Update 'ultimatemember_searchform' shortcode in Ultimate Member plugin

Refactored template, CSS and JS to fix the security vulnerability.

assets/css/um-styles.css

@@ -900,14 +900,14 @@ small.um-max-filesize span{
 	max-width: 300px;
 }
 
-.um-search-area .um-search-field {
+.um .um-form.um-search-area .um-search-field {
 	width: 100%;
 	margin: 0;
-	padding-left: 25px;
+	padding-left: 25px !important;
 }
 
-.rtl .um-search-area .um-search-field {
+.rtl .um .um-form.um-search-area .um-search-field {
-	padding-right: 25px;
+	padding-right: 25px !important;
 	padding-left: initial;
 }
 

assets/js/um-scripts.js

@@ -440,60 +440,63 @@ jQuery(document).ready(function() {
 		return false;
 	});
 
-	jQuery( document.body ).on('click', '#um-search-button', function() {
+	jQuery( document.body ).on('click', '#um-search-button', function(e) {
-		var action = jQuery(this).parents('.um-search-form').data('members_page');
+		e.preventDefault();
 
-		var search_keys = [];
+		let $btn = jQuery(this);
-		jQuery(this).parents('.um-search-form').find('input[name="um-search-keys[]"]').each( function() {
+		if ( $btn.hasClass( 'um-disabled' ) ) {
-			search_keys.push( jQuery(this).val() );
+			return;
+		}
+
+		let $form = $btn.parents('.um-search-form');
+		let search = $form.find('.um-search-field').val();
+		let nonce = $form.data('nonce');
+
+		$btn.addClass('um-disabled');
+		wp.ajax.send( 'um_search_widget_request', {
+			data: {
+				search: search,
+				_wpnonce: nonce
+			},
+			success: function(response) {
+				$btn.removeClass('um-disabled');
+				window.location = response.url;
+			},
+			error: function(e) {
+				console.log(e);
+				$btn.removeClass('um-disabled');
+			}
 		});
-
-		var search = jQuery(this).parents('.um-search-form').find('.um-search-field').val();
-
-		var url;
-		if ( search === '' ) {
-			url = action;
-		} else {
-			var query = '?';
-			for ( var i = 0; i < search_keys.length; i++ ) {
-				query += search_keys[i] + '=' + search;
-				if ( i !== search_keys.length - 1 ) {
-					query += '&';
-				}
-			}
-
-			url = action + query;
-		}
-		window.location = url;
 	});
 
 	//make search on Enter click
 	jQuery( document.body ).on( 'keypress', '.um-search-field', function(e) {
 		if ( e.which === 13 ) {
-			var action = jQuery(this).parents('.um-search-form').data('members_page');
+			let $field = jQuery(this);
+			let $form = $field.parents('.um-search-form');
 
-			var search_keys = [];
+			let $btn = $form.find('#um-search-button');
-			jQuery(this).parents('.um-search-form').find('input[name="um-search-keys[]"]').each( function() {
+			if ( $btn.hasClass( 'um-disabled' ) ) {
-				search_keys.push( jQuery(this).val() );
+				return;
+			}
+			let search = $field.val();
+			let nonce = $form.data('nonce');
+
+			$btn.addClass('um-disabled');
+			wp.ajax.send( 'um_search_widget_request', {
+				data: {
+					search: search,
+					_wpnonce: nonce
+				},
+				success: function(response) {
+					$btn.removeClass('um-disabled');
+					window.location = response.url;
+				},
+				error: function(e) {
+					console.log(e);
+					$btn.removeClass('um-disabled');
+				}
 			});
-
-			var search = jQuery(this).val();
-
-			var url;
-			if ( search === '' ) {
-				url = action;
-			} else {
-				var query = '?';
-				for ( var i = 0; i < search_keys.length; i++ ) {
-					query += search_keys[i] + '=' + search;
-					if ( i !== search_keys.length - 1 ) {
-						query += '&';
-					}
-				}
-
-				url = action + query;
-			}
-			window.location = url;
 		}
 	});
 

includes/ajax/class-pages.php

@@ -19,6 +19,9 @@ class Pages {
 	 */
 	public function __construct() {
 		add_action( 'wp_ajax_um_get_pages_list', array( $this, 'get_pages_list' ) );
+
+		add_action( 'wp_ajax_um_search_widget_request', array( $this, 'search_widget_request' ) );
+		add_action( 'wp_ajax_nopriv_um_search_widget_request', array( $this, 'search_widget_request' ) );
 	}
 
