From 118f5a1706b63b6736e8cf8738495149ec54b3bb Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Tue, 14 Jun 2022 01:26:09 +0300 Subject: [PATCH 01/10] - updated version; --- readme.txt | 3 +++ ultimate-member.php | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/readme.txt b/readme.txt index 98f392e5..aefcf122 100644 --- a/readme.txt +++ b/readme.txt @@ -163,6 +163,9 @@ No, you do not need to use our plugin’s login or registration pages and can us * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin += 2.4.2: July xx, 2022 = + + = 2.4.1: June 13, 2022 = * Enhancements: diff --git a/ultimate-member.php b/ultimate-member.php index c85a2ef0..59ae99e8 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.4.1 +Version: 2.4.2-alpha Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member From 986805e06484244964d8cb2868aeb6ab1a0f37c6 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Thu, 16 Jun 2022 01:41:37 +0300 Subject: [PATCH 02/10] - added GH action for checking PHPCS + WPCS --- .github/workflows/code-quality.yml | 17 +++++++++++++++++ composer.json | 9 ++++++++- phpcs.xml | 25 +++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/code-quality.yml create mode 100644 phpcs.xml diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml new file mode 100644 index 00000000..5265fed1 --- /dev/null +++ b/.github/workflows/code-quality.yml @@ -0,0 +1,17 @@ +name: JobBoardWP GitHub Actions + +on: push + +jobs: + build: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + + - name: Install dependencies + run: composer install --prefer-dist --no-progress --no-suggest + + - name: Run CS + run: vendor/bin/phpcs --standard=phpcs.xml . diff --git a/composer.json b/composer.json index a706435a..994e1a1f 100644 --- a/composer.json +++ b/composer.json @@ -10,7 +10,14 @@ "woocommerce/action-scheduler": "3.2.1" }, "require-dev": { - "roave/security-advisories": "dev-master" + "roave/security-advisories": "dev-master", + "wp-cli/wp-cli": "*", + "dealerdirect/phpcodesniffer-composer-installer": "^0.7.1", + "object-calisthenics/phpcs-calisthenics-rules": "*", + "phpcompatibility/phpcompatibility-wp": "*", + "wp-coding-standards/wpcs": "2.3.0", + "squizlabs/php_codesniffer": "3.*", + "phpdocumentor/phpdocumentor": "3.1.*" }, "extra": { "installer-paths": { diff --git a/phpcs.xml b/phpcs.xml new file mode 100644 index 00000000..7e29e70d --- /dev/null +++ b/phpcs.xml @@ -0,0 +1,25 @@ + + + + Best practices Ultimate Member Coding Standards + + + + + + + + + \.github/* + vendor/* + node_modules/* + documentor/* + \.idea/* + + + + + *\.php$ + + + From 4171c03f718336e6d66e892af2197eabf3a71ca5 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Thu, 16 Jun 2022 01:47:02 +0300 Subject: [PATCH 03/10] - updated gitignore file; --- .gitignore | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.gitignore b/.gitignore index 492d3a80..706e5908 100644 --- a/.gitignore +++ b/.gitignore @@ -222,3 +222,16 @@ assets/vendor/ package-lock.json .idea/ composer.lock + +# exclude Composer installation +composer.phar +/vendor + +# exclude WP-CLI installation +wp-cli.phar + +# exclude generated by phpDocumentor docs +/documentor + +#wp-hookdoc generated docs +hookdocs From 62867920e9bd4b190d22d11cf18ec90f13a5edc5 Mon Sep 17 00:00:00 2001 From: yuriinalivaiko Date: Sat, 18 Jun 2022 16:52:57 +0300 Subject: [PATCH 04/10] - fixed select2 style conflicts with 3-party plugins --- assets/css/um-styles.css | 56 ++++++++++++++++++++-------------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/assets/css/um-styles.css b/assets/css/um-styles.css index 29e708cc..4d974a75 100644 --- a/assets/css/um-styles.css +++ b/assets/css/um-styles.css @@ -881,10 +881,10 @@ small.um-max-filesize span{ - Customize Select2 CSS */ -.select2-container.select2-container--open { +.um-field .select2-container.select2-container--open { z-index: 9999999; } -.select2.select2-container .select2-selection { +.um-field .select2.select2-container .select2-selection { display: block !important; height: 40px; padding: 0 0 0 12px !important; @@ -909,11 +909,11 @@ small.um-max-filesize span{ background-color: #fff !important; border: 1px solid #ddd !important; } -.rtl .select2.select2-container .select2-selection { +.rtl .um-field .select2.select2-container .select2-selection { padding: 0 12px 0 0 !important; } -.select2.select2-container .select2-selection .select2-selection__arrow { +.um-field .select2.select2-container .select2-selection .select2-selection__arrow { display: inline-block !important; width: 34px !important; height: 100% !important; @@ -928,12 +928,12 @@ small.um-max-filesize span{ background: transparent !important; border-left: 0 !important; } -.rtl .select2.select2-container .select2-selection .select2-selection__arrow { +.rtl .um-field .select2.select2-container .select2-selection .select2-selection__arrow { right: initial !important; left: 0 !important; } -.select2.select2-container .select2-selection .select2-selection__arrow:before { +.um-field .select2.select2-container .select2-selection .select2-selection__arrow:before { content: "\f3d0" !important; font-size: 28px !important; font-family: "Ionicons" !important; @@ -946,16 +946,16 @@ small.um-max-filesize span{ color: #aaaaaa; } -.select2.select2-container .select2-selection .select2-selection__arrow b[role="presentation"] { +.um-field .select2.select2-container .select2-selection .select2-selection__arrow b[role="presentation"] { display: none; } -.select2-container.select2-container--open .select2-dropdown { +.um-field .select2-container.select2-container--open .select2-dropdown { border: 1px solid #ddd !important; border-radius: 0; } -.select2-container.select2-container--open .select2-dropdown .select2-results li { +.um-field .select2-container.select2-container--open .select2-dropdown .select2-results li { list-style: none; display: list-item; background-image: none; @@ -967,24 +967,24 @@ small.um-max-filesize span{ min-height: 1em !important; } -.select2.select2-container .select2-selection.select2-selection--multiple { +.um-field .select2.select2-container .select2-selection.select2-selection--multiple { height: auto !important; line-height: 0.8 !important; min-height: 40px; padding-bottom: 4px !important; } -.select2-container--default .select2-selection--single .select2-selection__rendered { +.um-field .select2-container--default .select2-selection--single .select2-selection__rendered { line-height: 37px; padding-left: 0 !important; padding-right: 24px !important; } -.rtl .select2-container--default .select2-selection--single .select2-selection__rendered { +.rtl .um-field .select2-container--default .select2-selection--single .select2-selection__rendered { padding-left: 24px !important; padding-right: 0 !important; } -.select2-container--default .select2-selection--multiple .select2-selection__rendered { +.um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered { line-height: 37px; box-sizing: border-box; list-style: none; @@ -994,23 +994,23 @@ small.um-max-filesize span{ width: 100%; font-size: 13px; } -.rtl .select2-container--default .select2-selection--multiple .select2-selection__rendered { +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered { padding-left: 30px !important; padding-right: 0 !important; } -.select2-results li.select2-results__option.select2-results__option--highlighted { +.um-field .select2-results li.select2-results__option.select2-results__option--highlighted { background: none !important; background: #f4f4f4 !important; color: #666 !important; } -.select2-container--default .select2-results__option[aria-selected="true"] { +.um-field .select2-container--default .select2-results__option[aria-selected="true"] { background-color: #ddd; } -.select2-container--default .select2-selection--single .select2-selection__clear, -.select2-container--default .select2-selection--multiple .select2-selection__clear { +.um-field .select2-container--default .select2-selection--single .select2-selection__clear, +.um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { color: #aaaaaa !important; font-size: 28px; font-weight: normal; @@ -1020,42 +1020,42 @@ small.um-max-filesize span{ text-align: center; width: 1em; } -.rtl .select2-container--default .select2-selection--single .select2-selection__clear, -.rtl .select2-container--default .select2-selection--multiple .select2-selection__clear { +.rtl .um-field .select2-container--default .select2-selection--single .select2-selection__clear, +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { left: 0; right: initial; } -.select2-container--default .select2-selection--multiple .select2-selection__clear { +.um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { position: absolute; } -.select2-container--default .select2-selection--multiple .select2-selection__choice { +.um-field .select2-container--default .select2-selection--multiple .select2-selection__choice { margin: 5px 5px 0 0; + max-height: 28px; padding: 3px 3px 3px 5px; } -.rtl .select2-container--default .select2-selection--multiple .select2-selection__choice{ +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__choice{ margin: 5px 0 0 5px; - max-height: 28px; padding: 3px 5px 3px 3px; } -.um .um-form .select2-container .select2-search.select2-search--inline{ +.um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline{ margin: 5px 5px 0 0; padding: 0px; } -.rtl .um .um-form .select2-container .select2-search.select2-search--inline{ +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline{ margin: 5px 0 0 5px; } -.um .um-form .select2-container .select2-search.select2-search--inline > input { +.um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline > input { border: none !important; padding: 0 !important; border-radius: 0 !important; max-height: 28px; } -.um .um-form .select2-container--default .select2-selection--multiple .select2-selection__rendered li { +.um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered li { overflow-x: hidden; text-overflow: ellipsis; max-width: 100%; From e013db9102ea2fd8286911efd79b9545ce52bcc0 Mon Sep 17 00:00:00 2001 From: yuriinalivaiko Date: Wed, 22 Jun 2022 00:28:24 +0300 Subject: [PATCH 05/10] - added selectors for the .um-search-filter wrapper --- assets/css/um-styles.css | 113 ++++++++++++++++++--------------------- 1 file changed, 53 insertions(+), 60 deletions(-) diff --git a/assets/css/um-styles.css b/assets/css/um-styles.css index 4d974a75..4db8e5e5 100644 --- a/assets/css/um-styles.css +++ b/assets/css/um-styles.css @@ -881,9 +881,11 @@ small.um-max-filesize span{ - Customize Select2 CSS */ +.um-search-filter .select2-container.select2-container--open, .um-field .select2-container.select2-container--open { z-index: 9999999; } +.um-search-filter .select2.select2-container .select2-selection, .um-field .select2.select2-container .select2-selection { display: block !important; height: 40px; @@ -894,8 +896,6 @@ small.um-max-filesize span{ line-height: 35px !important; color: #666 !important; font-size: 15px !important; - text-align: left !important; - text-decoration: none !important; -moz-border-radius: 2px !important; -webkit-border-radius: 2px !important; border-radius: 2px !important; @@ -905,39 +905,37 @@ small.um-max-filesize span{ -moz-user-select: none; -ms-user-select: none; user-select: none; - background: none !important; - background-color: #fff !important; + background: #fff !important; border: 1px solid #ddd !important; } +.rtl .um-search-filter .select2.select2-container .select2-selection, .rtl .um-field .select2.select2-container .select2-selection { padding: 0 12px 0 0 !important; } +.um-search-filter .select2.select2-container .select2-selection .select2-selection__arrow, .um-field .select2.select2-container .select2-selection .select2-selection__arrow { display: inline-block !important; width: 34px !important; height: 100% !important; - position: absolute !important; - right: 0 !important; - top: 0 !important; - -moz-border-radius: 0 2px 2px 0 !important; - -webkit-border-radius: 0 2px 2px 0 !important; - border-radius: 0 2px 2px 0 !important; - background-clip: padding-box !important; - text-align: center !important; + position: absolute; + right: 0; + top: 0; + text-align: center; background: transparent !important; - border-left: 0 !important; + border: none !important; } +.rtl .um-search-filter .select2.select2-container .select2-selection .select2-selection__arrow, .rtl .um-field .select2.select2-container .select2-selection .select2-selection__arrow { - right: initial !important; - left: 0 !important; + right: initial; + left: 0; } +.um-search-filter .select2.select2-container .select2-selection .select2-selection__arrow:before, .um-field .select2.select2-container .select2-selection .select2-selection__arrow:before { content: "\f3d0" !important; font-size: 28px !important; font-family: "Ionicons" !important; - font-weight: normal; display: block; height: 