Update 1.2.8

admin/core/um-admin-dashboard.php

@@ -20,7 +20,7 @@ class UM_Admin_Dashboard {
 	***/
 	function primary_admin_menu() {
 		
-		$this->pagehook = add_menu_page( __('Ultimate Member', $this->slug), __('Ultimate Member', $this->slug), 'manage_options', $this->slug, array(&$this, 'admin_page'), 'dashicons-admin-users', '66.78578');
+		$this->pagehook = add_menu_page( __('Ultimate Member', $this->slug), __('Ultimate Member', $this->slug), 'manage_options', $this->slug, array(&$this, 'admin_page'), 'dashicons-admin-users', '42.78578');
 		add_action('load-'.$this->pagehook, array(&$this, 'on_load_page'));
 		
 		add_submenu_page( $this->slug, __('Dashboard', $this->slug), __('Dashboard', $this->slug), 'manage_options', $this->slug, array(&$this, 'admin_page') );

admin/core/um-admin-users.php

@@ -51,7 +51,7 @@ class UM_Admin_Users {
 		global $pagenow;
 
 		if ( is_admin() && $pagenow == 'users.php' ) {
-			
+
 			global $wpdb;
 
 			if (!isset($_REQUEST['orderby'])) {
@@ -73,7 +73,7 @@ class UM_Admin_Users {
 
 		if ( is_admin() && $pagenow=='users.php' && isset($_GET[ $this->custom_role ]) && $_GET[ $this->custom_role ] != '') {
 			
-			$query->role = urldecode($_GET[ $this->custom_role ]);
+			$role = urldecode($_GET[ $this->custom_role ]);
 
 			global $wpdb;
 
@@ -82,7 +82,7 @@ class UM_Admin_Users {
 					"WHERE 1=1 AND {$wpdb->users}.ID IN (
 						 SELECT {$wpdb->usermeta}.user_id FROM $wpdb->usermeta 
 							WHERE {$wpdb->usermeta}.meta_key = 'role' 
-							AND {$wpdb->usermeta}.meta_value = '{$query->role}')", 
+							AND {$wpdb->usermeta}.meta_value = '{$role}')", 
 					$query->query_where
 			);
 
@@ -90,7 +90,7 @@ class UM_Admin_Users {
 		
 		if ( is_admin() && $pagenow=='users.php' && isset($_GET[ 'status' ]) && $_GET[ 'status' ] != '') {
 			
-			$query->status = urldecode($_GET[ 'status' ]);
+			$status = urldecode($_GET[ 'status' ]);
 
 			global $wpdb;
 
@@ -99,7 +99,7 @@ class UM_Admin_Users {
 					"WHERE 1=1 AND {$wpdb->users}.ID IN (
 						 SELECT {$wpdb->usermeta}.user_id FROM $wpdb->usermeta 
 							WHERE {$wpdb->usermeta}.meta_key = 'account_status' 
-							AND {$wpdb->usermeta}.meta_value = '{$query->status}')", 
+							AND {$wpdb->usermeta}.meta_value = '{$status}')", 
 					$query->query_where
 			);
 

admin/templates/extensions.php

@@ -1,5 +1,12 @@
 <?php
 
+	$premium['profile-completeness'] = array(
+		'url' => 'https://ultimatemember.com/extensions/profile-completeness/',
+		'image' => 'https://ultimatemember.com/wp-content/uploads/2015/04/pc3-01-copy.png',
+		'name' => 'Profile Completeness',
+		'desc' => 'Encourage users to complete their profiles or force them to fill specific profile fields with the Profile Completeness extension.',
+	);
+	
 	$premium['real-time-notifications'] = array(
 		'url' => 'https://ultimatemember.com/extensions/real-time-notifications/',
 		'image' => 'https://ultimatemember.com/wp-content/uploads/2015/04/notifications-01-copy.png',

assets/css/um-members.css

@@ -256,8 +256,7 @@
 }
 
 .um-member-metaline {
-	font-size: 14px;
+	font-size: 13px;
-	color: #888;
 	padding: 12px 0 0 0;
 	line-height: 16px;
 	vertical-align: middle;

assets/css/um-profile.css

@@ -324,6 +324,16 @@ font-weight: normal;
 	line-height: 70px;
 }
 
+.um-profile-note i.um-faicon-lock{
+	position: relative;
+	top: 1px;
+	display: inline-block;
+	font-size: 24px;
+	height: auto;
+	line-height: 24px;
+	margin-right: 10px;
+}
+
 .um-profile-note span {
 	margin-top: 10px;
 	display: block;

assets/css/um-responsive.css

@@ -726,4 +726,15 @@ div.uimob960 .um-gutter-sizer {width: 4%}
 		display: none;
 	}
 
