10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-20 15:13:55 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1087 from ultimatemember/development/2.5.1

Browse Source 
2.5.1 release
This commit is contained in:
Nikita Sinelnikov
2022-10-27 01:34:27 +03:00
committed by GitHub
parent aa6e59f55b 8ff70c0003
commit cb4ca7dbe5
20 changed files with 265 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -41,7 +41,7 @@ GNU Version 2 or Any Later Version
## Releases ## Releases
[Official Release Version: 2.5.0](https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.0). [Official Release Version: 2.5.1](https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1).
## Changelog ## Changelog
includes/admin/core/class-admin-builder.php
+4
View File
@@ -1220,6 +1220,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
$arr_options['function_exists'] = function_exists( $um_callback_func ); $arr_options['function_exists'] = function_exists( $um_callback_func );
} }
if ( in_array( $um_callback_func, UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
wp_send_json_error( __( 'This is not possible for security reasons. Don\'t use internal PHP functions.', 'ultimate-member' ) );
}
$arr_options['data'] = array(); $arr_options['data'] = array();
if ( function_exists( $um_callback_func ) ) { if ( function_exists( $um_callback_func ) ) {
$arr_options['data'] = call_user_func( $um_callback_func ); $arr_options['data'] = call_user_func( $um_callback_func );
includes/admin/core/class-admin-settings.php
-1
View File
@@ -3172,7 +3172,6 @@ do_action( "um_install_info_after_page_config" ); ?>
Default New User Role: <?php echo UM()->options()->get('register_role') . "\n"; ?> Default New User Role: <?php echo UM()->options()->get('register_role') . "\n"; ?>
Profile Permalink Base: <?php echo UM()->options()->get('permalink_base') . "\n"; ?> Profile Permalink Base: <?php echo UM()->options()->get('permalink_base') . "\n"; ?>
User Display Name: <?php echo UM()->options()->get('display_name') . "\n"; ?> User Display Name: <?php echo UM()->options()->get('display_name') . "\n"; ?>
Force Name to Uppercase: <?php echo $this->info_value( UM()->options()->get('force_display_name_capitlized'), 'yesno', true ); ?>
Redirect author to profile: <?php echo $this->info_value( UM()->options()->get('author_redirect'), 'yesno', true ); ?> Redirect author to profile: <?php echo $this->info_value( UM()->options()->get('author_redirect'), 'yesno', true ); ?>
Enable Members Directory: <?php echo $this->info_value( UM()->options()->get('members_page'), 'yesno', true ); ?> Enable Members Directory: <?php echo $this->info_value( UM()->options()->get('members_page'), 'yesno', true ); ?>
Use Gravatars: <?php echo $this->info_value( UM()->options()->get('use_gravatars'), 'yesno', true ); ?> Use Gravatars: <?php echo $this->info_value( UM()->options()->get('use_gravatars'), 'yesno', true ); ?>
includes/admin/core/class-admin-upgrade.php
+15 -5
View File
@@ -356,10 +356,20 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
if ( empty( $_POST['pack'] ) ) { if ( empty( $_POST['pack'] ) ) {
exit(''); exit('');
} else { } else {
ob_start(); $pack = sanitize_text_field( $_POST['pack'] );
include_once $this->packages_dir . sanitize_text_field( $_POST['pack'] ) . DIRECTORY_SEPARATOR . 'init.php'; if ( in_array( $pack, $this->necessary_packages, true ) ) {
ob_get_flush(); $file = $this->packages_dir . $pack . DIRECTORY_SEPARATOR . 'init.php';
exit; if ( file_exists( $file ) ) {
ob_start();
include_once $file;
ob_get_flush();
exit;
} else {
exit('');
}
} else {
exit('');
}
} }
} }
@@ -407,4 +417,4 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
} }
} }
} }
includes/core/class-access.php
+25 -23
View File
@@ -48,23 +48,10 @@ if ( ! class_exists( 'um\core\Access' ) ) {
$this->allow_access = false; $this->allow_access = false;
// NEW HOOKS // NEW HOOKS
// Change recent posts widget query
add_filter( 'widget_posts_args', array( &$this, 'exclude_restricted_posts_widget' ), 99, 1 );
// Exclude pages displayed by wp_list_pages function
add_filter( 'wp_list_pages_excludes', array( &$this, 'exclude_restricted_pages' ), 10, 1 );
// Archives list change where based on restricted posts
add_filter( 'getarchives_where', array( &$this, 'exclude_restricted_posts_archives_widget' ), 99, 2 );
// Navigation line below the post content, change query to exclude restricted // Navigation line below the post content, change query to exclude restricted
add_filter( 'get_next_post_where', array( &$this, 'exclude_navigation_posts' ), 99, 5 ); add_filter( 'get_next_post_where', array( &$this, 'exclude_navigation_posts' ), 99, 5 );
add_filter( 'get_previous_post_where', array( &$this, 'exclude_navigation_posts' ), 99, 5 ); add_filter( 'get_previous_post_where', array( &$this, 'exclude_navigation_posts' ), 99, 5 );