100%; line-height: 40px; @@ -946,27 +944,31 @@ small.um-max-filesize span{ color: #aaaaaa; } +.um-search-filter .select2.select2-container .select2-selection .select2-selection__arrow b[role="presentation"], .um-field .select2.select2-container .select2-selection .select2-selection__arrow b[role="presentation"] { display: none; } +.um-search-filter .select2-container.select2-container--open .select2-dropdown, .um-field .select2-container.select2-container--open .select2-dropdown { border: 1px solid #ddd !important; border-radius: 0; } +.um-search-filter .select2-container.select2-container--open .select2-dropdown .select2-results li, .um-field .select2-container.select2-container--open .select2-dropdown .select2-results li { list-style: none; display: list-item; - background-image: none; + background: none; font-size: 15px; margin: 5px !important; color: #666 !important; padding: 3px 7px 4px !important; cursor: pointer; - min-height: 1em !important; + min-height: 1em; } +.um-search-filter .select2.select2-container .select2-selection.select2-selection--multiple, .um-field .select2.select2-container .select2-selection.select2-selection--multiple { height: auto !important; line-height: 0.8 !important; @@ -974,44 +976,50 @@ small.um-max-filesize span{ padding-bottom: 4px !important; } +.um-search-filter .select2-container--default .select2-selection--single .select2-selection__rendered, .um-field .select2-container--default .select2-selection--single .select2-selection__rendered { line-height: 37px; - padding-left: 0 !important; - padding-right: 24px !important; + padding-left: 0px; + padding-right: 24px; } +.rtl .um-search-filter .select2-container--default .select2-selection--single .select2-selection__rendered, .rtl .um-field .select2-container--default .select2-selection--single .select2-selection__rendered { - padding-left: 24px !important; - padding-right: 0 !important; + padding-left: 24px; + padding-right: 0px; } +.um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__rendered, .um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered { line-height: 37px; box-sizing: border-box; list-style: none; margin: 0; - padding-left: 0 !important; + padding-left: 0px; padding-right: 30px; width: 100%; font-size: 13px; } +.rtl .um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__rendered, .rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered { - padding-left: 30px !important; - padding-right: 0 !important; + padding-left: 30px; + padding-right: 0px; } -.um-field .select2-results li.select2-results__option.select2-results__option--highlighted { - background: none !important; - background: #f4f4f4 !important; - color: #666 !important; +.um-search-filter .select2-dropdown .select2-results li.select2-results__option.select2-results__option--highlighted, +.um-field .select2-dropdown .select2-results li.select2-results__option.select2-results__option--highlighted { + background: #f4f4f4; + color: #666; } -.um-field .select2-container--default .select2-results__option[aria-selected="true"] { +.um-search-filter .select2-dropdown .select2-results li.select2-results__option[aria-selected="true"], +.um-field .select2-dropdown .select2-results li.select2-results__option[aria-selected="true"] { background-color: #ddd; } - +.um-search-filter .select2-container--default .select2-selection--single .select2-selection__clear, +.um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__clear, .um-field .select2-container--default .select2-selection--single .select2-selection__clear, .um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { - color: #aaaaaa !important; + color: #aaaaaa; font-size: 28px; font-weight: normal; line-height: 34px; @@ -1020,41 +1028,49 @@ small.um-max-filesize span{ text-align: center; width: 1em; } +.rtl .um-search-filter .select2-container--default .select2-selection--single .select2-selection__clear, +.rtl .um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__clear, .rtl .um-field .select2-container--default .select2-selection--single .select2-selection__clear, .rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { left: 0; right: initial; } +.um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__clear, .um-field .select2-container--default .select2-selection--multiple .select2-selection__clear { position: absolute; } +.um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__choice, .um-field .select2-container--default .select2-selection--multiple .select2-selection__choice { margin: 5px 5px 0 0; max-height: 28px; padding: 3px 3px 3px 5px; } -.rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__choice{ +.rtl .um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__choice, +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-selection__choice { margin: 5px 0 0 5px; padding: 3px 5px 3px 3px; } -.um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline{ +.um-search-filter .