+}
+
+@media screen and (max-width: 600px) {
+	
+	.um-popup {
+		width: 90%;
+		margin-left: 5%;
+		left: 0;
+		top: 5%;
+	}
+	
 }

core/um-access.php

@@ -28,7 +28,7 @@ class UM_Access {
 			// login page add protected page automatically
 			if ( strstr( $this->redirect_handler, um_get_core_page('login') ) ){
 				$curr = $ultimatemember->permalinks->get_current_url();
-				$this->redirect_handler = add_query_arg('redirect_to', $curr, $this->redirect_handler);
+				$this->redirect_handler = esc_url( add_query_arg('redirect_to', $curr, $this->redirect_handler) );
 			}
 			
 			exit( wp_redirect( $this->redirect_handler ) );

core/um-account.php

@@ -101,7 +101,7 @@ class UM_Account {
 		
 		} else {
 			
-			$url = add_query_arg( 'um_tab', $id, um_get_core_page('account') );
+			$url = esc_url( add_query_arg( 'um_tab', $id, um_get_core_page('account') ) );
 			
 		}
 		

core/um-actions-account.php

@@ -49,7 +49,7 @@
 		
 		$url = $ultimatemember->account->tab_link( $tab );
 		
-		$url = add_query_arg('updated','account',$url);
+		$url = add_query_arg( 'updated', 'account', $url );
 		
 		exit( wp_redirect( $url ) );
 		
@@ -284,6 +284,10 @@
 		
 		<div class="um-account-heading uimob340-hide uimob500-hide"><i class="<?php echo $icon; ?>"></i><?php echo $title; ?></div>
 		
+		<div class="um-field">
+			<div class="um-field-label"><label for=""><?php _e('Email me when','ultimatemember'); ?></label><div class="um-clear"></div></div>
+		</div>
+		
 		<?php echo $output; ?>
 		
 		<?php do_action('um_after_account_notifications'); ?>

core/um-actions-form.php

@@ -9,7 +9,7 @@
 		
 		$can_register = get_option('users_can_register');
 		if ( !$can_register ) {
-			exit( wp_redirect( add_query_arg('err', 'registration_disabled') ) );
+			exit( wp_redirect( esc_url( add_query_arg('err', 'registration_disabled') ) ) );
 		}
 		
 	}
@@ -33,10 +33,10 @@
 			$check_domain = str_replace($domain[0], '*', $args['user_email']);
 
 			if ( in_array( $args['user_email'], $emails ) )
-				exit( wp_redirect( add_query_arg('err', 'blocked_email') ) );
+				exit( wp_redirect( esc_url(  add_query_arg('err', 'blocked_email') ) ) );
 			
 			if ( in_array( $check_domain, $emails ) )
-				exit( wp_redirect( add_query_arg('err', 'blocked_domain') ) );
+				exit( wp_redirect( esc_url(  add_query_arg('err', 'blocked_domain') ) ) );
 			
 		}
 		
@@ -46,10 +46,10 @@
 			$check_domain = str_replace($domain[0], '*', $args['username']);
 			
 			if ( in_array( $args['username'], $emails ) )
-				exit( wp_redirect( add_query_arg('err', 'blocked_email') ) );
+				exit( wp_redirect(  esc_url( add_query_arg('err', 'blocked_email') ) ) );
 
 			if ( in_array( $check_domain, $emails ) )
-				exit( wp_redirect( add_query_arg('err', 'blocked_domain') ) );
+				exit( wp_redirect(  esc_url(  add_query_arg('err', 'blocked_domain') ) ) );
 			
 		}
 		
@@ -72,7 +72,7 @@
 		foreach($ips as $ip) {
 			$ip = str_replace('*','',$ip);
 			if (strpos($user_ip, $ip) === 0) {
-				exit( wp_redirect( add_query_arg('err', 'blocked_ip') ) );
+				exit( wp_redirect(  esc_url(  add_query_arg('err', 'blocked_ip') ) ) );
 			}
 		}
 	}

core/um-actions-login.php

@@ -101,7 +101,7 @@
 			case 'awaiting_email_confirmation':
 			case 'rejected':
 				um_reset_user();
-				exit( wp_redirect( add_query_arg( 'err', $status, $ultimatemember->permalinks->get_current_url() ) ) );
+				exit( wp_redirect(  add_query_arg( 'err', esc_attr( $status ), $ultimatemember->permalinks->get_current_url() ) ) );
 				break;
 				