// callbacks for changing posts query
add_action( 'pre_get_posts', array( &$this, 'exclude_posts' ), 99, 1 );
add_filter( 'posts_where', array( &$this, 'exclude_posts_where' ), 10, 2 );
add_filter( 'wp_count_posts', array( &$this, 'custom_count_posts_handler' ), 99, 3 );
// change the title of the post // change the title of the post
add_filter( 'the_title', array( &$this, 'filter_restricted_post_title' ), 10, 2 ); add_filter( 'the_title', array( &$this, 'filter_restricted_post_title' ), 10, 2 );
// change the content of the restricted post // change the content of the restricted post
@@ -91,13 +78,6 @@ if ( ! class_exists( 'um\core\Access' ) ) {
// Gutenberg blocks restrictions // Gutenberg blocks restrictions
add_filter( 'render_block', array( $this, 'restrict_blocks' ), 10, 2 ); add_filter( 'render_block', array( $this, 'restrict_blocks' ), 10, 2 );
// there is posts (Posts/Page/CPT) filtration if site is accessible
// there also will be redirects if they need
// protect posts types
add_filter( 'the_posts', array( &$this, 'filter_protected_posts' ), 99, 2 );
// protect pages for wp_list_pages func
add_filter( 'get_pages', array( &$this, 'filter_protected_posts' ), 99, 2 );
// check the site's accessible more priority have Individual Post/Term Restriction settings // check the site's accessible more priority have Individual Post/Term Restriction settings
add_action( 'template_redirect', array( &$this, 'template_redirect' ), 1000 ); add_action( 'template_redirect', array( &$this, 'template_redirect' ), 1000 );
add_action( 'um_access_check_individual_term_settings', array( &$this, 'um_access_check_individual_term_settings' ) ); add_action( 'um_access_check_individual_term_settings', array( &$this, 'um_access_check_individual_term_settings' ) );
@@ -111,9 +91,31 @@ if ( ! class_exists( 'um\core\Access' ) ) {
* Rollback function for old business logic to avoid security enhancements with 404 errors * Rollback function for old business logic to avoid security enhancements with 404 errors
*/ */
function disable_restriction_pre_queries() { function disable_restriction_pre_queries() {
// callbacks for changing terms query // Using inside plugins_loaded hook because of there can be earlier direct queries without hooks.
// Avoid using to not getting fatal error for not exists WordPress native functions.
// Change recent posts widget query.
add_filter( 'widget_posts_args', array( &$this, 'exclude_restricted_posts_widget' ), 99, 1 );
// Exclude pages displayed by wp_list_pages function.
add_filter( 'wp_list_pages_excludes', array( &$this, 'exclude_restricted_pages' ), 10, 1 );
// Archives list change where based on restricted posts.
add_filter( 'getarchives_where', array( &$this, 'exclude_restricted_posts_archives_widget' ), 99, 2 );
// Callbacks for changing posts query.
add_action( 'pre_get_posts', array( &$this, 'exclude_posts' ), 99, 1 );
add_filter( 'posts_where', array( &$this, 'exclude_posts_where' ), 10, 2 );
add_filter( 'wp_count_posts', array( &$this, 'custom_count_posts_handler' ), 99, 3 );
// Callbacks for changing terms query.
add_action( 'pre_get_terms', array( &$this, 'exclude_hidden_terms_query' ), 99, 1 ); add_action( 'pre_get_terms', array( &$this, 'exclude_hidden_terms_query' ), 99, 1 );
// there is posts (Posts/Page/CPT) filtration if site is accessible
// there also will be redirects if they need
// protect posts types
add_filter( 'the_posts', array( &$this, 'filter_protected_posts' ), 99, 2 );
// protect pages for wp_list_pages func
add_filter( 'get_pages', array( &$this, 'filter_protected_posts' ), 99, 2 );
if ( ! UM()->options()->get( 'disable_restriction_pre_queries' ) ) { if ( ! UM()->options()->get( 'disable_restriction_pre_queries' ) ) {
return; return;
} }
@@ -1136,7 +1138,7 @@ if ( ! class_exists( 'um\core\Access' ) ) {
continue; continue;
} else { } else {
$restriction_settings = $this->get_post_privacy_settings( $menu_item->object_id ); $restriction_settings = $this->get_post_privacy_settings( $menu_item->object_id );
if ( empty( $restriction_settings['_um_access_hide_from_queries'] ) || ! UM()->options()->get( 'disable_restriction_pre_queries' ) ) { if ( empty( $restriction_settings['_um_access_hide_from_queries'] ) || UM()->options()->get( 'disable_restriction_pre_queries' ) ) {
$filtered_items[] = $this->maybe_replace_nav_menu_title( $menu_item ); $filtered_items[] = $this->maybe_replace_nav_menu_title( $menu_item );
continue; continue;
} }
@@ -1414,7 +1416,7 @@ if ( ! class_exists( 'um\core\Access' ) ) {
} }
} }
} else { } else {
