- fixed vulnerabilities reported by Sucuri;

includes/core/class-validation.php

@@ -20,6 +20,29 @@ if ( ! class_exists( 'um\core\Validation' ) ) {
 		function __construct() {
 			$this->regex_safe = '/\A[\w\-\.]+\z/';
 			$this->regex_phone_number = '/\A[\d\-\.\+\(\)\ ]+\z/';
+
+
+			add_filter( 'um_user_pre_updating_files_array', array( $this, 'validate_files' ) );
+		}
+
+
+		/**
+		 * Validate files before upload
+		 *
+		 * @param $files
+		 *
+		 * @return mixed
+		 */
+		function validate_files( $files ) {
+			if ( ! empty( $files ) ) {
+				foreach ( $files as $key => $filename ) {
+					if ( validate_file( $filename ) !== 0 ) {
+						unset( $files[ $key ] );
+					}
+				}
+			}
+
+			return $files;
 		}