 		}

core/um-actions-members.php

@@ -231,15 +231,17 @@
 						$default_size = str_replace( 'px', '', um_get_option('profile_photosize') );
 						$corner = um_get_option('profile_photocorner');
 						?>
-					<div class="um-member-photo radius-<?php echo $corner; ?>"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo um_cap_initials( um_user('display_name') ); ?>"><?php echo get_avatar( um_user('ID'), $default_size ); ?></a></div>
+					<div class="um-member-photo radius-<?php echo $corner; ?>"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo um_user('display_name'); ?>"><?php echo get_avatar( um_user('ID'), $default_size ); ?></a></div>
 					<?php } ?>
 					
 					<div class="um-member-card <?php if (!$profile_photo) { echo 'no-photo'; } ?>">
 						
 						<?php if ( $show_name ) { ?>
-						<div class="um-member-name"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo um_cap_initials( um_user('display_name') ); ?>"><?php echo um_cap_initials( um_user('display_name') ); ?></a></div>
+						<div class="um-member-name"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo um_user('display_name'); ?>"><?php echo um_user('display_name'); ?></a></div>
 						<?php } ?>
 						
+						<?php do_action('um_members_just_after_name', um_user('ID'), $args); ?>
+						
 						<?php do_action('um_members_after_user_name', um_user('ID'), $args); ?>
 						
 						<?php
@@ -274,7 +276,7 @@
 											
 								?>
 								
-								<div class="um-member-metaline"><span><?php echo $value; ?></span></div>
+								<div class="um-member-metaline"><span><strong><?php echo $ultimatemember->fields->get_label( $key ); ?>:</strong> <?php echo $value; ?></span></div>
 								
 								<?php 
 									}

core/um-actions-misc.php

@@ -112,7 +112,7 @@
 					break;
 					
 				case 'awaiting_email_confirmation':
-					$err = __('Your account is awaiting e-mail verifications.','ultimatemember');
+					$err = __('Your account is awaiting e-mail verification.','ultimatemember');
 					break;
 					
 				case 'rejected':

core/um-actions-posts.php

@@ -1,56 +0,0 @@
-<?php
-
-	/***
-	***	@Search results
-	***/
-	add_action('pre_get_posts','um_pre_get_posts');
-	function um_pre_get_posts($query) {
-
-		if ( !is_admin() && $query->is_main_query() ) {
-			
-			// Incompatibility with The Events Calendar
-			if ( isset( $query->query['post_type'] ) && $query->query['post_type'] == 'tribe_events' ) return;
-
-			if ( $query->is_search || $query->is_archive() || $query->is_home ) {
-				
-				if ( $query->is_home && !um_get_option('exclude_from_main_loop' ) ) return;
-				if ( $query->is_archive && !um_get_option('exclude_from_archive_loop' ) ) return;
-				if ( $query->is_search && !um_get_option('exclude_from_search_loop' ) ) return;
-				
-				if ( is_user_logged_in() ) {
-
-					$meta_query['relation'] = 'OR';
-					$meta_query[] = array(
-									'key'=>'_um_accessible',
-									'value'=>'1',
-									'compare'=>'!=',
-					);
-					$meta_query[] = array(
-									'key'=>'_um_accessible',
-									'compare'=>'NOT EXISTS',
-					);
-					$query->set('meta_query',$meta_query);
-
-				}
-				
-				if ( !is_user_logged_in() ) {
-
-					$meta_query['relation'] = 'OR';
-					$meta_query[] = array(
-									'key'=>'_um_accessible',
-									'value'=>'2',
-									'compare'=>'!=',
-					);
-					$meta_query[] = array(
-									'key'=>'_um_accessible',
-									'compare'=>'NOT EXISTS',
-					);
-					$query->set('meta_query',$meta_query);
-
-				}
-				
-			}
-
-		}
-
-	}

core/um-actions-profile.php

@@ -5,20 +5,33 @@
 	***/
 	add_action('um_profile_content_main','um_profile_content_main');
 	function um_profile_content_main( $args ) {
-		
 		extract( $args );
+		
+		$can_view = apply_filters('um_profile_can_view_main', -1, um_profile_id() );
+		
+		if ( $can_view == -1 ) {
 	
-		do_action("um_before_form", $args);
+			do_action("um_before_form", $args);
-				
+					
-		do_action("um_before_{$template}_fields", $args);
+			do_action("um_before_{$mode}_fields", $args);
-				
+					
-		do_action("um_main_{$template}_fields", $args);
+			do_action("um_main_{$mode}_fields", $args);
-				
+					
-		do_action("um_after_form_fields", $args);
+			do_action("um_after_form_fields", $args);
-				
+					
-		do_action("um_after_{$template}_fields", $args);
+			do_action("um_after_{$mode}_fields", $args);
-				
+					
-		do_action("um_after_form", $args);
+			do_action("um_after_form", $args);
+		
+		} else {
+			
+			?>
+			
+			<div class="um-profile-note"><span><i class="um-faicon-lock"></i><?php echo $can_view; ?></span></div>
+			
+			<?php
+			
+		}
 	