if ( empty( $restriction['_um_access_hide_from_queries'] ) || ! UM()->options()->get( 'disable_restriction_pre_queries' ) ) { if ( empty( $restriction['_um_access_hide_from_queries'] ) || UM()->options()->get( 'disable_restriction_pre_queries' ) ) {
$filtered_posts[] = $this->maybe_replace_title( $post ); $filtered_posts[] = $this->maybe_replace_title( $post );
continue; continue;
} }
includes/core/class-builtin.php
+17 -14
View File
@@ -1058,21 +1058,24 @@ if ( ! class_exists( 'um\core\Builtin' ) ) {
), ),
'youtube' => array( 'youtube' => array(
'title' => __('YouTube','ultimate-member'), 'title' => __( 'YouTube', 'ultimate-member' ),
'metakey' => 'youtube', 'metakey' => 'youtube',
'type' => 'url', 'type' => 'url',
'label' => __('YouTube','ultimate-member'), 'label' => __( 'YouTube', 'ultimate-member' ),
'required' => 0, 'required' => 0,
'public' => 1, 'public' => 1,
'editable' => 1, 'editable' => 1,
'url_target' => '_blank', 'url_target' => '_blank',
'url_rel' => 'nofollow', 'url_rel' => 'nofollow',
'icon' => 'um-faicon-youtube', 'icon' => 'um-faicon-youtube',
'validate' => 'youtube_url', 'validate' => 'youtube_url',
'url_text' => 'YouTube', 'url_text' => __( 'YouTube', 'ultimate-member' ),
'advanced' => 'social', 'advanced' => 'social',
'color' => '#e52d27', 'color' => '#e52d27',
'match' => 'https://youtube.com/', 'match' => array(
'https://youtube.com/',
'https://youtu.be/',
),
), ),
'soundcloud' => array( 'soundcloud' => array(
includes/core/class-fields.php
+55 -27
View File
@@ -86,9 +86,10 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
} }
foreach ( $social as $k => $arr ) { foreach ( $social as $k => $arr ) {
if ( um_profile( $k ) ) { ?> if ( um_profile( $k ) ) {
$match = is_array( $arr['match'] ) ? $arr['match'][0] : $arr['match']; ?>
<a href="<?php echo esc_url( um_filtered_social_link( $k, $arr['match'] ) ); ?>" <a href="<?php echo esc_url( um_filtered_social_link( $k, $match ) ); ?>"
style="background: <?php echo esc_attr( $arr['color'] ); ?>;" target="_blank" class="um-tip-n" style="background: <?php echo esc_attr( $arr['color'] ); ?>;" target="_blank" class="um-tip-n"
title="<?php echo esc_attr( $arr['title'] ); ?>"><i class="<?php echo esc_attr( $arr['icon'] ); ?>"></i></a> title="<?php echo esc_attr( $arr['title'] ); ?>"><i class="<?php echo esc_attr( $arr['icon'] ); ?>"></i></a>
@@ -146,17 +147,19 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) { if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) {
if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) { if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' ); if ( ! in_array( $args['custom_dropdown_options_source'], UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
if ( ! empty( $allowed_callbacks ) ) { $allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) ); if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks[] = $args['custom_dropdown_options_source']; $allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
} else { $allowed_callbacks[] = $args['custom_dropdown_options_source'];
$allowed_callbacks = array( $args['custom_dropdown_options_source'] ); } else {
} $allowed_callbacks = array( $args['custom_dropdown_options_source'] );
$allowed_callbacks = array_unique( $allowed_callbacks ); }
$allowed_callbacks = implode( "\r\n", $allowed_callbacks ); $allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks ); UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
}
} }
} }
@@ -201,19 +204,21 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) { if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) {
if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) { if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' ); if ( ! in_array( $args['custom_dropdown_options_source'], UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
if ( ! empty( $allowed_callbacks ) ) { $allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) ); if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks[] = $args['custom_dropdown_options_source']; $allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
} else { $allowed_callbacks[] = $args['custom_dropdown_options_source'];
$allowed_callbacks = array( $args['custom_dropdown_options_source'] ); } else {
$allowed_callbacks = array( $args['custom_dropdown_options_source'] );
}
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
$args['custom_dropdown_options_source'] = wp_unslash( $args['custom_dropdown_options_source'] );
} }
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
$args['custom_dropdown_options_source'] = wp_unslash( $args['custom_dropdown_options_source'] );
} }
} }
@@ -1291,6 +1296,18 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
return ''; return '';
} }
/**
* Getting the blacklist of the functions that cannot be used as callback.
* All internal PHP functions are insecure for using inside callback functions.
