From a85cb5cbb9b716ff6868f9b0b0b73f6e74d0b7c8 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Fri, 8 Dec 2023 14:40:12 +0200 Subject: [PATCH 01/11] - updated version; --- readme.txt | 5 +++++ ultimate-member.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/readme.txt b/readme.txt index 2379a733..bbeae4ec 100644 --- a/readme.txt +++ b/readme.txt @@ -166,6 +166,11 @@ No specific extensions are needed. But we highly recommended keep active these P IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSION 2.6.7 PATCHES SECURITY PRIVILEGE ESCALATION VULNERABILITY. PLEASE SEE [THIS ARTICLE](https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions) FOR MORE INFORMATION += 2.8.1: December xx, 2023 = + + + + = 2.8.0: December 11, 2023 = * Enhancements: diff --git a/ultimate-member.php b/ultimate-member.php index bf70d9f8..a35bdf75 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ * Plugin Name: Ultimate Member * Plugin URI: http://ultimatemember.com/ * Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress - * Version: 2.8.0 + * Version: 2.8.1-alpha * Author: Ultimate Member * Author URI: http://ultimatemember.com/ * Text Domain: ultimate-member From 382ae24c73d4fba5d2cfc85883df8168cf5d8620 Mon Sep 17 00:00:00 2001 From: yuriinalivaiko Date: Fri, 8 Dec 2023 14:48:27 +0200 Subject: [PATCH 02/11] - implemented safeguards against clickjacking attacks --- includes/core/class-access.php | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/includes/core/class-access.php b/includes/core/class-access.php index 765fc357..60463bf9 100644 --- a/includes/core/class-access.php +++ b/includes/core/class-access.php @@ -76,6 +76,7 @@ if ( ! class_exists( 'um\core\Access' ) ) { // check the site's accessible more priority have Individual Post/Term Restriction settings add_action( 'template_redirect', array( &$this, 'template_redirect' ), 1000 ); + add_action( 'template_redirect', array( &$this, 'send_frame_options_header' ), 1010 ); add_action( 'um_access_check_blog_page_settings', array( &$this, 'um_access_check_blog_page_settings' ) ); add_action( 'um_access_check_individual_term_settings', array( &$this, 'um_access_check_individual_term_settings' ) ); add_action( 'um_access_check_global_settings', array( &$this, 'um_access_check_global_settings' ) ); @@ -1795,6 +1796,23 @@ if ( ! class_exists( 'um\core\Access' ) ) { } + /** + * Sends a HTTP header to limit rendering of pages to same origin iframes when loading sensitive pages. + * + * Can be disabled with: remove_action( 'template_redirect', array( UM()->access(), 'send_frame_options_header' ), 1010 ); + * + * @since 2.8.0 + */ + public function send_frame_options_header() { + if ( um_is_core_page( 'account' ) + || um_is_core_page( 'login' ) + || um_is_core_page( 'password-reset' ) + || um_is_core_page( 'register' ) ) { + send_frame_options_header(); + } + } + + /** * Sets a custom access referer in a redirect URL * From 8171302d027e08de16ef530a70a26ddbfb3fb307 Mon Sep 17 00:00:00 2001 From: yuriinalivaiko Date: Mon, 11 Dec 2023 19:36:19 +0200 Subject: [PATCH 03/11] - fixed the visibility of sub-items of hidden menu items. --- includes/core/um-filters-navmenu.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/includes/core/um-filters-navmenu.php b/includes/core/um-filters-navmenu.php index 1f202fc6..9f0572c1 100644 --- a/includes/core/um-filters-navmenu.php +++ b/includes/core/um-filters-navmenu.php @@ -72,9 +72,9 @@ if ( ! is_admin() ) { $visible = true; // Hide any item that is the child of a hidden item. - if ( isset( $item->menu_item_parent ) && in_array( $item->menu_item_parent, $hide_children_of, true ) ) { + if ( isset( $item->menu_item_parent ) && in_array( absint( $item->menu_item_parent ), $hide_children_of, true ) ) { $visible = false; - $hide_children_of[] = $item->ID; // for nested menus + $hide_children_of[] = absint( $item->ID ); // for nested menus } if ( isset( $mode ) && $visible ) { @@ -118,7 +118,7 @@ if ( ! is_admin() ) { // unset non-visible item if ( ! $visible ) { - $hide_children_of[] = $item->ID; // store ID of item + $hide_children_of[] = absint( $item->ID ); // store ID of item } else { $filtered_items[] = $item; } From 0c9d733962f081dd394666f2cbc41980cad07aa6 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Tue, 12 Dec 2023 13:42:50 +0200 Subject: [PATCH 04/11] - probably fix Cropper.JS if UM.frontend.cropper.obj undefined (Cropper hasn't been properly inited for UM objects); --- assets/js/um-modal.js | 2 +- assets/js/um-modal.min.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/assets/js/um-modal.js b/assets/js/um-modal.js index dc46251e..bbb06e4c 100644 --- a/assets/js/um-modal.js +++ b/assets/js/um-modal.js @@ -112,7 +112,7 @@ jQuery(document).ready(function() { mode = $formWrapper.attr('data-mode'); } - if ( jQuery('.cropper-hidden').length > 0 ) { + if ( jQuery('.cropper-hidden').length > 0 && UM.frontend.cropper.obj ) { var data = UM.frontend.cropper.obj.getData(); var coord = Math.round(data.x) + ',' + Math.round(data.y) + ',' + Math.round(data.width) + ',' + Math.round(data.height); diff --git a/assets/js/um-modal.min.js b/assets/js/um-modal.min.js index 38ea26ad..7464fe88 100644 --- a/assets/js/um-modal.min.js +++ b/assets/js/um-modal.min.js @@ -1 +1 @@ -jQuery(document).ready(function(){jQuery(document).on("click",".um-popup-overlay",function(){remove_Modal()}),jQuery(document).on("click",'.um-modal-overlay, a[data-action="um_remove_modal"]',function(){um_remove_modal()}),jQuery(document).on("click",'a[data-modal^="um_"], span[data-modal^="um_"], .um-modal:not(:has(.um-form)) a',function(e){return e.preventDefault(),!1}),jQuery(document).on("click",".um-finish-upload.file:not(.disabled)",function(){var e=jQuery(this).attr("data-key"),a=jQuery(this).parents(".um-modal-body").find(".um-single-file-preview").html(),a=(um_remove_modal(),jQuery(".um-single-file-preview[data-key="+e+"]").fadeIn().html(a),jQuery(".um-field[data-key="+e+"]").find(".um-single-fileinfo a").data("file"));jQuery(".um-single-file-preview[data-key="+e+"]").parents(".um-field").find(".um-btn-auto-width").html(jQuery(this).attr("data-change")),jQuery(".um-single-file-preview[data-key="+e+"]").parents(".um-field").find('input[type="hidden"]').val(a)}),jQuery(document).on("click",".um-finish-upload.image:not(.disabled)",function(){var a,e,t=jQuery(this),i=jQuery(this).attr("data-key"),r=jQuery(this).parents(".um-modal-body").find(".um-single-image-preview"),u=r.find("img").attr("src"),r=r.find("img").data("file"),d=0,m=(jQuery(this).parents("#um_upload_single").data("user_id")&&(d=jQuery(this).parents("#um_upload_single").data("user_id")),0),n="";1===jQuery('div.um-field-image[data-key="'+i+'"]').length&&(m=(e=jQuery('div.um-field-image[data-key="'+i+'"]').closest(".um-form")).find('input[name="form_id"]').val(),n=e.attr("data-mode")),0'),jQuery(".um").hasClass("um-editing"))&&jQuery(".um-cover-overlay").show(),jQuery(".um-single-image-preview[data-key="+i+"]").fadeIn().find("img").attr("src",e.data.image.source_url+"?"+a.getTime()),um_remove_modal(),jQuery("img.cropper-invisible").remove(),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find(".um-btn-auto-width").html(t.attr("data-change")),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find('input[type="hidden"]').val(e.data.image.filename))}})):(a=new Date,jQuery(".um-single-image-preview[data-key="+i+"]").fadeIn().find("img").attr("src",u+"?"+a.getTime()),um_remove_modal(),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find(".um-btn-auto-width").html(t.attr("data-change")),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find("input[type=hidden]").val(r))}),jQuery(document.body).on("click",'a[data-modal^="um_"], span[data-modal^="um_"]',function(e){var a=jQuery(this).attr("data-modal"),t="normal";jQuery(this).data("modal-size")&&(t=jQuery(this).data("modal-size")),jQuery(this).data("modal-copy")&&(jQuery("#"+a).html(jQuery(this).parents(".um-field").find(".um-modal-hidden-content").html()),jQuery(this).parents(".um-profile-photo").attr("data-user_id")&&jQuery("#"+a).attr("data-user_id",jQuery(this).parents(".um-profile-photo").attr("data-user_id")),jQuery(this).parents(".um-cover").attr("data-ratio")&&jQuery("#"+a).attr("data-ratio",jQuery(this).parents(".um-cover").attr("data-ratio")),jQuery(this).parents(".um-cover").attr("data-user_id")&&jQuery("#"+a).attr("data-user_id",jQuery(this).parents(".um-cover").attr("data-user_id")),0'),jQuery(".um").hasClass("um-editing"))&&jQuery(".um-cover-overlay").show(),jQuery(".um-single-image-preview[data-key="+i+"]").fadeIn().find("img").attr("src",e.data.image.source_url+"?"+a.getTime()),um_remove_modal(),jQuery("img.cropper-invisible").remove(),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find(".um-btn-auto-width").html(t.attr("data-change")),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find('input[type="hidden"]').val(e.data.image.filename))}})):(a=new Date,jQuery(".um-single-image-preview[data-key="+i+"]").fadeIn().find("img").attr("src",u+"?"+a.getTime()),um_remove_modal(),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find(".um-btn-auto-width").html(t.attr("data-change")),jQuery(".um-single-image-preview[data-key="+i+"]").parents(".um-field").find("input[type=hidden]").val(r))}),jQuery(document.body).on("click",'a[data-modal^="um_"], span[data-modal^="um_"]',function(e){var a=jQuery(this).attr("data-modal"),t="normal";jQuery(this).data("modal-size")&&(t=jQuery(this).data("modal-size")),jQuery(this).data("modal-copy")&&(jQuery("#"+a).html(jQuery(this).parents(".um-field").find(".um-modal-hidden-content").html()),jQuery(this).parents(".um-profile-photo").attr("data-user_id")&&jQuery("#"+a).attr("data-user_id",jQuery(this).parents(".um-profile-photo").attr("data-user_id")),jQuery(this).parents(".um-cover").attr("data-ratio")&&jQuery("#"+a).attr("data-ratio",jQuery(this).parents(".um-cover").attr("data-ratio")),jQuery(this).parents(".um-cover").attr("data-user_id")&&jQuery("#"+a).attr("data-user_id",jQuery(this).parents(".um-cover").attr("data-user_id")),0 Date: Wed, 13 Dec 2023 18:06:51 +0200 Subject: [PATCH 05/11] - changed displaying notice to avoid using wrong symbols; --- includes/admin/core/class-admin-notices.php | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/includes/admin/core/class-admin-notices.php b/includes/admin/core/class-admin-notices.php index f5d235b6..dde627d1 100644 --- a/includes/admin/core/class-admin-notices.php +++ b/includes/admin/core/class-admin-notices.php @@ -640,17 +640,19 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) { $url = add_query_arg( array( 'page' => 'um_upgrade' ), admin_url( 'admin.php' ) ); - ob_start(); ?> + ob_start(); + ?>

- %1$s version %2$s needs to be updated to work correctly.