 	}
 	
@@ -158,7 +171,7 @@
 	/***
 	***	@profile header cover
 	***/
-	add_action('um_profile_header_cover_area', 'um_profile_header_cover_area' );
+	add_action('um_profile_header_cover_area', 'um_profile_header_cover_area', 9 );
 	function um_profile_header_cover_area( $args ) {
 		global $ultimatemember;
 		
@@ -260,7 +273,7 @@
 	/***
 	***	@profile header
 	***/
-	add_action('um_profile_header', 'um_profile_header' );
+	add_action('um_profile_header', 'um_profile_header', 9 );
 	function um_profile_header( $args ) {
 		global $ultimatemember;
 		
@@ -557,7 +570,7 @@
 	/***
 	***	@display the available profile tabs
 	***/
-	add_action('um_profile_navbar', 'um_profile_navbar');
+	add_action('um_profile_navbar', 'um_profile_navbar', 9 );
 	function um_profile_navbar( $args ) {
 		global $ultimatemember;
 		
@@ -576,10 +589,11 @@
 		
 		$active_tab = $ultimatemember->profile->active_tab();
 
-		if ( !isset( $tabs[$active_tab] ) )
+		if ( !isset( $tabs[$active_tab] ) ) {
 			$active_tab = 'main';
 			$ultimatemember->profile->active_tab = $active_tab;
 			$ultimatemember->profile->active_subnav = null;
+		}
 
 		?>
 		
@@ -587,13 +601,15 @@
 		
 			<?php foreach( $tabs as $id => $tab ) {
 				
+				if ( isset( $tab['hidden'] ) ) continue;
+				
 				$nav_link = $ultimatemember->permalinks->get_current_url( get_option('permalink_structure') );
 				$nav_link = remove_query_arg( 'um_action', $nav_link );
 				$nav_link = remove_query_arg( 'subnav', $nav_link );
-				$nav_link = add_query_arg('profiletab', $id, $nav_link )
+				$nav_link =  add_query_arg('profiletab', $id, $nav_link );
 				?>
 			
-			<div class="um-profile-nav-item <?php if ( !um_get_option('profile_menu_icons') ) { echo 'without-icon'; } ?> <?php if ( $id == $active_tab ) { echo 'active'; } ?>">
+			<div class="um-profile-nav-item um-profile-nav-<?php echo $id; ?> <?php if ( !um_get_option('profile_menu_icons') ) { echo 'without-icon'; } ?> <?php if ( $id == $active_tab ) { echo 'active'; } ?>">
 				<a href="<?php echo $nav_link; ?>" title="<?php echo $tab['name']; ?>">
 
 					<i class="<?php echo $tab['icon']; ?>"></i>
@@ -610,6 +626,7 @@
 			<?php } ?>
 			
 			<div class="um-clear"></div>
+			
 		</div>
 	
 	<?php foreach( $tabs as $id => $tab ) {

core/um-actions-register.php

@@ -171,8 +171,8 @@
 				
 				if ( um_user( $status . '_action' ) == 'show_message' && um_user( $status . '_message' ) != '' ) {
 					$url = um_get_core_page('register');
-					$url = add_query_arg( 'message', $status, $url );
+					$url =  add_query_arg( 'message', esc_attr( $status ), $url );
-					$url = add_query_arg( 'uid', um_user('ID'), $url );
+					$url =  add_query_arg( 'uid', esc_attr( um_user('ID') ), $url );
 					exit( wp_redirect( $url ) );
 				}
 				

core/um-actions-user.php

@@ -59,7 +59,7 @@
 	?>
 	
 		<li><a href="<?php echo um_get_core_page('account'); ?>"><?php _e('Your account','ultimatemember'); ?></a></li>
-		<li><a href="<?php echo add_query_arg('redirect_to', $ultimatemember->permalinks->get_current_url(true), um_get_core_page('logout') ); ?>"><?php _e('Logout','ultimatemember'); ?></a></li>
+		<li><a href="<?php echo esc_url( add_query_arg('redirect_to', $ultimatemember->permalinks->get_current_url(true), um_get_core_page('logout') ) ); ?>"><?php _e('Logout','ultimatemember'); ?></a></li>
 	