*
* @return array
*/
public function dropdown_options_source_blacklist() {
$list = get_defined_functions();
$blacklist = ! empty( $list['internal'] ) ? $list['internal'] : array();
$blacklist = apply_filters( 'um_dropdown_options_source_blacklist', $blacklist );
return $blacklist;
}
/** /**
* Gets selected option value from a callback function * Gets selected option value from a callback function
@@ -1305,6 +1322,10 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
if ( in_array( $type, array( 'select', 'multiselect' ) ) && ! empty( $data['custom_dropdown_options_source'] ) ) { if ( in_array( $type, array( 'select', 'multiselect' ) ) && ! empty( $data['custom_dropdown_options_source'] ) ) {
if ( in_array( $data['custom_dropdown_options_source'], $this->dropdown_options_source_blacklist(), true ) ) {
return $value;
}
$has_custom_source = apply_filters( "um_has_dropdown_options_source__{$data['metakey']}", false ); $has_custom_source = apply_filters( "um_has_dropdown_options_source__{$data['metakey']}", false );
if ( $has_custom_source ) { if ( $has_custom_source ) {
@@ -1372,6 +1393,10 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
if ( in_array( $type, array( 'select', 'multiselect' ) ) && ! empty( $data['custom_dropdown_options_source'] ) ) { if ( in_array( $type, array( 'select', 'multiselect' ) ) && ! empty( $data['custom_dropdown_options_source'] ) ) {
if ( in_array( $data['custom_dropdown_options_source'], $this->dropdown_options_source_blacklist(), true ) ) {
return $arr_options;
}
if ( function_exists( $data['custom_dropdown_options_source'] ) ) { if ( function_exists( $data['custom_dropdown_options_source'] ) ) {
if ( isset( $data['parent_dropdown_relationship'] ) ) { if ( isset( $data['parent_dropdown_relationship'] ) ) {
$arr_options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] ); $arr_options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] );
@@ -3037,7 +3062,9 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
if ( ! empty( $data['custom_dropdown_options_source'] ) && $has_parent_option && function_exists( $data['custom_dropdown_options_source'] ) && if ( ! empty( $data['custom_dropdown_options_source'] ) && $has_parent_option && function_exists( $data['custom_dropdown_options_source'] ) &&
um_user( $data['parent_dropdown_relationship'] ) um_user( $data['parent_dropdown_relationship'] )
) { ) {
$options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] ); if ( ! in_array( $data['custom_dropdown_options_source'], $this->dropdown_options_source_blacklist(), true ) ) {
$options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] );
}
$disabled_by_parent_option = ''; $disabled_by_parent_option = '';
if ( um_user( $form_key ) ) { if ( um_user( $form_key ) ) {
@@ -3053,10 +3080,11 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
// Child dropdown // Child dropdown
if ( $has_parent_option ) { if ( $has_parent_option ) {
if ( ! empty( $data['custom_dropdown_options_source'] ) && $has_parent_option && if ( ! empty( $data['custom_dropdown_options_source'] ) && $has_parent_option &&
function_exists( $data['custom_dropdown_options_source'] ) && isset( UM()->form()->post_form[ $form_key ] ) ) { function_exists( $data['custom_dropdown_options_source'] ) && isset( UM()->form()->post_form[ $form_key ] ) ) {
$options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] ); if ( ! in_array( $data['custom_dropdown_options_source'], $this->dropdown_options_source_blacklist(), true ) ) {
$options = call_user_func( $data['custom_dropdown_options_source'], $data['parent_dropdown_relationship'] );
}
} }
} }
includes/core/class-form.php
+48 -13
View File
@@ -148,6 +148,13 @@ if ( ! class_exists( 'um\core\Form' ) ) {
wp_send_json( $arr_options ); wp_send_json( $arr_options );
} }
if ( in_array( $ajax_source_func, UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
$arr_options['status'] = 'error';
$arr_options['message'] = __( 'This is not possible for security reasons.', 'ultimate-member' );
wp_send_json( $arr_options );
}
if ( isset( $_POST['form_id'] ) ) { if ( isset( $_POST['form_id'] ) ) {
UM()->fields()->set_id = absint( $_POST['form_id'] ); UM()->fields()->set_id = absint( $_POST['form_id'] );
} }
@@ -438,7 +445,7 @@ if ( ! class_exists( 'um\core\Form' ) ) {
* } * }
* ?> * ?>
*/ */
$this->post_form = apply_filters( 'um_submit_post_form', $_POST ); $this->post_form = apply_filters( 'um_submit_post_form', wp_unslash( $_POST ) );
if ( isset( $this->post_form[ UM()->honeypot ] ) && '' !== $this->post_form[ UM()->honeypot ] ) { if ( isset( $this->post_form[ UM()->honeypot ] ) && '' !== $this->post_form[ UM()->honeypot ] ) {
wp_die( esc_html__( 'Hello, spam bot!', 'ultimate-member' ) ); wp_die( esc_html__( 'Hello, spam bot!', 'ultimate-member' ) );
@@ -650,19 +657,47 @@ if ( ! class_exists( 'um\core\Form' ) ) {