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline, +.um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline { margin: 5px 5px 0 0; padding: 0px; } -.rtl .um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline{ +.rtl .um-search-filter .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline, +.rtl .um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline { margin: 5px 0 0 5px; } +.um-search-filter .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline > input, .um-field .select2-container--default .select2-selection--multiple .select2-search.select2-search--inline > input { border: none !important; padding: 0 !important; - border-radius: 0 !important; max-height: 28px; } +.um-search-filter .select2-container--default .select2-selection--multiple .select2-selection__rendered li, .um-field .select2-container--default .select2-selection--multiple .select2-selection__rendered li { overflow-x: hidden; text-overflow: ellipsis; @@ -1066,31 +1082,8 @@ small.um-max-filesize span{ /* - Multi-select */ -/*.um-field .select2-selection--multiple .select2-search{*/ - /*clear: both;*/ - /*float: none;*/ - /*margin-right: 12px;*/ - /*padding-top: 0.5rem;*/ - /*position: relative;*/ -/*}*/ -/*.um-field .select2-selection--multiple .select2-search:first-of-type{*/ - /*padding-top: 12px;*/ -/*}*/ -/*.um-field .select2-selection--multiple .select2-search::before {*/ - /*content: "\f21f";*/ - /*font-family: "Ionicons";*/ - /*font-size: 1.4rem;*/ - /*line-height: 2rem;*/ - /*right: 0.3rem;*/ - /*position: absolute;*/ -/*}*/ -/*.um-field .select2-selection--multiple .select2-search input.select2-search__field{*/ - /*background-color: rgba(128,128,128,0.1) !important;*/ - /*height: 2rem !important;*/ - /*width: 100% !important;*/ -/*}*/ -/* @todo maybe deprecated and used only for select and multiselect */ +/* @todo maybe deprecated and used only for select and multiselect */ .um-field-select .um-field-area .um-field-icon, .um-field-multiselect .um-field-area .um-field-icon { z-index: 99999999; From 4da0ae5392d2fa6e3ef8f1c7c82b72c3d124f94d Mon Sep 17 00:00:00 2001 From: ashubawork Date: Wed, 6 Jul 2022 13:04:09 +0300 Subject: [PATCH 06/10] - fix url for edit tabs --- includes/core/class-fields.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php index 2abe7a70..ebbbe7d4 100644 --- a/includes/core/class-fields.php +++ b/includes/core/class-fields.php @@ -4487,7 +4487,15 @@ if ( ! class_exists( 'um\core\Fields' ) ) { } if ( um_is_myprofile() ) { - $output .= '

' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), esc_url( um_edit_profile_url() ) ) . '

'; + if ( isset( $_GET['profiletab'] ) && 'main' !== $_GET['profiletab'] ) { + $tab = sanitize_key( $_GET['profiletab'] ); + $edit_action = 'edit_' . $tab; + $profile_url = um_user_profile_url( um_profile_id() ); + $edit_url = add_query_arg( array( 'profiletab' => $tab, 'um_action' => $edit_action ), $profile_url ); + } else { + $edit_url = um_edit_profile_url(); + } + $output .= '

' . $emo . '' . sprintf( __( 'Your profile is looking a little empty. Why not add some information!', 'ultimate-member' ), esc_url( $edit_url ) ) . '

'; } else { $output .= '

' . $emo . '' . __( 'This user has not added any information to their profile yet.', 'ultimate-member' ) . '

'; } From fb6a4f56795f9eae9f1e880e6b1d288f36c0acdb Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Thu, 7 Jul 2022 14:30:10 +0300 Subject: [PATCH 07/10] - fixed security vulnerability in member directories queries; --- includes/core/class-member-directory-meta.php | 11 ++++++++++- includes/core/class-member-directory.php | 9 +++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/includes/core/class-member-directory-meta.php b/includes/core/class-member-directory-meta.php index c2f999f6..268934ed 100644 --- a/includes/core/class-member-directory-meta.php +++ b/includes/core/class-member-directory-meta.php @@ -446,7 +446,16 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) { $blog_id = get_current_blog_id(); - $directory_id = $this->get_directory_by_hash( $_POST['directory_id'] ); + if ( empty( $_POST['directory_id'] ) ) { + wp_send_json_error( __( 'Wrong member directory data', 'ultimate-member' ) ); + } + + $directory_id = $this->get_directory_by_hash( sanitize_key( $_POST['directory_id'] ) ); + + if ( empty( $directory_id ) ) { + wp_send_json_error( __( 'Wrong member directory data', 'ultimate-member' ) ); + } + $directory_data = UM()->query()->post_data( $directory_id ); //predefined result for user without capabilities to see other members diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php index 9721fd50..752018f5 100644 --- a/includes/core/class-member-directory.php +++ b/includes/core/class-member-directory.php @@ -2465,7 +2465,16 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { global $wpdb; + if ( empty( $_POST['directory_id'] ) ) { + wp_send_json_error( __( 'Wrong member directory data', 'ultimate-member' ) ); + } + $directory_id = $this->get_directory_by_hash( sanitize_key( $_POST['directory_id'] ) ); + + if ( empty( $directory_id ) ) { + wp_send_json_error( __( 'Wrong member directory data', 'ultimate-member' ) ); + } + $directory_data = UM()->query()->post_data( $directory_id ); //predefined result for user without capabilities to see other members From c0f5ec75e25cb7ab5a9099b89906156001e1518c Mon Sep 17 00:00:00 2001 From: yuriinalivaiko Date: Tue, 12 Jul 2022 19:35:22 +0300 Subject: [PATCH 08/10] - fix fatal error on unset --- includes/core/class-fields.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php index ebbbe7d4..7d9b1ffe 100644 --- a/includes/core/class-fields.php +++ b/includes/core/class-fields.php @@ -308,7 +308,9 @@ if ( ! class_exists( 'um\core\Fields' ) ) { // Admin filtering $directory_search_filters = get_post_meta( $directory_id, '_um_search_filters', true ); - unset( $directory_search_filters[ $id ] ); + if ( isset( $directory_search_filters[ $id ] ) ) { + unset( $directory_search_filters[ $id ] ); + } update_post_meta( $directory_id, '_um_search_filters', $directory_search_filters ); // display in tagline From dd6f79d5271f71e53010cd08e3c51c5a1bd23cc7 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Thu, 14 Jul 2022 18:24:22 +0300 Subject: [PATCH 09/10] - 2.4.2 release; --- readme.txt | 10 ++++++++-- ultimate-member.php | 2 +- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/readme.txt b/readme.txt index aefcf122..7a98a3ed 100644 --- a/readme.txt +++ b/readme.txt @@ -7,7 +7,7 @@ Tags: community, member, membership, user-profile, user-registration Requires PHP: 5.6 Requires at least: 5.0 Tested up to: 6.0 -Stable tag: 2.4.1 +Stable tag: 2.4.2 License: GNU Version 2 or Any Later Version License URI: http://www.gnu.org/licenses/gpl-3.0.txt @@ -163,8 +163,14 @@ No, you do not need to use our plugin’s login or registration pages and can us * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin -= 2.4.2: July xx, 2022 = += 2.4.2: July 14, 2022 = +* Bugfixes: + + - Fixed: Member Directory vulnerabilities + - Fixed: 3rd-party integration with profile tabs and ability to show edit profile form on the 3rd-party profile tab + - Fixed: PHP fatal error on unset + - Fixed: select2 style conflicts with 3rd-party plugins = 2.4.1: June 13, 2022 = diff --git a/ultimate-member.php b/ultimate-member.php index 59ae99e8..8d9c9910 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.4.2-alpha +Version: 2.4.2 Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member From ab39f9c811d570f3dadea9cbae1c07e46b77e935 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Thu, 14 Jul 2022 18:24:58 +0300 Subject: [PATCH 10/10] - updated readme; --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 03bc34f3..7ab7df7b 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ GNU Version 2 or Any Later Version ## Releases -[Official Release Version: 2.4.1](https://github.com/ultimatemember/ultimatemember/releases/tag/2.4.1). +[Official Release Version: 2.4.2](https://github.com/ultimatemember/ultimatemember/releases/tag/2.4.2). ## Changelog