10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-11 18:56:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize referers and printing notices in admin screens

Browse Source
This commit is contained in:
champsupertramp
2015-12-09 10:15:56 +08:00
parent 14c137f606
commit dbf7543761
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/core/um-admin-actions.php
+2 -2
View File
@@ -240,8 +240,8 @@
$uri = add_query_arg('user[]', $user_id, $uri);
$redirect = add_query_arg('user[]', $user_id, $redirect);
}
$uri = add_query_arg('confirm', 1, $uri);
$redirect = add_query_arg('_refer', urlencode($uri), $redirect);
$uri = add_query_arg('_refer', $_POST['_wp_http_referer'], $redirect);
$redirect = add_query_arg('confirm', 1, $uri);
exit( wp_redirect($redirect) );
admin/core/um-admin-notices.php
+7 -5
View File
@@ -161,18 +161,20 @@ class UM_Admin_Notices {
case 'confirm_delete':
$confirm_uri = urldecode($_REQUEST['_refer']);
$confirm_uri = sanitize_text_field( urldecode($_REQUEST['_wp_http_referer']) );
$users = '';
foreach( $_REQUEST['user'] as $user_id ) {
$user = get_userdata( $user_id );
$users .= '#' . $user_id . ': ' . $user->user_login . '<br />';
if( isset( $_REQUEST['user'] ) ){
foreach( $_REQUEST['user'] as $user_id ) {
$user = get_userdata( $user_id );
$users .= '#' . $user_id . ': ' . $user->user_login . '<br />';
}
}
$ignore = admin_url('users.php');
$messages[0]['err_content'] = sprintf(__('Are you sure you want to delete the selected user(s)? The following users will be deleted: <p>%s</p> <strong>This cannot be undone!</strong>','ultimatemember'), $users);
$messages[0]['err_content'] .= '<p><a href="'. esc_attr( $confirm_uri ) .'" class="button-primary">' . __('Remove','ultimatemember') . '</a>&nbsp;&nbsp;<a href="'.$ignore.'" class="button">' . __('Undo','ultimatemember') . '</a></p>';
$messages[0]['err_content'] .= '<p><a href="'. esc_html( $confirm_uri ) .'" class="button-primary">' . __('Remove','ultimatemember') . '</a>&nbsp;&nbsp;<a href="'.$ignore.'" class="button">' . __('Undo','ultimatemember') . '</a></p>';
break;