 	<?php
 	

core/um-builtin.php

@@ -64,6 +64,8 @@ class UM_Builtin {
 		foreach ($fields as $field ) {
 			if ( isset( $this->predefined_fields[$field] ) ) {
 				$array = $this->predefined_fields[$field];
+			} else if ( isset( $this->saved_fields[$field] ) ) {
+				$array = $this->saved_fields[$field];
 			}
 		}
 		return $array;
@@ -456,6 +458,8 @@ class UM_Builtin {
 	
 		global $ultimatemember;
 		
+		$profile_privacy = apply_filters('um_profile_privacy_options', array( __('Everyone','ultimatemember'), __('Only me','ultimatemember') ) );
+		
 		$this->predefined_fields = array(
 		
 			'user_login' => array(
@@ -859,7 +863,7 @@ class UM_Builtin {
 				'public' => 1,
 				'editable' => 1,
 				'default' => __('Everyone','ultimatemember'),
-				'options' => array( __('Everyone','ultimatemember'), __('Only me','ultimatemember') ),
+				'options' => $profile_privacy,
 				'allowclear' => 0,
 				'account_only' => true,
 				'required_perm' => 'can_make_private_profile',

core/um-fields.php

@@ -516,6 +516,19 @@ class UM_Fields {
 		return '';
 	}
 	
+	/***
+	***	@Get Field Label
+	***/
+	function get_label( $key ) {
+		global $ultimatemember;
+		$fields = $ultimatemember->builtin->all_user_fields;
+		if ( isset( $fields[$key]['label'] ) )
+			return $fields[$key]['label'];
+		if ( isset( $fields[$key]['title'] ) )
+			return $fields[$key]['title'];
+		return '';
+	}
+	
 	/***
 	***	@Get Field Title
 	***/
@@ -927,7 +940,7 @@ class UM_Fields {
 
 						$output .= '<div class="um-field-area">';
 						
-						if ( isset($icon) && $icon && $this->field_icons == 'field' ) {
+						if ( isset($icon) && $icon && isset( $this->field_icons ) && $this->field_icons == 'field' ) {
 						
 						$output .= '<div class="um-field-icon"><i class="'.$icon.'"></i></div>';
 						
@@ -1112,7 +1125,7 @@ class UM_Fields {
 
 						$output .= '<div class="um-field-area">';
 						
-						if ( isset($icon) && $icon && $this->field_icons == 'field' ) {
+						if ( isset($icon) && $icon && isset( $this->field_icons ) && $this->field_icons == 'field' ) {
 						
 						$output .= '<div class="um-field-icon"><i class="'.$icon.'"></i></div>';
 						

core/um-filters-arguments.php

@@ -30,6 +30,7 @@
 
 		if ($ultimatemember->shortcodes->message_mode == true) {
 			$args['template'] = 'message';
+			um_fetch_user( $_REQUEST['uid'] );
 			$ultimatemember->shortcodes->custom_message = um_user( um_user('status')  . '_message' );
 			um_reset_user();
 		}

core/um-filters-fields.php

@@ -165,7 +165,7 @@
 		
 		$value = str_replace('https://https://','https://',$value);
 		$value = str_replace('http://https://','https://',$value);
-		
+
 		return $value;
 
 	}

core/um-filters-login.php

@@ -81,7 +81,7 @@
 					return new WP_Error( $status, __('Your account has not been approved yet.','ultimatemember') );
 					break;
 				case 'awaiting_email_confirmation':
-					return new WP_Error( $status, __('Your account is awaiting e-mail verifications.','ultimatemember') );
+					return new WP_Error( $status, __('Your account is awaiting e-mail verification.','ultimatemember') );
 					break;
 				case 'rejected':
 					return new WP_Error( $status, __('Your membership request has been rejected.','ultimatemember') );

core/um-password.php

@@ -47,9 +47,9 @@ class UM_Password {
 		
 		if ( !um_user('reset_pass_hash') ) return false;
 		
-		$url = add_query_arg( 'act', 'reset_password', um_get_core_page('password-reset') );
+		$url =  add_query_arg( 'act', 'reset_password', um_get_core_page('password-reset') );
-		$url = add_query_arg( 'hash', um_user('reset_pass_hash'), $url );
+		$url =  add_query_arg( 'hash', esc_attr( um_user('reset_pass_hash') ), $url );
-		$url = add_query_arg( 'user_id', um_user('ID'), $url );
+		$url =  add_query_arg( 'user_id', esc_attr( um_user('ID') ), $url );
 		
 		return $url;
 		