$v = sanitize_text_field( $form[ $k ] ); $v = sanitize_text_field( $form[ $k ] );
// Make a proper social link // Make a proper social link
if ( ! empty( $v ) && ! strstr( $v, $f['match'] ) ) { if ( ! empty( $v ) ) {
$domain = trim( strtr( $f['match'], array( $replace_match = is_array( $f['match'] ) ? $f['match'][0] : $f['match'];
'https://' => '',
'http://' => '',
) ), ' /' );
if ( ! strstr( $v, $domain ) ) { $need_replace = false;
$v = $f['match'] . $v; if ( is_array( $f['match'] ) ) {
} else { $need_replace = true;
$v = 'https://' . trim( strtr( $v, array( foreach ( $f['match'] as $arr_match ) {
'https://' => '', if ( strstr( $v, $arr_match ) ) {
'http://' => '', $need_replace = false;
) ), ' /' ); }
}
}
if ( ! is_array( $f['match'] ) || $need_replace ) {
if ( ! strstr( $v, $replace_match ) ) {
$domain = trim(
strtr(
$replace_match,
array(
'https://' => '',
'http://' => '',
)
),
' /'
);
if ( ! strstr( $v, $domain ) ) {
$v = $replace_match . $v;
} else {
$v = 'https://' . trim(
strtr(
$v,
array(
'https://' => '',
'http://' => '',
)
),
' /'
);
}
}
} }
} }
includes/core/class-shortcodes.php
+6 -1
View File
@@ -283,7 +283,12 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
} }
if ( file_exists( $file ) ) { if ( file_exists( $file ) ) {
include $file; // Avoid Directory Traversal vulnerability by the checking the realpath.
// Templates can be situated only in the get_stylesheet_directory() or plugindir templates.
$real_file = wp_normalize_path( realpath( $file ) );
if ( 0 === strpos( $real_file, wp_normalize_path( um_path . "templates" . DIRECTORY_SEPARATOR ) ) || 0 === strpos( $real_file, wp_normalize_path( get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) ) {
include $file;
}
} }
} }
includes/core/class-uploader.php
+6 -6
View File
@@ -786,14 +786,14 @@ if ( ! class_exists( 'um\core\Uploader' ) ) {
if ( isset( $image_info['invalid_image'] ) && $image_info['invalid_image'] == true ) { if ( isset( $image_info['invalid_image'] ) && $image_info['invalid_image'] == true ) {
$error = sprintf(__('Your image is invalid or too large!','ultimate-member') ); $error = sprintf(__('Your image is invalid or too large!','ultimate-member') );
} elseif ( isset($data['min_size']) && ( $image_info['size'] < $data['min_size'] ) ) { } elseif ( isset( $data['min_size'] ) && ( $image_info['size'] < $data['min_size'] ) ) {
$error = $data['min_size_error']; $error = $data['min_size_error'];
} elseif ( isset($data['max_file_size']) && ( $image_info['size'] > $data['max_file_size'] ) ) { } elseif ( isset( $data['max_file_size'] ) && ( $image_info['size'] > $data['max_file_size'] ) ) {
$error = $data['max_file_size_error']; $error = $data['max_file_size_error'];
} elseif ( isset($data['min_width']) && ( $image_info['width'] < $data['min_width'] ) ) { } elseif ( isset( $data['min_width'] ) && ( $image_info['width'] < $data['min_width'] ) ) {
$error = sprintf(__('Your photo is too small. It must be at least %spx wide.','ultimate-member'), $data['min_width']); $error = sprintf( __( 'Your photo is too small. It must be at least %spx wide.', 'ultimate-member' ), $data['min_width'] );
} elseif ( isset($data['min_height']) && ( $image_info['height'] < $data['min_height'] ) ) { } elseif ( isset( $data['min_height'] ) && ( $image_info['height'] < $data['min_height'] ) ) {
$error = sprintf(__('Your photo is too small. It must be at least %spx wide.','ultimate-member'), $data['min_height']); $error = sprintf( __( 'Your photo is too small. It must be at least %spx high.', 'ultimate-member' ), $data['min_height'] );
} }
return $error; return $error;
includes/core/class-user.php
+21 -1
View File
@@ -1641,6 +1641,11 @@ if ( ! class_exists( 'um\core\User' ) ) {
function email_pending() { function email_pending() {
$this->assign_secretkey(); $this->assign_secretkey();
$this->set_status( 'awaiting_email_confirmation' ); $this->set_status( 'awaiting_email_confirmation' );
//clear all sessions for email confirmation pending users
$user = \WP_Session_Tokens::get_instance( um_user( 'ID' ) );
$user->destroy_all();
UM()->mail()->send( um_user( 'user_email' ), 'checkmail_email' ); UM()->mail()->send( um_user( 'user_email' ), 'checkmail_email' );
} }
@@ -1662,6 +1667,11 @@ if ( ! class_exists( 'um\core\User' ) ) {
*/ */
function pending() { function pending() {
$this->set_status( 'awaiting_admin_review' ); $this->set_status( 'awaiting_admin_review' );
//clear all sessions for awaiting admin confirmation users
$user = \WP_Session_Tokens::get_instance( um_user( 'ID' ) );
$user->destroy_all();
UM()->mail()->send( um_user( 'user_email' ), 'pending_email' ); UM()->mail()->send( um_user( 'user_email' ), 'pending_email' );
} }
@@ -1684,6 +1694,11 @@ if ( ! class_exists( 'um\core\User' ) ) {
*/ */
function reject() { function reject() {
