edit'] = '<a href="admin.php?page=um_roles&tab=edit&id=' . esc_attr( $item['key'] ) . '">' . __( 'Edit', 'ultimate-member' ) . '</a>';
+		$actions['edit'] = '<a href="admin.php?page=um_roles&tab=edit&id=' . urlencode( $item['key'] ) . '">' . __( 'Edit', 'ultimate-member' ) . '</a>';
 
 		if ( ! empty( $item['_um_is_custom'] ) ) {
-			$actions['delete'] = '<a href="admin.php?page=um_roles&action=delete&id=' . esc_attr( $item['key'] ) . '&_wpnonce=' . wp_create_nonce( 'um_role_delete' . $item['key'] . get_current_user_id() ) . '" onclick="return confirm( \'' . __( 'Are you sure you want to delete this role?', 'ultimate-member' ) . '\' );">' . __( 'Delete', 'ultimate-member' ) . '</a>';
+			$actions['delete'] = '<a href="admin.php?page=um_roles&action=delete&id=' . urlencode( $item['key'] ) . '&_wpnonce=' . wp_create_nonce( 'um_role_delete' . $item['key'] . get_current_user_id() ) . '" onclick="return confirm( \'' . __( 'Are you sure you want to delete this role?', 'ultimate-member' ) . '\' );">' . __( 'Delete', 'ultimate-member' ) . '</a>';
 		} else {
 			$role_meta = get_option( "um_role_{$item['key']}_meta" );
 
 			if ( ! empty( $role_meta ) ) {
-				$actions['reset'] = '<a href="admin.php?page=um_roles&action=reset&id=' . esc_attr( $item['key'] ) . '&_wpnonce=' . wp_create_nonce( 'um_role_reset' . $item['key'] . get_current_user_id() ) . '" onclick="return confirm( \'' . __( 'Are you sure you want to reset UM role meta?', 'ultimate-member' ) . '\' );">' . __( 'Reset UM Role meta', 'ultimate-member' ) . '</a>';
+				$actions['reset'] = '<a href="admin.php?page=um_roles&action=reset&id=' . urlencode( $item['key'] ) . '&_wpnonce=' . wp_create_nonce( 'um_role_reset' . $item['key'] . get_current_user_id() ) . '" onclick="return confirm( \'' . __( 'Are you sure you want to reset UM role meta?', 'ultimate-member' ) . '\' );">' . __( 'Reset UM Role meta', 'ultimate-member' ) . '</a>';
 			}
 		}
 
 
 
-		return sprintf('%1$s %2$s', '<strong><a class="row-title" href="admin.php?page=um_roles&tab=edit&id=' . esc_attr( $item['key'] ) . '">' . stripslashes( $item['name'] ) . '</a></strong>', $this->row_actions( $actions ) );
+		return sprintf('%1$s %2$s', '<strong><a class="row-title" href="admin.php?page=um_roles&tab=edit&id=' . urlencode( $item['key'] ) . '">' . stripslashes( $item['name'] ) . '</a></strong>', $this->row_actions( $actions ) );
 	}