core/um-permalinks.php

@@ -32,19 +32,20 @@ class UM_Permalinks {
 	***/
 	function get_current_url( $no_query_params = false ) {
 		global $post;
-
+		 
 		if ( is_front_page() ) :
-			$page_url = home_url() . $_SERVER["REQUEST_URI"];
+			$page_url = home_url();
 		else :
 			$page_url = 'http';
-
+		 
 		if ( isset( $_SERVER["HTTPS"] ) && $_SERVER["HTTPS"] == "on" )
 			$page_url .= "s";
 			$page_url .= "://";
-			if ( isset( $_SERVER["SERVER_PORT"] ) && $_SERVER["SERVER_PORT"] != "80" )
+		 
-				$page_url .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
+		if ( $_SERVER["SERVER_PORT"] != "80" )
-			else
+			$page_url .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
-				$page_url .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
+		else
+			$page_url .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 		endif;
 
 		if ( $no_query_params == true ) {
@@ -88,9 +89,9 @@ class UM_Permalinks {
 		
 		if ( !um_user('account_secret_hash') ) return false;
 		
-		$url = add_query_arg( 'act', 'activate_via_email', home_url() );
+		$url =  add_query_arg( 'act', 'activate_via_email', home_url() );
-		$url = add_query_arg( 'hash', um_user('account_secret_hash'), $url );
+		$url =  add_query_arg( 'hash', um_user('account_secret_hash'), $url );
-		$url = add_query_arg( 'user_id', um_user('ID'), $url );
+		$url =  add_query_arg( 'user_id', um_user('ID'), $url );
 		
 		return $url;
 	}
@@ -100,20 +101,15 @@ class UM_Permalinks {
 	***/
 	function check_for_querystrings(){
 		global $ultimatemember;
-		
 		if ( isset($_REQUEST['message']) ) 
 			$ultimatemember->shortcodes->message_mode = true;
-		
-		if ( isset($_REQUEST['message']) && isset($_REQUEST['uid']) )
-			um_fetch_user( $_REQUEST['uid'] );
-			
 	}
 	
 	/***
 	***	@add a query param to url
 	***/
 	function add_query( $key, $value ) {
-		$this->current_url = add_query_arg( $key, $value, $this->current_url );
+		$this->current_url =  esc_url( add_query_arg( $key, $value, $this->current_url ) );
 		return $this->current_url;
 	}
 	/***
@@ -165,7 +161,7 @@ class UM_Permalinks {
 		
 		} else {
 			
-			$profile_url = add_query_arg( 'um_user', $user_in_url, $profile_url );
+			$profile_url =  add_query_arg( 'um_user', $user_in_url, $profile_url );
 			
 		}
 
@@ -177,9 +173,9 @@ class UM_Permalinks {
 	***/
 	function admin_act_url( $action, $subaction ) {
 		$url = $this->get_current_url();
-		$url = add_query_arg( 'um_adm_action', $action, $url );
+		$url =  add_query_arg( 'um_adm_action', $action, $url );
-		$url = add_query_arg( 'sub', $subaction, $url );
+		$url =  add_query_arg( 'sub', $subaction, $url );
-		$url = add_query_arg( 'user_id', um_user('ID'), $url );
+		$url =  add_query_arg( 'user_id', um_user('ID'), $url );
 		return $url;
 	}
 

core/um-profile.php

@@ -22,7 +22,7 @@ class UM_Profile {
 	function tabs_active(){
 		$tabs = $this->tabs();
 		foreach( $tabs as $id => $info ) {
-			if ( !um_get_option('profile_tab_'.$id) )
+			if ( !um_get_option('profile_tab_'.$id) && !isset( $info['_builtin'] ) )
 				unset( $tabs[$id] );
 		}
 		return $tabs;
@@ -34,7 +34,9 @@ class UM_Profile {
 	function tabs_primary(){
 		$tabs = $this->tabs();
 		foreach( $tabs as $id => $info ){
-			$primary[$id] = $info['name'];
+			if ( isset( $info['name'] ) ) {
+				$primary[$id] = $info['name'];
+			}
 		}
 		return $primary;
 	}

core/um-query.php

@@ -119,6 +119,13 @@ class UM_Query {
 	***/
 	function get_role_by_userid( $user_id ) {
 		$role = get_user_meta( $user_id, 'role', true );
+		if ( !$role ) {
+			if ( $user_id == get_current_user_id() && current_user_can('edit_users') ) {
+				$role = 'admin';
+			} else {
+				$role = 'member';
+			}
+		}
 		return $role;
 	}
 	

core/um-rewrite.php

@@ -59,6 +59,8 @@ class UM_Rewrite {
 				flush_rewrite_rules( true );
 				update_option('um_flush_rules', true);
 			}
+			
+			flush_rewrite_rules( true );
 
