10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-13 19:56:27 +09:00
Code Issues Packages Projects Releases Wiki Activity

- increase security via option for Password field in user account;

Browse Source
This commit is contained in:
nikitasinelnikov
2019-03-12 09:13:40 +02:00
parent 19ffd41e22
commit a199f35cc7
7 changed files with 120 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/js/um-account.js
+26 -18
View File
@@ -1,12 +1,14 @@
jQuery(document).ready(function() {
var current_tab = jQuery('.um-account-main').attr('data-current_tab');
if ( current_tab ) {
jQuery('.um-account-tab[data-tab='+current_tab+']').show();
if ( current_tab ) {
jQuery('.um-account-tab[data-tab="'+current_tab+'"]').show();
jQuery('.um-account-tab:not(:visible)').find( 'input:not(:disabled)' ).addClass('um_account_inactive').prop( 'disabled', true ).attr( 'disabled', true );
}
jQuery(document).on('click','.um-account-side li a',function(e){
jQuery( document.body ).on( 'click', '.um-account-side li a', function(e) {
e.preventDefault();
var link = jQuery(this);
@@ -16,32 +18,35 @@ jQuery(document).ready(function() {
var url_ = jQuery(this).attr('href');
var tab_ = jQuery(this).attr('data-tab');
jQuery("input[id=_um_account_tab]:hidden").val( tab_ );
jQuery('input[id="_um_account_tab"]:hidden').val( tab_ );
window.history.pushState("", "", url_);
jQuery('.um-account-tab').hide();
jQuery('.um-account-tab[data-tab='+tab_+']').fadeIn();
jQuery('.um-account-tab[data-tab="'+tab_+'"]').fadeIn();
jQuery('.um-account-tab:visible').find( 'input.um_account_inactive:disabled' ).removeClass('um_account_inactive').prop( 'disabled', false ).attr( 'disabled', false );
jQuery('.um-account-tab:not(:visible)').find( 'input:not(:disabled)' ).addClass('um_account_inactive').prop( 'disabled', true ).attr( 'disabled', true );
jQuery('.um-account-nav a').removeClass('current');
jQuery('.um-account-nav a[data-tab='+tab_+']').addClass('current');
jQuery('.um-account-nav a[data-tab="'+tab_+'"]').addClass('current');
return false;
});
});
jQuery(document).on('click','.um-account-nav a',function(e){
jQuery(document.body).on( 'click', '.um-account-nav a', function(e) {
e.preventDefault();
var tab_ = jQuery(this).attr('data-tab');
var div = jQuery(this).parents('div');
var link = jQuery(this);
jQuery("input[id=_um_account_tab]:hidden").val( tab_ );
jQuery('input[id="_um_account_tab"]:hidden').val( tab_ );
jQuery('.um-account-tab').hide();
if ( link.hasClass('current') ) {
div.next('.um-account-tab').slideUp();
link.removeClass('current');
@@ -51,9 +56,12 @@ jQuery(document).ready(function() {
link.addClass('current');
}
jQuery('.um-account-tab:visible').find( 'input.um_account_inactive:disabled' ).removeClass('um_account_inactive').prop( 'disabled', false ).attr( 'disabled', false );
jQuery('.um-account-tab:not(:visible)').find( 'input:not(:disabled)' ).addClass('um_account_inactive').prop( 'disabled', true ).attr( 'disabled', true );
jQuery('.um-account-side li a').removeClass('current');
jQuery('.um-account-side li a[data-tab='+tab_+']').addClass('current');
jQuery('.um-account-side li a[data-tab="'+tab_+'"]').addClass('current');
return false;
});
});
assets/js/um-account.min.js
Vendored
+1 -1
View File
@@ -1 +1 @@
jQuery(document).ready(function(){var a=jQuery(".um-account-main").attr("data-current_tab");a&&jQuery(".um-account-tab[data-tab="+a+"]").show(),jQuery(document).on("click",".um-account-side li a",function(a){a.preventDefault();var t=jQuery(this);t.parents("ul").find("li a").removeClass("current"),t.addClass("current");var u=jQuery(this).attr("href"),e=jQuery(this).attr("data-tab");return jQuery("input[id=_um_account_tab]:hidden").val(e),window.history.pushState("","",u),jQuery(".um-account-tab").hide(),jQuery(".um-account-tab[data-tab="+e+"]").fadeIn(),jQuery(".um-account-nav a").removeClass("current"),jQuery(".um-account-nav a[data-tab="+e+"]").addClass("current"),!1})}),jQuery(document).on("click",".um-account-nav a",function(a){a.preventDefault();var t=jQuery(this).attr("data-tab"),u=jQuery(this).parents("div"),e=jQuery(this);return jQuery("input[id=_um_account_tab]:hidden").val(t),jQuery(".um-account-tab").hide(),e.hasClass("current")?(u.next(".um-account-tab").slideUp(),e.removeClass("current")):(u.next(".um-account-tab").slideDown(),e.parents("div").find("a").removeClass("current"),e.addClass("current")),jQuery(".um-account-side li a").removeClass("current"),jQuery(".um-account-side li a[data-tab="+t+"]").addClass("current"),!1});
jQuery(document).ready(function(){var a=jQuery(".um-account-main").attr("data-current_tab");a&&(jQuery('.um-account-tab[data-tab="'+a+'"]').show(),jQuery(".um-account-tab:not(:visible)").find("input:not(:disabled)").addClass("um_account_inactive").prop("disabled",!0).attr("disabled",!0)),jQuery(document.body).on("click",".um-account-side li a",function(a){a.preventDefault();var t=jQuery(this);t.parents("ul").find("li a").removeClass("current"),t.addClass("current");var u=jQuery(this).attr("href"),e=jQuery(this).attr("data-tab");return jQuery('input[id="_um_account_tab"]:hidden').val(e),window.history.pushState("","",u),jQuery(".um-account-tab").hide(),jQuery('.um-account-tab[data-tab="'+e+'"]').fadeIn(),jQuery(".um-account-tab:visible").find("input.um_account_inactive:disabled").removeClass("um_account_inactive").prop("disabled",!1).attr("disabled",!1),jQuery(".um-account-tab:not(:visible)").find("input:not(:disabled)").addClass("um_account_inactive").prop("disabled",!0).attr("disabled",!0),jQuery(".um-account-nav a").removeClass("current"),jQuery('.um-account-nav a[data-tab="'+e+'"]').addClass("current"),!1}),jQuery(document.body).on("click",".um-account-nav a",function(a){a.preventDefault();var t=jQuery(this).attr("data-tab"),u=jQuery(this).parents("div"),e=jQuery(this);return jQuery('input[id="_um_account_tab"]:hidden').val(t),jQuery(".um-account-tab").hide(),e.hasClass("current")?(u.next(".um-account-tab").slideUp(),e.removeClass("current")):(u.next(".um-account-tab").slideDown(),e.parents("div").find("a").removeClass("current"),e.addClass("current")),jQuery(".um-account-tab:visible").find("input.um_account_inactive:disabled").removeClass("um_account_inactive").prop("disabled",!1).attr("disabled",!1),jQuery(".um-account-tab:not(:visible)").find("input:not(:disabled)").addClass("um_account_inactive").prop("disabled",!0).attr("disabled",!0),jQuery(".um-account-side li a").removeClass("current"),jQuery('.um-account-side li a[data-tab="'+t+'"]').addClass("current"),!1})});
includes/admin/core/class-admin-settings.php
+7 -1
View File
@@ -492,7 +492,13 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
'id' => 'account_email',
'type' => 'checkbox',
'label' => __( 'Allow users to change e-mail','ultimate-member' ),
'tooltip' => __('Whether to allow users changing their email in account page.','ultimate-member'),
'tooltip' => __( 'Whether to allow users changing their email in account page.', 'ultimate-member' ),
),
array(
'id' => 'account_general_password',
'type' => 'checkbox',
'label' => __( 'Password is required?','ultimate-member' ),
'tooltip' => __( 'Password is required to save account data.', 'ultimate-member' ),
),
array(
'id' => 'account_hide_in_directory',
includes/class-config.php
+1
View File
@@ -498,6 +498,7 @@ if ( ! class_exists( 'um\Config' ) ) {
'account_name_disable' => 0,
'account_name_require' => 1,
'account_email' => 1,
'account_general_password' => 0,
'account_hide_in_directory' => 1,
'account_require_strongpass' => 0,
'photo_thumb_sizes' => array( 40, 80, 190 ),
includes/core/class-account.php
+11 -4
View File
@@ -65,13 +65,15 @@ if ( ! class_exists( 'um\core\Account' ) ) {
foreach ( $arr as $id => $info ) {
if ( ! empty( $args['tab'] ) && $id != $args['tab'] )
if ( ! empty( $args['tab'] ) && $id != $args['tab'] ) {
continue;
}
$output = $this->get_tab_fields( $id, $args );
if ( ! empty( $output ) )
$tabs_structed[$id] = $info;
if ( ! empty( $output ) ) {
$tabs_structed[ $id ] = $info;
}
}
@@ -518,8 +520,9 @@ if ( ! class_exists( 'um\core\Account' ) ) {
UM()->fields()->editing = true;
if ( ! empty( $this->tab_output[$id]['content'] ) && ! empty( $this->tab_output[$id]['hash'] ) &&
$this->tab_output[$id]['hash'] == md5( json_encode( $shortcode_args ) ) )
$this->tab_output[$id]['hash'] == md5( json_encode( $shortcode_args ) ) ) {
return $this->tab_output[$id]['content'];
}
switch ( $id ) {
@@ -607,6 +610,10 @@ if ( ! class_exists( 'um\core\Account' ) ) {
$args = str_replace(',user_email','', $args );
}
if ( UM()->options()->get( 'account_general_password' ) ) {
$args .= ',single_user_password';
}
/**
* UM hook
*
includes/core/um-actions-account.php
+20 -5
View File
@@ -24,10 +24,10 @@ function um_submit_account_errors_hook( $args ) {
case 'delete': {
// delete account
if ( strlen(trim( $_POST['single_user_password'] ) ) == 0 ) {
UM()->form()->add_error('single_user_password', __('You must enter your password','ultimate-member') );
UM()->form()->add_error( 'single_user_password', __( 'You must enter your password', 'ultimate-member' ) );
} else {
if ( ! wp_check_password( $_POST['single_user_password'], $user->data->user_pass, $user->data->ID ) ) {
UM()->form()->add_error('single_user_password', __('This is not your password','ultimate-member') );
UM()->form()->add_error( 'single_user_password', __( 'This is not your password', 'ultimate-member' ) );
}
}
@@ -95,14 +95,29 @@ function um_submit_account_errors_hook( $args ) {
}
if ( isset( $_POST['user_email'] ) ) {
if ( strlen( trim( $_POST['user_email'] ) ) == 0 )
if ( strlen( trim( $_POST['user_email'] ) ) == 0 ) {
UM()->form()->add_error( 'user_email', __( 'You must provide your e-mail', 'ultimate-member' ) );
}
if ( ! is_email( $_POST['user_email'] ) )
if ( ! is_email( $_POST['user_email'] ) ) {
UM()->form()->add_error( 'user_email', __( 'Please provide a valid e-mail', 'ultimate-member' ) );
}
if ( email_exists( $_POST['user_email'] ) && email_exists( $_POST['user_email'] ) != get_current_user_id() )
if ( email_exists( $_POST['user_email'] ) && email_exists( $_POST['user_email'] ) != get_current_user_id() ) {
UM()->form()->add_error( 'user_email', __( 'Email already linked to another account', 'ultimate-member' ) );
}
}
// check account password
if ( UM()->options()->get( 'account_general_password' ) ) {
if ( strlen( trim( $_POST['single_user_password'] ) ) == 0 ) {
UM()->form()->add_error('single_user_password', __( 'You must enter your password', 'ultimate-member' ) );
} else {
if ( ! wp_check_password( $_POST['single_user_password'], $user->data->user_pass, $user->data->ID ) ) {
UM()->form()->add_error('single_user_password', __( 'This is not your password', 'ultimate-member' ) );
}
}
}
break;
templates/account.php
+54 -55
View File
@@ -26,65 +26,65 @@
*/
do_action( 'um_account_page_hidden_fields', $args ); ?>
<div class="um-account-meta radius-<?php echo UM()->options()->get( 'profile_photocorner' ); ?> uimob340-show uimob500-show">
<div class="um-account-meta radius-<?php echo UM()->options()->get( 'profile_photocorner' ); ?> uimob340-show uimob500-show">
<div class="um-account-meta-img">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a>
</div>
<div class="um-account-meta-img">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a>
</div>
<div class="um-account-name">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name' ); ?></a>
<div class="um-account-profile-link">
<a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a>
</div>
</div>
<div class="um-account-name">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name' ); ?></a>
<div class="um-account-profile-link">
<a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a>
</div>
</div>
</div>
</div>
<div class="um-account-side uimob340-hide uimob500-hide">
<div class="um-account-meta radius-<?php echo UM()->options()->get('profile_photocorner'); ?>">
<div class="um-account-meta radius-<?php echo UM()->options()->get('profile_photocorner'); ?>">
<div class="um-account-meta-img uimob800-hide"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<div class="um-account-meta-img uimob800-hide"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<?php if ( UM()->mobile()->isMobile() ) { ?>
<?php if ( UM()->mobile()->isMobile() ) { ?>
<div class="um-account-meta-img-b uimob800-show" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<div class="um-account-meta-img-b uimob800-show" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<?php } else { ?>
<?php } else { ?>
<div class="um-account-meta-img-b uimob800-show um-tip-w" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<div class="um-account-meta-img-b uimob800-show um-tip-w" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
<?php } ?>
<?php } ?>
<div class="um-account-name uimob800-hide">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name', 'html' ); ?></a>
<div class="um-account-profile-link"><a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a></div>
</div>
<div class="um-account-name uimob800-hide">
<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name', 'html' ); ?></a>
<div class="um-account-profile-link"><a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a></div>
</div>
</div>
</div>
<ul>
<?php foreach ( UM()->account()->tabs as $id => $info ) {
if ( isset( $info['custom'] ) || UM()->options()->get( "account_tab_{$id}" ) == 1 || $id == 'general' ) { ?>
if ( isset( $info['custom'] ) || UM()->options()->get( "account_tab_{$id}" ) == 1 || $id == 'general' ) { ?>
<li>
<a data-tab="<?php echo $id ?>" href="<?php echo UM()->account()->tab_link( $id ); ?>" class="um-account-link <?php if ( $id == UM()->account()->current_tab ) echo 'current'; ?>">
<?php if ( UM()->mobile()->isMobile() ) { ?>
<span class="um-account-icontip uimob800-show" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
<?php } else { ?>
<span class="um-account-icontip uimob800-show um-tip-w" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
<?php } ?>
<li>
<a data-tab="<?php echo $id ?>" href="<?php echo UM()->account()->tab_link( $id ); ?>" class="um-account-link <?php if ( $id == UM()->account()->current_tab ) echo 'current'; ?>">
<?php if ( UM()->mobile()->isMobile() ) { ?>
<span class="um-account-icontip uimob800-show" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
<?php } else { ?>
<span class="um-account-icontip uimob800-show um-tip-w" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
<?php } ?>
<span class="um-account-icon uimob800-hide"><i class="<?php echo $info['icon']; ?>"></i></span>
<span class="um-account-title uimob800-hide"><?php echo $info['title']; ?></span>
<span class="um-account-arrow uimob800-hide">
<i class="<?php if ( is_rtl() ) { ?>um-faicon-angle-left<?php } else { ?>um-faicon-angle-right<?php } ?>"></i>
</span>
</a>
</li>
<span class="um-account-icon uimob800-hide"><i class="<?php echo $info['icon']; ?>"></i></span>
<span class="um-account-title uimob800-hide"><?php echo $info['title']; ?></span>
<span class="um-account-arrow uimob800-hide">
<i class="<?php if ( is_rtl() ) { ?>um-faicon-angle-left<?php } else { ?>um-faicon-angle-right<?php } ?>"></i>
</span>
</a>
</li>
<?php }
<?php }
} ?>
</ul>
</div>
@@ -115,25 +115,24 @@
foreach ( UM()->account()->tabs as $id => $info ) {
$current_tab = UM()->account()->current_tab;
$current_tab = UM()->account()->current_tab;
if ( isset( $info['custom'] ) || UM()->options()->get( 'account_tab_' . $id ) == 1 || $id == 'general' ) { ?>
if ( isset( $info['custom'] ) || UM()->options()->get( 'account_tab_' . $id ) == 1 || $id == 'general' ) { ?>
<div class="um-account-nav uimob340-show uimob500-show">
<a href="#" data-tab="<?php echo $id; ?>" class="<?php if ( $id == $current_tab ) echo 'current'; ?>">
<?php echo $info['title']; ?>
<span class="ico"><i class="<?php echo $info['icon']; ?>"></i></span>
<span class="arr"><i class="um-faicon-angle-down"></i></span>
</a>
</div>
<div class="um-account-nav uimob340-show uimob500-show">
<a href="#" data-tab="<?php echo $id; ?>" class="<?php if ( $id == $current_tab ) echo 'current'; ?>">
<?php echo $info['title']; ?>
<span class="ico"><i class="<?php echo $info['icon']; ?>"></i></span>
<span class="arr"><i class="um-faicon-angle-down"></i></span>
</a>
</div>
<div class="um-account-tab um-account-tab-<?php echo $id ?>" data-tab="<?php echo $id ?>">
<?php $info['with_header'] = true;
UM()->account()->render_account_tab( $id, $info, $args ); ?>
</div>
<div class="um-account-tab um-account-tab-<?php echo $id ?>" data-tab="<?php echo $id ?>">
<?php $info['with_header'] = true;
UM()->account()->render_account_tab( $id, $info, $args ); ?>
</div>
<?php }
<?php }
} ?>
</div>
@@ -161,5 +160,5 @@
do_action( 'um_after_account_page_load' ); ?>
</div>
</div>