$this->set_status( 'rejected' ); $this->set_status( 'rejected' );
//clear all sessions for rejected users
$user = \WP_Session_Tokens::get_instance( um_user( 'ID' ) );
$user->destroy_all();
UM()->mail()->send( um_user( 'user_email' ), 'rejected_email' ); UM()->mail()->send( um_user( 'user_email' ), 'rejected_email' );
} }
@@ -1705,6 +1720,11 @@ if ( ! class_exists( 'um\core\User' ) ) {
*/ */
function deactivate() { function deactivate() {
$this->set_status( 'inactive' ); $this->set_status( 'inactive' );
//clear all sessions for inactive users
$user = \WP_Session_Tokens::get_instance( um_user( 'ID' ) );
$user->destroy_all();
/** /**
* UM hook * UM hook
* *
@@ -2087,7 +2107,7 @@ if ( ! class_exists( 'um\core\User' ) ) {
update_user_meta( $this->id, $key, $value ); update_user_meta( $this->id, $key, $value );
} }
} else { } else {
$args[ $key ] = esc_attr( $changes[ $key ] ); $args[ $key ] = $changes[ $key ];
} }
} }
includes/core/class-validation.php
+4 -2
View File
@@ -95,8 +95,10 @@ if ( ! class_exists( 'um\core\Validation' ) ) {
isset( $fields[ $key ]['custom_dropdown_options_source'] ) && isset( $fields[ $key ]['custom_dropdown_options_source'] ) &&
! empty( $fields[ $key ]['custom_dropdown_options_source'] ) && ! empty( $fields[ $key ]['custom_dropdown_options_source'] ) &&
function_exists( $fields[ $key ]['custom_dropdown_options_source'] ) ) { function_exists( $fields[ $key ]['custom_dropdown_options_source'] ) ) {
$arr_options = call_user_func( $fields[ $key ]['custom_dropdown_options_source'] ); if ( ! in_array( $fields[ $key ]['custom_dropdown_options_source'], UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
$fields[ $key ]['options'] = array_keys( $arr_options ); $arr_options = call_user_func( $fields[ $key ]['custom_dropdown_options_source'] );
$fields[ $key ]['options'] = array_keys( $arr_options );
}
} }
// Unset changed value that doesn't match the option list // Unset changed value that doesn't match the option list
includes/core/um-actions-form.php
+2 -2
View File
@@ -702,7 +702,7 @@ function um_submit_form_errors_hook_( $args ) {
break; break;
case 'youtube_url': case 'youtube_url':
if ( ! UM()->validation()->is_url( $args[ $key ], 'youtube.com' ) ) { if ( ! UM()->validation()->is_url( $args[ $key ], 'youtube.com' ) && ! UM()->validation()->is_url( $args[ $key ], 'youtu.be' ) ) {
UM()->form()->add_error( $key, sprintf( __( 'Please enter a valid %s username or profile URL', 'ultimate-member' ), $array['label'] ) ); UM()->form()->add_error( $key, sprintf( __( 'Please enter a valid %s username or profile URL', 'ultimate-member' ), $array['label'] ) );
} }
break; break;
@@ -806,7 +806,7 @@ function um_submit_form_errors_hook_( $args ) {
$args['user_id'] = um_get_requested_user(); $args['user_id'] = um_get_requested_user();
} }
$email_exists = email_exists( $args[ $key ] ); $email_exists = email_exists( $args[ $key ] );
if ( $args[ $key ] == '' && in_array( $key, array( 'user_email' ) ) ) { if ( $args[ $key ] == '' && in_array( $key, array( 'user_email' ) ) ) {
UM()->form()->add_error( $key, __( 'You must provide your email', 'ultimate-member' ) ); UM()->form()->add_error( $key, __( 'You must provide your email', 'ultimate-member' ) );
includes/core/um-actions-profile.php
+6 -4
View File
@@ -294,10 +294,12 @@ function um_user_edit_profile( $args ) {
if ( isset( $array['options'] ) && in_array( $array['type'], array( 'select', 'multiselect' ) ) ) { if ( isset( $array['options'] ) && in_array( $array['type'], array( 'select', 'multiselect' ) ) ) {
$options = array(); $options = array();
if ( ! empty( $array['custom_dropdown_options_source'] ) && function_exists( $array['custom_dropdown_options_source'] ) && ! $has_custom_source ) { if ( ! empty( $array['custom_dropdown_options_source'] ) && function_exists( $array['custom_dropdown_options_source'] ) && ! $has_custom_source ) {
$callback_result = call_user_func( $array['custom_dropdown_options_source'], $array['options'] ); if ( ! in_array( $array['custom_dropdown_options_source'], UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
if ( is_array( $callback_result ) ) { $callback_result = call_user_func( $array['custom_dropdown_options_source'], $array['options'] );
$options = array_keys( $callback_result ); if ( is_array( $callback_result ) ) {
$options = array_keys( $callback_result );
}
} }
} }
includes/core/um-actions-register.php
+5 -2
View File
@@ -178,8 +178,11 @@ function um_check_user_status( $user_id, $args ) {
do_action( "track_{$status}_user_registration" ); do_action( "track_{$status}_user_registration" );
if ( $status == 'approved' ) { if ( $status == 'approved' ) {
// Check if user is logged in because there can be the customized way when through 'um_registration_for_loggedin_users' hook the registration is enabled for the logged in users (e.g. Administrator).
UM()->user()->auto_login( $user_id ); if ( ! is_user_logged_in() ) {
// Custom way if 'um_registration_for_loggedin_users' hook after custom callbacks returns true. Then don't make auto-login because user is already logged-in.
UM()->user()->auto_login( $user_id );
}
UM()->user()->generate_profile_slug( $user_id ); UM()->user()->generate_profile_slug( $user_id );
/** /**
includes/core/um-filters-fields.php
+3
View File
@@ -694,6 +694,9 @@ add_filter( 'um_field_non_utf8_value', 'um_field_non_utf8_value' );
*/ */
function um_select_dropdown_dynamic_callback_options( $options, $data ) { function um_select_dropdown_dynamic_callback_options( $options, $data ) {
if ( ! empty( $data['custom_dropdown_options_source'] ) && function_exists( $data['custom_dropdown_options_source'] ) ) { if ( ! empty( $data['custom_dropdown_options_source'] ) && function_exists( $data['custom_dropdown_options_source'] ) ) {
if ( in_array( $data['custom_dropdown_options_source'], UM()->fields()->dropdown_options_source_blacklist(), true ) ) {
return $options;
}
$options = call_user_func( $data['custom_dropdown_options_source'] ); $options = call_user_func( $data['custom_dropdown_options_source'] );
} }
includes/core/um-filters-navmenu.php
+19 -16
View File
@@ -20,13 +20,13 @@ if ( ! is_admin() ) {
} }
foreach ( $sorted_menu_items as &$menu_item ) { foreach ( $sorted_menu_items as &$menu_item ) {
if ( $menu_item->title ) { if ( ! empty( $menu_item->title ) ) {
$menu_item->title = UM()->shortcodes()->convert_user_tags( $menu_item->title ); $menu_item->title = UM()->shortcodes()->convert_user_tags( $menu_item->title );
} }
if ( $menu_item->attr_title ) { if ( ! empty( $menu_item->attr_title ) ) {
$menu_item->attr_title = UM()->shortcodes()->convert_user_tags( $menu_item->attr_title ); $menu_item->attr_title = UM()->shortcodes()->convert_user_tags( $menu_item->attr_title );
} }
if ( $menu_item->description ) { if ( ! empty( $menu_item->description ) ) {
$menu_item->description = UM()->shortcodes()->convert_user_tags( $menu_item->description ); $menu_item->description = UM()->shortcodes()->convert_user_tags( $menu_item->description );
} }
} }
@@ -56,19 +56,22 @@ if ( ! is_admin() ) {
um_fetch_user( get_current_user_id() ); um_fetch_user( get_current_user_id() );
$filtered_items = array(); $filtered_items = array();
$hide_children_of = array(); $hide_children_of = array();
//other filter //other filter
foreach ( $menu_items as $item ) { foreach ( $menu_items as $item ) {
if ( empty( $item->ID ) ) {
continue;
}
$mode = get_post_meta( $item->ID, 'menu-item-um_nav_public', true ); $mode = get_post_meta( $item->ID, 'menu-item-um_nav_public', true );
$roles = get_post_meta( $item->ID, 'menu-item-um_nav_roles', true ); $roles = get_post_meta( $item->ID, 'menu-item-um_nav_roles', true );
$visible = true; $visible = true;
// hide any item that is the child of a hidden item // hide any item that is the child of a hidden item
if ( in_array( $item->menu_item_parent, $hide_children_of ) ) { if ( isset( $item->menu_item_parent ) && in_array( $item->menu_item_parent, $hide_children_of ) ) {
$visible = false; $visible = false;
$hide_children_of[] = $item->ID; // for nested menus $hide_children_of[] = $item->ID; // for nested menus
} }
@@ -79,16 +82,16 @@ if ( ! is_admin() ) {
case 2: case 2:
if ( is_user_logged_in() && ! empty( $roles ) ) { if ( is_user_logged_in() && ! empty( $roles ) ) {
if ( current_user_can( 'administrator' ) ) { if ( current_user_can( 'administrator' ) ) {
$visible = true; $visible = true;
} else { } else {
$current_user_roles = um_user( 'roles' ); $current_user_roles = um_user( 'roles' );
if ( empty( $current_user_roles ) ) { if ( empty( $current_user_roles ) ) {
$visible = false; $visible = false;
} else { } else {
$visible = ( count( array_intersect( $current_user_roles, (array)$roles ) ) > 0 ) ? true : false; $visible = ( count( array_intersect( $current_user_roles, (array)$roles ) ) > 0 ) ? true : false;
} }
} }
} else { } else {
$visible = is_user_logged_in() ? true : false; $visible = is_user_logged_in() ? true : false;