It is necessary to update the structure of the database and options that are associated with %3$s %4$s.
Please visit "Upgrade" page and run the upgrade process.', 'ultimate-member' ), UM_PLUGIN_NAME, UM_VERSION, UM_PLUGIN_NAME, UM_VERSION, $url ), UM()->get_allowed_html( 'admin_notice' ) ); - ?> + +
+ +
+

- +  

From 6a825f70eb7026508a6dfbb2d8a958a8f4a9a3cd Mon Sep 17 00:00:00 2001 From: Champ Camba Date: Sat, 16 Dec 2023 00:05:38 +0800 Subject: [PATCH 06/11] Fix error notice when creating page via extensions --- includes/core/class-setup.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/core/class-setup.php b/includes/core/class-setup.php index a1eec114..253e4287 100644 --- a/includes/core/class-setup.php +++ b/includes/core/class-setup.php @@ -206,7 +206,7 @@ KEY meta_value_indx (um_value(191)) $content = '[ultimatemember_password]'; } elseif ( 'user' === $slug ) { $content = '[ultimatemember form_id="' . $setup_shortcodes['profile'] . '"]'; - } else { + } elseif ( ! empty( $setup_shortcodes[ $slug ] ) ) { $content = '[ultimatemember form_id="' . $setup_shortcodes[ $slug ] . '"]'; } From a551123a6d95090c2894518f47c24f1d163c73cf Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Tue, 19 Dec 2023 11:47:41 +0200 Subject: [PATCH 07/11] - WPCS for class-setup.php; --- includes/core/class-setup.php | 114 ++++++++++++++-------------------- 1 file changed, 46 insertions(+), 68 deletions(-) diff --git a/includes/core/class-setup.php b/includes/core/class-setup.php index 253e4287..209c8ae4 100644 --- a/includes/core/class-setup.php +++ b/includes/core/class-setup.php @@ -1,13 +1,14 @@ create_db(); $this->install_basics(); $this->install_default_forms(); @@ -35,11 +28,10 @@ if ( ! class_exists( 'um\core\Setup' ) ) { $this->set_default_user_status(); } - /** - * Create custom DB tables + * Create custom DB tables. */ - function create_db() { + public function create_db() { global $wpdb; $charset_collate = $wpdb->get_charset_collate(); @@ -55,25 +47,23 @@ KEY meta_key_indx (um_key), KEY meta_value_indx (um_value(191)) ) $charset_collate;"; - require_once( ABSPATH . 'wp-admin/includes/upgrade.php' ); + require_once ABSPATH . 'wp-admin/includes/upgrade.php'; dbDelta( $sql ); } - /** - * Basics + * Basics. */ - function install_basics() { + public function install_basics() { if ( ! get_option( '__ultimatemember_sitekey' ) ) { - update_option( '__ultimatemember_sitekey', str_replace( array( 'http://', 'https://' ), '', sanitize_user( get_bloginfo('url') ) ) . '-' . wp_generate_password( 20, false ) ); + update_option( '__ultimatemember_sitekey', str_replace( array( 'http://', 'https://' ), '', sanitize_user( get_bloginfo( 'url' ) ) ) . '-' . wp_generate_password( 20, false ) ); } } - /** - * Default Forms + * Default Forms. */ - function install_default_forms() { + public function install_default_forms() { if ( current_user_can( 'manage_options' ) && ! get_option( 'um_is_installed' ) ) { $options = get_option( 'um_options', array() ); @@ -81,39 +71,35 @@ KEY meta_value_indx (um_value(191)) //Install default options foreach ( UM()->config()->settings_defaults as $key => $value ) { - $options[$key] = $value; + $options[ $key ] = $value; } - // Install Core Forms + // Install Core Forms. foreach ( UM()->config()->core_forms as $id ) { - - /** - If page does not exist - Create it - **/ + // If page does not exist - create it. $page_exists = UM()->query()->find_post_id( 'um_form', '_um_core', $id ); if ( ! $page_exists ) { - if ( $id == 'register' ) { + if ( 'register' === $id ) { $title = 'Default Registration'; - } else if ( $id == 'login' ) { + } elseif ( 'login' === $id ) { $title = 'Default Login'; } else { $title = 'Default Profile'; } $form = array( - 'post_type' => 'um_form', - 'post_title' => $title, - 'post_status' => 'publish', - 'post_author' => get_current_user_id(), + 'post_type' => 'um_form', + 'post_title' => $title, + 'post_status' => 'publish', + 'post_author' => get_current_user_id(), ); $form_id = wp_insert_post( $form ); - foreach( UM()->config()->core_form_meta[$id] as $key => $value ) { - if ( $key == '_um_custom_fields' ) { - $array = unserialize( $value ); + foreach ( UM()->config()->core_form_meta[ $id ] as $key => $value ) { + if ( '_um_custom_fields' === $key ) { + $array = maybe_unserialize( $value ); update_post_meta( $form_id, $key, $array ); } else { update_post_meta( $form_id, $key, $value ); @@ -129,40 +115,35 @@ KEY meta_value_indx (um_value(191)) update_option( 'um_core_forms', $core_forms ); } - // Install Core Directories + // Install Core Directories. foreach ( UM()->config()->core_directories as $id ) { - - /** - If page does not exist - Create it - **/ + // If page does not exist - create it. $page_exists = UM()->query()->find_post_id( 'um_directory', '_um_core', $id ); if ( ! $page_exists ) { $title = 'Members'; $form = array( - 'post_type' => 'um_directory', - 'post_title' => $title, - 'post_status' => 'publish', - 'post_author' => get_current_user_id(), + 'post_type' => 'um_directory', + 'post_title' => $title, + 'post_status' => 'publish', + 'post_author' => get_current_user_id(), ); $form_id = wp_insert_post( $form ); foreach ( UM()->config()->core_directory_meta[ $id ] as $key => $value ) { - if ( $key == '_um_custom_fields' ) { - $array = unserialize( $value ); + if ( '_um_custom_fields' === $key ) { + $array = maybe_unserialize( $value ); update_post_meta( $form_id, $key, $array ); } else { - update_post_meta($form_id, $key, $value); + update_post_meta( $form_id, $key, $value ); } } $core_directories[ $id ] = $form_id; } /** DONE **/ - } if ( isset( $core_directories ) ) { @@ -173,9 +154,8 @@ KEY meta_value_indx (um_value(191)) } } - /** - * Install Pre-defined pages with shortcodes + * Install Pre-defined pages with shortcodes. */ public function install_default_pages() { if ( ! current_user_can( 'manage_options' ) ) { @@ -187,7 +167,7 @@ KEY meta_value_indx (um_value(191)) $setup_shortcodes = array_merge( $core_forms, $core_directories ); - //Install Core Pages + // Install Core Pages. $core_pages = array(); foreach ( UM()->config()->core_pages as $slug => $array ) { @@ -197,7 +177,8 @@ KEY meta_value_indx (um_value(191)) continue; } - //If page does not exist - create it + // If page does not exist - create it. + $content = ''; if ( 'logout' === $slug ) { $content = ''; } elseif ( 'account' === $slug ) { @@ -262,11 +243,10 @@ KEY meta_value_indx (um_value(191)) UM()->rewrite()->reset_rules(); } - /** - * Set default UM settings + * Set default UM settings. */ - function set_default_settings() { + public function set_default_settings() { $options = get_option( 'um_options', array() ); foreach ( UM()->config()->settings_defaults as $key => $value ) { @@ -279,23 +259,21 @@ KEY meta_value_indx (um_value(191)) update_option( 'um_options', $options ); } - /** - * Set UM roles meta to Default WP roles + * Set UM roles meta to Default WP roles. */ - function set_default_role_meta() { + public function set_default_role_meta() { foreach ( UM()->config()->default_roles_metadata as $role => $meta ) { add_option( "um_role_{$role}_meta", $meta ); } } - /** - * Set accounts without account_status meta to 'approved' status + * Set accounts without account_status meta to 'approved' status. * * @since 2.4.2 */ - function set_default_user_status() { + public function set_default_user_status() { $result = get_transient( 'um_count_users_unassigned' ); if ( false === $result ) { $args = array( @@ -310,7 +288,7 @@ KEY meta_value_indx (um_value(191)) 'um_custom_user_query' => true, ); - $users = new \WP_User_Query( $args ); + $users = new WP_User_Query( $args ); if ( empty( $users ) || is_wp_error( $users ) ) { $result = array(); } else { From a2cf941a05e078b668f6e43f85379174f3f34fd5 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Tue, 19 Dec 2023 12:19:28 +0200 Subject: [PATCH 08/11] - Fixed button margin in UM > Settings. --- assets/css/admin/settings.css | 6 +++ assets/css/admin/settings.min.css | 2 +- assets/css/admin/settings.sass | 12 +++++ includes/admin/core/class-admin-forms.php | 17 +++++-- includes/admin/core/class-admin-settings.php | 49 +++++++++++++------- 5 files changed, 62 insertions(+), 24 deletions(-) diff --git a/assets/css/admin/settings.css b/assets/css/admin/settings.css index 0b5d7676..567c6ff5 100644 --- a/assets/css/admin/settings.css +++ b/assets/css/admin/settings.css @@ -191,3 +191,9 @@ th.column-email.column-primary { .um_setting_ajax_button_response.complete { color: #7acf58; font-style: italic; } + +.wp-core-ui .button.um_license_activate, .wp-core-ui .button.um_license_deactivate, .wp-core-ui .button.um_license_reactivate { + margin-top: 5px; } + +.um-media-upload .um-media-upload-url { + margin-bottom: 5px; } diff --git a/assets/css/admin/settings.min.css b/assets/css/admin/settings.min.css index b98a6977..a086dd80 100644 --- a/assets/css/admin/settings.min.css +++ b/assets/css/admin/settings.min.css @@ -1 +1 @@ -#um-settings-wrap .subsubsub{display:flex;flex-direction:row;justify-content:flex-start;align-items:center;flex-wrap:wrap;margin-left:-3px;margin-right:-3px}#um-settings-wrap .subsubsub a{margin:0 3px}.um-settings-section .description{font-style:italic}.um-notification-status{margin-right:18px;font-size:28px;line-height:22px;color:#c74a4a;float:left;box-sizing:border-box;-moz-box-sizing:border-box;-webkit-box-sizing:border-box}.um-notification-status.um-notification-is-active{color:#7acf58}.um-email-configure span{line-height:24px}.um-long-field{width:100%}.um-medium-field{width:50%}.um-small-field{width:25%}.column-configure{width:60px;text-align:center}th.column-email.column-primary{padding-left:48px}.um-form-table .um-forms-line td{padding-right:0}#um-settings-template-versions .wp-list-table .column-core_version{width:100px;text-align:center}#um-settings-template-versions .wp-list-table .column-theme_version{width:100px;text-align:center}#um-settings-template-versions .wp-list-table .column-status{width:260px}#um-settings-form{float:left;width:100%;margin:0}#um-settings-form .subsubsub{float:left;width:100%}.um-settings-line .multi-checkbox-line{float:left;width:100%;clear:both;margin:0 0 10px 0;padding:0}.um-settings-line .multi-checkbox-column{float:left;margin:0;padding:0}.um-settings-line .multi-checkbox-column label{float:left;width:100%}.wrap-licenses .form-table,.wrap-licenses caption,.wrap-licenses tbody,.wrap-licenses td,.wrap-licenses tfoot,.wrap-licenses th,.wrap-licenses thead,.wrap-licenses tr{display:block}.wrap-licenses .form-table tr{float:left;margin:0 15px 15px 0;background:#fff;border:1px solid #ccc;width:30.5%;max-width:350px;padding:14px;min-height:240px;position:relative;box-sizing:border-box}.wrap-licenses .form-table th{background:#f9f9f9;padding:14px;border-bottom:1px solid #ccc;margin:-14px -14px 20px;width:100%}.wrap-licenses .form-table td{padding:0}.wrap-licenses td input.regular-text{margin:0 0 8px;width:100%}.wrap-licenses .edd-license-data[class*=edd-license-]{position:absolute;background:#fafafa;padding:14px;border-top:1px solid #eee;margin:20px -14px -14px;min-height:67px;width:100%;bottom:14px;box-sizing:border-box}.wrap-licenses .edd-license-data[class*=edd-license-] a{color:#444}.wrap-licenses .edd-license-data[class*=edd-license-] a:hover{text-decoration:none}.wrap-licenses .edd-license-data.license-expires-soon-notice{background-color:#00a0d2;color:#fff;border-color:#00a0d2}.wrap-licenses .edd-license-data.license-expires-soon-notice a{color:#fff}.wrap-licenses .edd-license-data.license-expires-soon-notice a:hover{text-decoration:none}.wrap-licenses .edd-license-data.edd-license-expired{background-color:#e24e4e;color:#fff;border-color:#e24e4e}.wrap-licenses .edd-license-data.edd-license-expired a{color:#fff}.wrap-licenses .edd-license-data.edd-license-expired a:hover{text-decoration:none}.wrap-licenses .edd-license-data.edd-license-valid{background-color:#5abc55;color:#fff;border-color:#5abc55}.wrap-licenses .edd-license-data.edd-license-error,.wrap-licenses .edd-license-data.edd-license-invalid,.wrap-licenses .edd-license-data.edd-license-item_name_mismatch,.wrap-licenses .edd-license-data.edd-license-missing,.wrap-licenses .edd-license-data.edd-license-site_inactive{background-color:#ffebcd;border-color:#ffebcd}.wrap-licenses .edd-license-data p{font-size:13px;margin-top:0}.wrap-licenses~p.submit{clear:both}@media screen and (max-width:980px){.wrap-licenses .form-table tr{width:calc(50% - 15px);max-width:none}}@media screen and (max-width:782px){#um-settings-template-versions .wp-list-table .column-core_version,#um-settings-template-versions .wp-list-table .column-theme_version{width:auto;text-align:left}.wrap-licenses .form-table tr{width:100%;margin-right:0;max-width:none}.um-settings-line .multi-checkbox-column{width:100%!important}.um-settings-line .multi-checkbox-column label{line-height:30px!important}.um-medium-field{width:100%}.um-small-field{width:50%}}.um_setting_ajax_button_response.complete{color:#7acf58;font-style:italic} \ No newline at end of file +#um-settings-wrap .subsubsub{display:flex;flex-direction:row;justify-content:flex-start;align-items:center;flex-wrap:wrap;margin-left:-3px;margin-right:-3px}#um-settings-wrap .subsubsub a{margin:0 3px}.um-settings-section .description{font-style:italic}.um-notification-status{margin-right:18px;font-size:28px;line-height:22px;color:#c74a4a;float:left;box-sizing:border-box;-moz-box-sizing:border-box;-webkit-box-sizing:border-box}.um-notification-status.um-notification-is-active{color:#7acf58}.um-email-configure span{line-height:24px}.um-long-field{width:100%}.um-medium-field{width:50%}.um-small-field{width:25%}.column-configure{width:60px;text-align:center}th.column-email.column-primary{padding-left:48px}.um-form-table .um-forms-line td{padding-right:0}#um-settings-template-versions .wp-list-table .column-core_version{width:100px;text-align:center}#um-settings-template-versions .wp-list-table .column-theme_version{width:100px;text-align:center}#um-settings-template-versions .wp-list-table .column-status{width:260px}#um-settings-form{float:left;width:100%;margin:0}#um-settings-form .subsubsub{float:left;width:100%}.um-settings-line .multi-checkbox-line{float:left;width:100%;clear:both;margin:0 0 10px 0;padding:0}.um-settings-line .multi-checkbox-column{float:left;margin:0;padding:0}.um-settings-line .multi-checkbox-column label{float:left;width:100%}.wrap-licenses .form-table,.wrap-licenses caption,.wrap-licenses tbody,.wrap-licenses td,.wrap-licenses tfoot,.wrap-licenses th,.wrap-licenses thead,.wrap-licenses tr{display:block}.wrap-licenses .form-table tr{float:left;margin:0 15px 15px 0;background:#fff;border:1px solid #ccc;width:30.5%;max-width:350px;padding:14px;min-height:240px;position:relative;box-sizing:border-box}.wrap-licenses .form-table th{background:#f9f9f9;padding:14px;border-bottom:1px solid #ccc;margin:-14px -14px 20px;width:100%}.wrap-licenses .form-table td{padding:0}.wrap-licenses td input.regular-text{margin:0 0 8px;width:100%}.wrap-licenses .edd-license-data[class*=edd-license-]{position:absolute;background:#fafafa;padding:14px;border-top:1px solid #eee;margin:20px -14px -14px;min-height:67px;width:100%;bottom:14px;box-sizing:border-box}.wrap-licenses .edd-license-data[class*=edd-license-] a{color:#444}.wrap-licenses .edd-license-data[class*=edd-license-] a:hover{text-decoration:none}.wrap-licenses .edd-license-data.license-expires-soon-notice{background-color:#00a0d2;color:#fff;border-color:#00a0d2}.wrap-licenses .edd-license-data.license-expires-soon-notice a{color:#fff}.wrap-licenses .edd-license-data.license-expires-soon-notice a:hover{text-decoration:none}.wrap-licenses .edd-license-data.edd-license-expired{background-color:#e24e4e;color:#fff;border-color:#e24e4e}.wrap-licenses .edd-license-data.edd-license-expired a{color:#fff}.wrap-licenses .edd-license-data.edd-license-expired a:hover{text-decoration:none}.wrap-licenses .edd-license-data.edd-license-valid{background-color:#5abc55;color:#fff;border-color:#5abc55}.wrap-licenses .edd-license-data.edd-license-error,.wrap-licenses .edd-license-data.edd-license-invalid,.wrap-licenses .edd-license-data.edd-license-item_name_mismatch,.wrap-licenses .edd-license-data.edd-license-missing,.wrap-licenses .edd-license-data.edd-license-site_inactive{background-color:#ffebcd;border-color:#ffebcd}.wrap-licenses .edd-license-data p{font-size:13px;margin-top:0}.wrap-licenses~p.submit{clear:both}@media screen and (max-width:980px){.wrap-licenses .form-table tr{width:calc(50% - 15px);max-width:none}}@media screen and (max-width:782px){#um-settings-template-versions .wp-list-table .column-core_version,#um-settings-template-versions .wp-list-table .column-theme_version{width:auto;text-align:left}.wrap-licenses .form-table tr{width:100%;margin-right:0;max-width:none}.um-settings-line .multi-checkbox-column{width:100%!important}.um-settings-line .multi-checkbox-column label{line-height:30px!important}.um-medium-field{width:100%}.um-small-field{width:50%}}.um_setting_ajax_button_response.complete{color:#7acf58;font-style:italic}.wp-core-ui .button.um_license_activate,.wp-core-ui .button.um_license_deactivate,.wp-core-ui .button.um_license_reactivate{margin-top:5px}.um-media-upload .um-media-upload-url{margin-bottom:5px} \ No newline at end of file diff --git a/assets/css/admin/settings.sass b/assets/css/admin/settings.sass index 963e0ac5..e6eec3c2 100644 --- a/assets/css/admin/settings.sass +++ b/assets/css/admin/settings.sass @@ -210,3 +210,15 @@ th.column-email.column-primary .um_setting_ajax_button_response.complete color: #{$admin-ok} font-style: italic + +.wp-core-ui + .button + &.um_license_activate, + &.um_license_deactivate, + &.um_license_reactivate + margin-top: 5px + +.