- prepared for 2.4.0 release;

2026-07-16 21:23:39 +09:00 · 2022-05-24 18:29:39 +03:00
parent 64da49de00
commit 9cdf65973c
16 changed files with 228 additions and 44 deletions
@@ -763,6 +763,12 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
 					'blocked_words'                         => array(
 						'sanitize' => 'textarea',
 					),
+					'allowed_choice_callbacks'              => array(
+						'sanitize' => 'textarea',
+					),
+					'allow_url_redirect_confirm'            => array(
+						'sanitize' => 'bool',
+					),
 					'admin_email'                           => array(
 						'sanitize' => 'text',
 					),
@@ -1289,6 +1295,18 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
 										'label'   => __( 'Blacklist Words (Enter one word per line)', 'ultimate-member' ),
 										'tooltip' => __( 'This option lets you specify blacklist of words to prevent anyone from signing up with such a word as their username', 'ultimate-member' ),
 									),
+									array(
+										'id'      => 'allowed_choice_callbacks',
+										'type'    => 'textarea',
+										'label'   => __( 'Allowed Choice Callbacks (Enter one PHP function per line)', 'ultimate-member' ),
+										'tooltip' => __( 'This option lets you specify the choice callback functions to prevent anyone from using 3rd-party functions that may put your site at risk.', 'ultimate-member' ),
+									),
+									array(
+										'id'      => 'allow_url_redirect_confirm',
+										'type'    => 'checkbox',
+										'label'   => __( 'Allow external link redirect confirm', 'ultimate-member' ),
+										'tooltip' => __( 'Using JS.confirm alert when you go to an external link.', 'ultimate-member' ),
+									),
 								),
 							),
 						),
@@ -0,0 +1,50 @@
+<?php if ( ! defined( 'ABSPATH' ) ) exit;
+
+
+function um_upgrade_choice_callbacks240() {
+	UM()->admin()->check_ajax_nonce();
+
+	um_maybe_unset_time_limit();
+
+	$functions = array();
+	// hardcoded for UM:Woocommerce function
+	if ( function_exists( 'um_woo_directory_get_states' ) ) {
+		$functions[] = 'um_woo_directory_get_states';
+	}
+
+	$custom_fields = get_option( 'um_fields', array() );
+	foreach ( $custom_fields as $custom_field ) {
+		if ( array_key_exists( 'custom_dropdown_options_source', $custom_field ) && function_exists( $custom_field['custom_dropdown_options_source'] ) ) {
+			$functions[] = $custom_field['custom_dropdown_options_source'];
+		}
+	}
+
+	$forms_query = new WP_Query;
+	$forms = $forms_query->query( array(
+		'post_type'      => 'um_form',
+		'posts_per_page' => -1,
+		'fields'         => 'ids',
+	) );
+
+	foreach ( $forms as $form_id ) {
+		$forms_fields = get_post_meta( $form_id, '_um_custom_fields', true );
+		if ( ! is_array( $forms_fields ) ) {
+			continue;
+		}
+
+		foreach ( $forms_fields as $key => $field ) {
+			if ( array_key_exists( 'custom_dropdown_options_source', $field ) && function_exists( $field['custom_dropdown_options_source'] ) ) {
+				$functions[] = $field['custom_dropdown_options_source'];
+			}
+		}
+	}
+
+	$functions = array_unique( $functions );
+	$functions = implode( "\r\n", $functions );
+	UM()->options()->update( 'allowed_choice_callbacks', $functions );
+
+	// delete temporarily option for fields upgrade
+	update_option( 'um_last_version_upgrade', '2.4.0' );
+
+	wp_send_json_success( array( 'message' => __( 'Custom callback functions whitelisted for 2.4.0 version.', 'ultimate-member' ) ) );
+}
@@ -0,0 +1,5 @@
+<?php if ( ! defined( 'ABSPATH' ) ) exit;
+
+return array(
+	'choice_callbacks240' => 'choice_callbacks240',
+);
@@ -0,0 +1,30 @@
+<?php if ( ! defined( 'ABSPATH' ) ) exit; ?>
+
+
+<script type="text/javascript">
+	jQuery( document ).ready( function() {
+		um_add_upgrade_log( '<?php echo esc_js( __( 'Added custom callback functions for the UM Forms custom fields to the whitelist setting...', 'ultimate-member' ) ) ?>' );
+
+		jQuery.ajax({
+			url: wp.ajax.settings.url,
+			type: 'POST',
+			dataType: 'json',
+			data: {
+				action: 'um_choice_callbacks240',
+				nonce: um_admin_scripts.nonce
+			},
+			success: function( response ) {
+				if ( typeof response.data.message != 'undefined' ) {
+					um_add_upgrade_log( response.data.message );
+					//switch to the next package
+					um_run_upgrade();
+				} else {
+					um_wrong_ajax();
+				}
+			},
+			error: function() {
+				um_something_wrong();
+			}
+		});
+	});
+</script>