 		}
 		
@@ -121,7 +123,7 @@ class UM_Rewrite {
 				
 			}
 			
-		} else if ( um_is_core_page('user') ) { // just base64_decode
+		} else if ( um_is_core_page('user') ) {
 		
 			if ( is_user_logged_in() ) { // just redirect to their profile
 				
@@ -131,7 +133,7 @@ class UM_Rewrite {
 				
 				if ( $query ) {
 					foreach( $query as $key => $val ) {
-						$url = add_query_arg($key, $val, $url);
+						$url =  add_query_arg($key, $val, $url);
 					}
 				}
 				

core/um-setup.php

@@ -366,6 +366,7 @@ class UM_Setup {
 						'post_type' 	  	=> 'post',
 						'post_status'		=> 'publish',
 						'post_author'   	=> um_user('ID'),
+						'comment_status'    => 'closed'
 					);
 					
 					$post_id = wp_insert_post( $user_page );

core/um-short-functions.php

@@ -90,14 +90,27 @@ function um_user_ip() {
 	}
 	
 	/***
-	***	@Capitalize first initial
+	***	@Get limit of words from sentence
 	***/
-	function um_cap_initials( $name ) {
+	function um_get_snippet( $str, $wordCount = 10 ) {
-		if ( is_email( $name ) ) return $name;
+		if ( str_word_count( $str ) > $wordCount ) {
-		$name = str_replace('\' ', '\'', ucwords( str_replace('\'', '\' ', mb_strtolower($name, 'UTF-8') ) ) );
+		  $str = implode( 
-		return $name;
+			'', 
+			array_slice( 
+			  preg_split(
+				'/([\s,\.;\?\!]+)/', 
+				$str, 
+				$wordCount*2+1, 
+				PREG_SPLIT_DELIM_CAPTURE
+			  ),
+			  0,
+			  $wordCount*2-1
+			)
+		  );
+		}
+	  return $str;
 	}
-	
+
 	/***
 	***	@Get submitted user information
 	***/
@@ -264,7 +277,7 @@ function um_profile_id() {
 			$url = get_permalink( $ultimatemember->permalinks->core[ $slug ] );
 			
 			if ( $updated )
-				$url = add_query_arg( 'updated', $updated, $url );
+				$url =  add_query_arg( 'updated', esc_attr( $updated ), $url );
 				
 			return $url;
 			
@@ -523,6 +536,8 @@ function um_reset_user() {
 	function um_can_view_profile( $user_id ){
 		global $ultimatemember;
 		
+		if ( !um_user('can_view_all') && $user_id != get_current_user_id() && is_user_logged_in() ) return false;
+		
 		if ( um_current_user_can('edit', $user_id ) ) {
 			return true;
 		}
@@ -536,9 +551,7 @@ function um_reset_user() {
 		}
 		
 		if ( !um_user('can_access_private_profile') && $ultimatemember->user->is_private_profile( $user_id ) ) return false;
-		
+
-		if ( !um_user('can_view_all') && $user_id != get_current_user_id() ) return false;
-		
 		if ( um_user('can_view_roles') && $user_id != get_current_user_id() ) {
 			if ( !in_array( $ultimatemember->query->get_role_by_userid( $user_id ), um_user('can_view_roles') ) ) {
 				return false;
@@ -647,11 +660,11 @@ function um_reset_user() {
 	***/
 	function um_edit_profile_url(){
 		global $ultimatemember;
-		$url = um_get_core_page('user');
+		$url = um_user_profile_url();
 		$url = remove_query_arg('profiletab', $url);
 		$url = remove_query_arg('subnav', $url);
-		$url = add_query_arg('profiletab', 'main',$url);
+		$url = add_query_arg( 'profiletab', 'main', $url );
-		$url = add_query_arg('um_action','edit', $url);
+		$url = add_query_arg( 'um_action',  'edit', $url );
 		return $url;
 	}
 	

core/um-shortcodes.php

@@ -134,7 +134,7 @@ class UM_Shortcodes {
 		$args = apply_filters('um_shortcode_args_filter', $args );
 
 		extract( $args, EXTR_SKIP );
-		
+
 		// for profiles only
 		if ( $mode == 'profile' && um_profile_id() && isset( $args['role'] ) && $args['role'] && 
 				$args['role'] != $ultimatemember->query->get_role_by_userid( um_profile_id() ) )
@@ -307,7 +307,7 @@ class UM_Shortcodes {
 				$usermeta = str_replace('}','',$usermeta);
 				
 				if ( $usermeta == 'user_avatar_small' ) {
-					$value = um_user('profile_photo', 40);
+					$value = get_avatar( um_user('ID'), 40 );
 				} elseif ( um_user( $usermeta ) ){
 					$value = um_user( $usermeta );
 				}

core/um-tracking.php

@@ -139,8 +139,8 @@ class UM_Tracking {
 		if ( $hide_notice )
 			return;
 