#{$prefix}media-upload + .#{$prefix}media-upload-url + margin-bottom: 5px + diff --git a/includes/admin/core/class-admin-forms.php b/includes/admin/core/class-admin-forms.php index 932c6860..f2194200 100644 --- a/includes/admin/core/class-admin-forms.php +++ b/includes/admin/core/class-admin-forms.php @@ -1368,13 +1368,20 @@ if ( ! class_exists( 'um\admin\core\Admin_Forms' ) ) { $upload_frame_title = ! empty( $field_data['upload_frame_title'] ) ? $field_data['upload_frame_title'] : __( 'Select media', 'ultimate-member' ); - $image_id = ! empty( $value['id'] ) ? $value['id'] : ''; - $image_width = ! empty( $value['width'] ) ? $value['width'] : ''; - $image_height = ! empty( $value['height'] ) ? $value['height'] : ''; + $image_id = ! empty( $value['id'] ) ? $value['id'] : ''; + $image_width = ! empty( $value['width'] ) ? $value['width'] : ''; + $image_height = ! empty( $value['height'] ) ? $value['height'] : ''; $image_thumbnail = ! empty( $value['thumbnail'] ) ? $value['thumbnail'] : ''; - $image_url = ! empty( $value['url'] ) ? $value['url'] : ''; + $image_url = ! empty( $value['url'] ) ? $value['url'] : ''; - $html = "
" . + $wrapper_classes = array(); + if ( ! isset( $field_data['preview'] ) || false !== $field_data['preview'] ) { + $wrapper_classes[] = 'um-media-preview-enabled'; + } + $wrapper_classes = implode( ' ', $wrapper_classes ); + $wrapper_classes = ! empty( $wrapper_classes ) ? ' ' . $wrapper_classes : ''; + + $html = '
' . "" . "" . "" . diff --git a/includes/admin/core/class-admin-settings.php b/includes/admin/core/class-admin-settings.php index 7ecd749a..d7e1310e 100644 --- a/includes/admin/core/class-admin-settings.php +++ b/includes/admin/core/class-admin-settings.php @@ -2754,7 +2754,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) { - options()->get( $field_data['id'] ); $value = isset( $option_value ) && ! empty( $option_value ) ? $option_value : ( isset( $field_data['default'] ) ? $field_data['default'] : '' ); @@ -2985,27 +2986,39 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) { - - -
- + + +
+ license ) || 'valid' === $license ) ) { ?> - - - - - - - license ) || 'valid' === $license ) ) { + ?> + + + + + + + -
-

+ foreach ( $messages as $message ) { + ?> +
+

get_allowed_html( 'admin_notice' ) ); ?>

- + From 510f9e46ed96a123fb4dd891c76c774f485949d8 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Tue, 19 Dec 2023 13:48:50 +0200 Subject: [PATCH 09/11] - updated Twitter texts to X; --- includes/admin/class-site-health.php | 2 +- includes/admin/templates/extensions.php | 2 +- includes/core/class-builtin.php | 32 ++++++++++++------------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/includes/admin/class-site-health.php b/includes/admin/class-site-health.php index d0a300c1..58d9dd9f 100644 --- a/includes/admin/class-site-health.php +++ b/includes/admin/class-site-health.php @@ -1796,7 +1796,7 @@ class Site_Health { 'role_radio' => __( 'Roles (Radio)', 'ultimate-member' ), 'whatsapp' => __( 'WhatsApp number', 'ultimate-member' ), 'facebook' => __( 'Facebook', 'ultimate-member' ), - 'twitter' => __( 'Twitter', 'ultimate-member' ), + 'twitter' => __( 'X (formerly Twitter)', 'ultimate-member' ), 'viber' => __( 'Viber number', 'ultimate-member' ), 'skype' => __( 'Skype ID', 'ultimate-member' ), 'telegram' => __( 'Telegram', 'ultimate-member' ), diff --git a/includes/admin/templates/extensions.php b/includes/admin/templates/extensions.php index 09ad82ce..7da231e4 100644 --- a/includes/admin/templates/extensions.php +++ b/includes/admin/templates/extensions.php @@ -77,7 +77,7 @@ $premium['social-login'] = array( 'url' => 'https://ultimatemember.com/extensions/social-login/', 'img' => 'social-login.svg', 'name' => 'Social Login', - 'desc' => 'Let users register & login to your site via Facebook, Twitter, G+, LinkedIn, and more', + 'desc' => 'Let users register & login to your site via Facebook, X (formerly Twitter), G+, LinkedIn, and more', ); $premium['user-tags'] = array( diff --git a/includes/core/class-builtin.php b/includes/core/class-builtin.php index e3f841b1..32158e0c 100644 --- a/includes/core/class-builtin.php +++ b/includes/core/class-builtin.php @@ -961,22 +961,22 @@ if ( ! class_exists( 'um\core\Builtin' ) ) { 'match' => 'https://facebook.com/', ), - 'twitter' => array( - 'title' => __('Twitter','ultimate-member'), - 'metakey' => 'twitter', - 'type' => 'url', - 'label' => __('Twitter','ultimate-member'), - 