} }
includes/um-short-functions.php
+1 -16
View File
@@ -2306,10 +2306,6 @@ function um_user( $data, $attrs = null ) {
$name = um_profile( $data ); $name = um_profile( $data );
if ( UM()->options()->get( 'force_display_name_capitlized' ) ) {
$name = implode( '-', array_map( 'ucfirst', explode( '-', $name ) ) );
}
/** /**
* UM hook * UM hook
* *
@@ -2366,14 +2362,7 @@ function um_user( $data, $attrs = null ) {
$f_and_l_initial = um_profile( $data ); $f_and_l_initial = um_profile( $data );
} }
$f_and_l_initial = UM()->validation()->safe_name_in_url( $f_and_l_initial ); $name = UM()->validation()->safe_name_in_url( $f_and_l_initial );
if ( UM()->options()->get( 'force_display_name_capitlized' ) ) {
$name = implode( '-', array_map( 'ucfirst', explode( '-', $f_and_l_initial ) ) );
} else {
$name = $f_and_l_initial;
}
return $name; return $name;
break; break;
@@ -2459,10 +2448,6 @@ function um_user( $data, $attrs = null ) {
} }
} }
if ( UM()->options()->get( 'force_display_name_capitlized' ) ) {
$name = implode( '-', array_map( 'ucfirst', explode( '-', $name ) ) );
}
/** /**
* UM hook * UM hook
* *
readme.txt
+26 -1
View File
@@ -7,7 +7,7 @@ Tags: community, member, membership, user-profile, user-registration
Requires PHP: 5.6 Requires PHP: 5.6
Requires at least: 5.0 Requires at least: 5.0
Tested up to: 6.0 Tested up to: 6.0
Stable tag: 2.5.0 Stable tag: 2.5.1
License: GNU Version 2 or Any Later Version License: GNU Version 2 or Any Later Version
License URI: http://www.gnu.org/licenses/gpl-3.0.txt License URI: http://www.gnu.org/licenses/gpl-3.0.txt
@@ -163,6 +163,31 @@ No, you do not need to use our plugin’s login or registration pages and can us
* To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0) * To learn more about version 2.1 please see this [docs](https://docs.ultimatemember.com/article/1512-upgrade-2-1-0)
* UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin * UM2.1+ is a significant update to the Member Directories' code base from 2.0.x. Please make sure you take a full-site backup with restore point before updating the plugin
= 2.5.1: October 26, 2022 =
* Enhancements:
- Added: Custom fields callbacks blacklist. Use `um_dropdown_options_source_blacklist` filter for adding your custom functions to the custom callbacks blacklist. By default there are all PHP internal functions.
* Bugfixes:
- Fixed: Posts' restriction that is based on term restriction settings
- Fixed: Issue with class name in checkbox and radio. Class name being 'activeright' instead of 'active right'
- Fixed: Admin upgrade scripts and upgrades pack validation
- Fixed: Directory traversal vulnerabilities
- Fixed: Destroying user sessions after changing "Approved" status to something else (e.g. deactivated)
- Fixed: Conflict when `wp_get_current_user()` not exists. Transferred restriction settings callbacks to `plugins_loaded` hook
- Fixed: Restriction post displaying when 404 is enabled and old restiction logic isn't active
- Fixed: PHP warning when nav menu is empty
- Fixed: Disable auto-login after user is registered by Administrator and UM Registration form
- Fixed: Some typos errors
- Fixed: Using an apostrophe symbols in emails for registration and login both
- Fixed: Sanitizing YouTube links. Applying both https://youtu.be/xxxxxxx and https://youtube.com/xxxxxxx links
* Deprecated:
- Removed: Outdated setting using in code (force_display_name_capitlized). Moved the functionality to extended [repo](https://github.com/ultimatemember/Extended/tree/main/um-capitalize-name#readme)
= 2.5.0: August 17, 2022 = = 2.5.0: August 17, 2022 =
* Enhancements: * Enhancements:
ultimate-member.php
+1 -1
View File
@@ -3,7 +3,7 @@
Plugin Name: Ultimate Member Plugin Name: Ultimate Member
Plugin URI: http://ultimatemember.com/ Plugin URI: http://ultimatemember.com/
Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress
Version: 2.5.0 Version: 2.5.1
Author: Ultimate Member Author: Ultimate Member
Author URI: http://ultimatemember.com/ Author URI: http://ultimatemember.com/
Text Domain: ultimate-member Text Domain: ultimate-member