10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-18 14:13:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

- using slashes in the callback function setting of the dropdown fields;

Browse Source
This commit is contained in:
Nikita Sinelnikov
2022-06-08 21:24:23 +03:00
parent f46a382532
commit fe88b40939
8 changed files with 60 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-builtin.php
+1 -1
View File
@@ -67,7 +67,7 @@ if ( ! class_exists( 'um\core\Builtin' ) ) {
$fields = $this->all_user_fields;
if ( isset( $fields[$field]['options'] ) || ! empty( $fields[$field]['custom_dropdown_options_source'] ) ) {
if ( isset( $fields[ $field ]['options'] ) || ! empty( $fields[ $field ]['custom_dropdown_options_source'] ) ) {
return true;
}
includes/core/class-fields.php
+29 -23
View File
@@ -144,18 +144,20 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$fields[ $id ] = $args;
if ( array_key_exists( 'custom_dropdown_options_source', $args ) && function_exists( $args['custom_dropdown_options_source'] ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
$allowed_callbacks[] = $args['custom_dropdown_options_source'];
} else {
$allowed_callbacks = array( $args['custom_dropdown_options_source'] );
}
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) {
if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
$allowed_callbacks[] = $args['custom_dropdown_options_source'];
} else {
$allowed_callbacks = array( $args['custom_dropdown_options_source'] );
}
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
}
}
unset( $fields[ $id ]['in_row'] );
@@ -197,22 +199,26 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$args = array_merge( UM()->builtin()->predefined_fields[ $id ], $args );
}
$fields[ $id ] = $args;
if ( array_key_exists( 'custom_dropdown_options_source', $args ) ) {
if ( function_exists( wp_unslash( $args['custom_dropdown_options_source'] ) ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
$allowed_callbacks[] = $args['custom_dropdown_options_source'];
} else {
$allowed_callbacks = array( $args['custom_dropdown_options_source'] );
}
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
if ( array_key_exists( 'custom_dropdown_options_source', $args ) && function_exists( $args['custom_dropdown_options_source'] ) ) {
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
if ( ! empty( $allowed_callbacks ) ) {
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
$allowed_callbacks[] = $args['custom_dropdown_options_source'];
} else {
$allowed_callbacks = array( $args['custom_dropdown_options_source'] );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
$args['custom_dropdown_options_source'] = wp_unslash( $args['custom_dropdown_options_source'] );
}
$allowed_callbacks = array_unique( $allowed_callbacks );
$allowed_callbacks = implode( "\r\n", $allowed_callbacks );
UM()->options()->update( 'allowed_choice_callbacks', $allowed_callbacks );
}
$fields[ $id ] = $args;
// for group field only
if ( $args['type'] == 'group' ) {
$fields[ $id ]['in_group'] = '';
includes/core/class-form.php
+2 -1
View File
@@ -132,13 +132,14 @@ if ( ! class_exists( 'um\core\Form' ) ) {
}
$allowed_callbacks = UM()->options()->get( 'allowed_choice_callbacks' );
if ( empty( $allowed_callbacks ) ) {
$arr_options['status'] = 'error';
$arr_options['message'] = __( 'This is not possible for security reasons.', 'ultimate-member' );
wp_send_json( $arr_options );
}
$allowed_callbacks = array_map( 'rtrim', explode( "\n", $allowed_callbacks ) );
$allowed_callbacks = array_map( 'rtrim', explode( "\n", wp_unslash( $allowed_callbacks ) ) );
if ( ! in_array( $ajax_source_func, $allowed_callbacks, true ) ) {
$arr_options['status'] = 'error';
includes/core/class-member-directory.php
+2
View File
@@ -612,6 +612,8 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
}
}
$attrs['custom_dropdown_options_source'] = wp_unslash( $attrs['custom_dropdown_options_source'] );
$ajax_source = apply_filters( "um_custom_dropdown_options_source__{$filter}", $attrs['custom_dropdown_options_source'], $attrs );
$custom_dropdown .= ' data-um-ajax-source="' . esc_attr( $ajax_source ) . '" ';
includes/core/class-query.php
+14 -1
View File
@@ -279,7 +279,20 @@ if ( ! class_exists( 'um\core\Query' ) ) {
* @param $post_id
* @param $new_value
*/
function update_attr( $key, $post_id, $new_value ){
function update_attr( $key, $post_id, $new_value ) {
/**
* Post meta values are passed through the stripslashes() function upon being stored.
* Function wp_slash() is added to compensate for the call to stripslashes().
* @see https://developer.wordpress.org/reference/functions/update_post_meta/
*/
if ( is_array( $new_value ) ) {
foreach ( $new_value as $k => $val ) {
if ( is_array( $val ) && array_key_exists( 'custom_dropdown_options_source', $val ) ) {
$new_value[ $k ]['custom_dropdown_options_source'] = wp_slash( $val['custom_dropdown_options_source'] );
}
}
}
update_post_meta( $post_id, '_um_' . $key, $new_value );
}
includes/core/class-validation.php
+1 -1
View File
@@ -94,7 +94,7 @@ if ( ! class_exists( 'um\core\Validation' ) ) {
if ( in_array( $fields[ $key ]['type'], array( 'select','multiselect' ) ) &&
isset( $fields[ $key ]['custom_dropdown_options_source'] ) &&
! empty( $fields[ $key ]['custom_dropdown_options_source'] ) &&
function_exists( $fields[ $key ]['custom_dropdown_options_source'] ) ){
function_exists( $fields[ $key ]['custom_dropdown_options_source'] ) ) {
$arr_options = call_user_func( $fields[ $key ]['custom_dropdown_options_source'] );
$fields[ $key ]['options'] = array_keys( $arr_options );
}