'required' => 0, - 'public' => 1, - 'editable' => true, + 'twitter' => array( + 'title' => __( 'X (formerly Twitter)', 'ultimate-member' ), + 'metakey' => 'twitter', + 'type' => 'url', + 'label' => __( 'X', 'ultimate-member' ), + 'required' => 0, + 'public' => 1, + 'editable' => true, 'url_target' => '_blank', - 'url_rel' => 'nofollow', - 'icon' => 'um-faicon-twitter', - 'validate' => 'twitter_url', - 'url_text' => 'Twitter', - 'advanced' => 'social', - 'color' => '#4099FF', - 'match' => 'https://twitter.com/', + 'url_rel' => 'nofollow', + 'icon' => 'um-faicon-twitter', // 'fa-brands fa-x-twitter' for new FA styles + 'validate' => 'twitter_url', + 'url_text' => 'X', + 'advanced' => 'social', + 'color' => '#4099FF', // #0f1419 for X symbol + 'match' => 'https://twitter.com/', ), 'linkedin' => array( @@ -1557,7 +1557,7 @@ if ( ! class_exists( 'um\core\Builtin' ) ) { $array['phone_number'] = __('Phone Number','ultimate-member'); $array['skype'] = __('Skype ID','ultimate-member'); $array['soundcloud'] = __( 'SoundCloud Profile', 'ultimate-member' ); - $array['twitter_url'] = __('Twitter URL','ultimate-member'); + $array['twitter_url'] = __( 'X (formerly Twitter) URL', 'ultimate-member' ); $array['is_email'] = __('E-mail( Not Unique )','ultimate-member'); $array['unique_email'] = __('Unique E-mail','ultimate-member'); $array['unique_value'] = __('Unique Metakey value','ultimate-member'); From afbde4cc8cf9b133940025f3344c51befcdebca1 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Wed, 20 Dec 2023 19:43:15 +0200 Subject: [PATCH 10/11] - updated version; --- README.md | 2 +- readme.txt | 7 +++---- ultimate-member.php | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 9e23b98c..b186db35 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ GNU Version 2 or Any Later Version ### IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSION 2.6.7 PATCHES SECURITY PRIVILEGE ESCALATION VULNERABILITY. PLEASE SEE [THIS ARTICLE](https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions) FOR MORE INFORMATION -[Official Release Version: 2.8.0](https://github.com/ultimatemember/ultimatemember/releases/tag/2.8.0). +[Official Release Version: 2.8.1](https://github.com/ultimatemember/ultimatemember/releases/tag/2.8.1). ## Changelog diff --git a/readme.txt b/readme.txt index bbeae4ec..763d14de 100644 --- a/readme.txt +++ b/readme.txt @@ -7,7 +7,7 @@ Tags: community, member, membership, user-profile, user-registration Requires PHP: 5.6 Requires at least: 5.5 Tested up to: 6.4 -Stable tag: 2.8.0 +Stable tag: 2.8.1 License: GNU Version 2 or Any Later Version License URI: http://www.gnu.org/licenses/gpl-3.0.txt @@ -166,10 +166,9 @@ No specific extensions are needed. But we highly recommended keep active these P IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSION 2.6.7 PATCHES SECURITY PRIVILEGE ESCALATION VULNERABILITY. PLEASE SEE [THIS ARTICLE](https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions) FOR MORE INFORMATION -= 2.8.1: December xx, 2023 = - - += 2.8.1: December 20, 2023 = +* Bugfixes: = 2.8.0: December 11, 2023 = diff --git a/ultimate-member.php b/ultimate-member.php index a35bdf75..713f4818 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ * Plugin Name: Ultimate Member * Plugin URI: http://ultimatemember.com/ * Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress - * Version: 2.8.1-alpha + * Version: 2.8.1 * Author: Ultimate Member * Author URI: http://ultimatemember.com/ * Text Domain: ultimate-member From 6f7c53e103de5b65d06030ce6eb6c6635b31eefd Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Wed, 20 Dec 2023 22:38:19 +0200 Subject: [PATCH 11/11] - updated readme.txt; --- readme.txt | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/readme.txt b/readme.txt index 763d14de..739c7210 100644 --- a/readme.txt +++ b/readme.txt @@ -168,8 +168,19 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI = 2.8.1: December 20, 2023 = +* Enhancements: + + - Updated: Twitter texts to X + - Added: Safeguards against clickjacking attacks on UM Forms + * Bugfixes: + - Fixed: Displaying notice to avoid using wrong symbols + - Fixed: UM > Settings button styles + - Fixed: Error notice when creating page via extensions + - Fixed: Workaround for Cropper.JS if UM.frontend.cropper.obj undefined (Cropper hasn't been properly inited for UM objects) + - Fixed: The visibility of sub-items of hidden menu items + = 2.8.0: December 11, 2023 = * Enhancements: