From a35dbba90517055368217190abc8a59b5071c723 Mon Sep 17 00:00:00 2001
From: Nikita Sinelnikov <nsinelnikov.work@gmail.com>
Date: Tue, 22 Mar 2022 23:06:34 +0200
Subject: [PATCH] - fixed issue with echo XSS in user description;

---
 includes/core/class-fields.php      | 6 ++++++
 includes/core/um-filters-fields.php | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php
index 57e528af..f6a1f7dd 100644
--- a/includes/core/class-fields.php
+++ b/includes/core/class-fields.php
@@ -4203,6 +4203,12 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
 							$res = stripslashes( $res );
 						}
 						if ( 'description' === $data['metakey'] ) {
+							if ( UM()->options()->get( 'profile_show_html_bio' ) ) {
+								$res = make_clickable( wpautop( wp_kses_post( $res ) ) );
+							} else {
+								$res = esc_html( $res );
+							}
+
 							$res = nl2br( $res );
 						}
 
diff --git a/includes/core/um-filters-fields.php b/includes/core/um-filters-fields.php
index 2589a3b3..4b14a2db 100644
--- a/includes/core/um-filters-fields.php
+++ b/includes/core/um-filters-fields.php
@@ -211,7 +211,10 @@ function um_profile_field_filter_hook__textarea( $value, $data ) {
 	$value = html_entity_decode( $value );
 	$value = preg_replace('$(https?://[a-z0-9_./?=&#-]+)(?![^<>]*>)$i', ' <a href="$1" target="_blank">$1</a> ', $value." ");
 	$value = preg_replace('$(www\.[a-z0-9_./?=&#-]+)(?![^<>]*>)$i', '<a target="_blank" href="http://$1">$1</a> ', $value." ");
-	$value = wpautop($value);
+
+	if ( ! ( isset( $data['metakey'] ) && 'description' === $data['metakey'] ) ) {
+		$value = wpautop( $value );
+	}
 
 	return $value;
 }