 	/**
@@ -98,4 +101,58 @@ class Pages {
 
 		wp_send_json( $return );
 	}
+
+	/**
+	 * AJAX callback for getting search widget redirect to a proper member directory page.
+	 */
+	public function search_widget_request() {
+		check_ajax_referer( 'um_search_widget_request' );
+
+		if ( ! UM()->options()->get( 'members_page' ) ) {
+			wp_send_json_error( __( 'No members page enabled', 'ultimate-member' ) );
+		}
+
+		$member_directory_ids = array();
+
+		$page_id = UM()->config()->permalinks['members'];
+		if ( ! empty( $page_id ) ) {
+			$member_directory_ids = UM()->member_directory()->get_member_directory_id( $page_id );
+		}
+
+		if ( empty( $member_directory_ids ) ) {
+			wp_send_json_error( __( 'No members page enabled', 'ultimate-member' ) );
+		}
+
+		$url = um_get_predefined_page_url( 'members' );
+
+		$search = isset( $_POST['search'] ) ? sanitize_text_field( $_POST['search'] ) : '';
+		if ( empty( $search ) ) {
+			wp_send_json_success( array( 'url' => $url ) );
+		}
+
+		// Current user priority role
+		$priority_user_role = false;
+		if ( is_user_logged_in() ) {
+			$priority_user_role = UM()->roles()->get_priority_user_role( get_current_user_id() );
+		}
+
+		foreach ( $member_directory_ids as $directory_id ) {
+			$directory_data = UM()->query()->post_data( $directory_id );
+
+			if ( isset( $directory_data['roles_can_search'] ) ) {
+				$directory_data['roles_can_search'] = maybe_unserialize( $directory_data['roles_can_search'] );
+			}
+
+			$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'], true ) );
+			if ( empty( $directory_data['search'] ) || ! $show_search ) {
+				continue;
+			}
+
+			$hash = UM()->member_directory()->get_directory_hash( $directory_id );
+
+			$url = add_query_arg( array( 'search_' . $hash => $search ), $url );
+		}
+
+		wp_send_json_success( array( 'url' => $url ) );
+	}
 }

includes/core/class-shortcodes.php

@@ -1370,12 +1370,10 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 		}
 
 		/**
-		 * @param array $args
-		 * @param string $content
 		 *
 		 * @return string
 		 */
-		public function ultimatemember_searchform( $args = array(), $content = '' ) {
+		public function ultimatemember_searchform() {
 			if ( ! UM()->options()->get( 'members_page' ) ) {
 				return '';
 			}
@@ -1391,7 +1389,7 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 				return '';
 			}
 
-			//current user priority role
+			// Current user priority role
 			$priority_user_role = false;
 			if ( is_user_logged_in() ) {
 				$priority_user_role = UM()->roles()->get_priority_user_role( get_current_user_id() );
@@ -1405,7 +1403,7 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 					$directory_data['roles_can_search'] = maybe_unserialize( $directory_data['roles_can_search'] );
 				}
 
-				$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'] ) );
+				$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'], true ) );
 				if ( empty( $directory_data['search'] ) || ! $show_search ) {
 					continue;
 				}
@@ -1419,12 +1417,11 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 				return '';
 			}
 
+			$query        = array_filter( $query );
 			$search_value = array_values( $query );
 
 			$t_args = array(
-				'query'        => $query,
+				'search_value' => ! empty( $search_value ) ? $search_value[0] : '',
-				'search_value' => $search_value[0],
-				'members_page' => um_get_core_page( 'members' ),
 			);
 			return UM()->get_template( 'searchform.php', '', $t_args );
 		}

includes/um-deprecated-functions.php

@@ -462,11 +462,7 @@ function um_members( $argument ) {
 function um_get_search_form() {
 	//um_deprecated_function( 'um_get_search_form', '2.1.0', 'do_shortcode( \'[ultimatemember_searchform]\' )' );
 
-	if ( version_compare( get_bloginfo('version'),'5.4', '<' ) ) {
-		return do_shortcode( '[ultimatemember_searchform]' );
-	} else {
 	return apply_shortcodes( '[ultimatemember_searchform]' );
-	}
 }
 
 

includes/widgets/class-um-search-widget.php

@@ -58,12 +58,7 @@ class UM_Search_Widget extends \WP_Widget {
 		}
 
 		// display the search form
-		if ( version_compare( get_bloginfo('version'),'5.4', '<' ) ) {
-			echo do_shortcode( '[ultimatemember_searchform /]' );
-		} else {
 		echo apply_shortcodes( '[ultimatemember_searchform /]' );
-		}
-
 
 		echo $args['after_widget'];
 	}

templates/searchform.php

@@ -6,23 +6,18 @@
  *
  * Call: function ultimatemember_searchform()
  *
- * @version 2.6.1
+ * @version 2.11.2
  *
- * @var string $members_page
  * @var string $search_value
- * @var array  $query
  */
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
-} ?>
+}
-
+?>
-<div class="search-form um-search-form" data-members_page="<?php echo esc_url( $members_page ); ?>">
+<div class="um search-form um-search-form" data-nonce="<?php echo esc_attr( wp_create_nonce( 'um_search_widget_request' ) ); ?>">
-	<?php foreach ( array_keys( $query ) as $key ) { ?>
+	<div class="um-form um-search-area">
-		<input type="hidden" name="um-search-keys[]" value="<?php echo esc_attr( $key ) ?>" />
+		<span class="screen-reader-text"><?php echo esc_html_x( 'Search for:', 'label', 'ultimate-member' ); ?></span>
-	<?php } ?>
+		<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder', 'ultimate-member' ); ?>" value="<?php echo esc_attr( $search_value ); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label', 'ultimate-member' ); ?>" />
-	<div class="um-search-area">
+		<a href="#" id="um-search-button" class="um-search-icon um-faicon um-faicon-search"></a>
-		<span class="screen-reader-text"><?php echo _x( 'Search for:', 'label' ); ?></span>
-		<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder' ); ?>" value="<?php echo esc_attr( $search_value ); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label' ); ?>" />
-		<a href="javascript:void(0);" id="um-search-button" class="um-search-icon um-faicon um-faicon-search"></a>
 	</div>
 </div>