-		$optin_url  = add_query_arg( 'um_adm_action', 'opt_into_tracking' );
+		$optin_url  =  esc_url( add_query_arg( 'um_adm_action', 'opt_into_tracking' ) );
-		$optout_url = add_query_arg( 'um_adm_action', 'opt_out_of_tracking' );
+		$optout_url =  esc_url( add_query_arg( 'um_adm_action', 'opt_out_of_tracking' ) );
 
 		echo '<div class="updated" style="border-color: #3ba1da;"><p>';
 		

core/um-user-posts.php

@@ -66,13 +66,11 @@ class UM_User_posts {
 		$tabs['posts'] = array(
 			'name' => __('Posts','ultimatemember'),
 			'icon' => 'um-faicon-pencil',
-			'count' => $this->count_user_posts_by_type(),
 		);
 		
 		$tabs['comments'] = array(
 			'name' => __('Comments','ultimatemember'),
 			'icon' => 'um-faicon-comment',
-			'count' => $this->count_user_comments(),
 		);
 		
 		return $tabs;

core/um-user.php

@@ -481,6 +481,8 @@ class UM_User {
 	function delete( $send_mail = true ) {
 		global $ultimatemember;
 		
+		do_action( 'um_delete_user', um_user('ID') );
+		
 		if ( $send_mail ) {
 			$ultimatemember->mail->send( um_user('user_email'), 'deletion_email' );
 			$ultimatemember->mail->send( um_admin_email(), 'notification_deletion', array('admin' => true ) );
@@ -713,6 +715,20 @@ class UM_User {
 		return false;
 	}
 	
+	/***
+	***	@Is private
+	***/
+	function is_private_case( $user_id, $case ) {
+		$privacy = get_user_meta( $user_id, 'profile_privacy', true );
+		
+		if ( $privacy == $case ) {
+			$bool = apply_filters('um_is_private_filter_hook', false, $privacy, $user_id );
+			return $bool;
+		}
+		
+		return false;
+	}
+	
 	/***
 	***	@update files
 	***/

index.php

@@ -3,7 +3,7 @@
 Plugin Name: Ultimate Member
 Plugin URI: http://ultimatemember.com/
 Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress
-Version: 1.2.2
+Version: 1.2.8
 Author: Ultimate Member
 Author URI: http://ultimatemember.com/
 */

readme.txt

@@ -5,9 +5,9 @@ Contributors: ultimatemember
 Donate link: 
 Tags: access control, author, authors, author profile, comments, community, communities, conditional fields, conditional logic, conditional menus, content protection, custom fields, file uploads, form builder, front-end login, front-end registration, gravatar, hide wp-admin, login, login page, logged-in users, mandrill, member, members, membership, member directory, online users, profile, profiles, profile builder, registration, restriction, restrict content, role creation, role menus, search filters, sign in, sign up, social network, star ratings, toolbar, user, users, user fields, user profile, user-profile, user profiles, user roles
 Requires at least: 4.1
-Tested up to: 4.1.1
+Tested up to: 4.2
 
-Stable Tag: 1.2.2
+Stable Tag: 1.2.8
 
 License: GNU Version 2 or Any Later Version
 
@@ -79,6 +79,7 @@ Ultimate Member has been translated into the following languages:
 * Dutch - Nederlands
 * Finnish - Suomi
 * Polish - Polski
+* Russian - Русский
 * Turkish - Türkçe
 * العربية
 
@@ -139,6 +140,41 @@ The plugin works with popular caching plugins by automatically excluding Ultimat
 
 == Changelog ==
 
+= 1.2.8: April 25, 2015 =
+
+* Fixed: Important WP 4.2 conflict resolved: filtering users in backend
+
+= 1.2.7: April 25, 2015 =
+
+* Tweak: Compatible with WordPress 4.2
+* Tweak: general code tweaks and improvements
+* Tweak: new action hook when user is deleted
+* Tweak: new action/filter hooks for profiles (developers)
+* Tweak: new filter hook for profile privacy option
+* Fixed: permalink issues
+
+= 1.2.6: April 22, 2015 =
+
+* Fixed: password reset security fix ( do not reveal emails )
+* Fixed: bug with custom profile templates
+* Fixed: display name in member directories
+* Fixed: URL fields display in member directory
+* Fixed: many bugs with previous version
+
+= 1.2.5: April 21, 2015 =
+
+* Fixed: e-mail activation bugs
+
+= 1.2.4: April 20, 2015 =
+
+* New: added Russian language support
+* Fixed: Security patch related to add_query_arg()
+* Fixed: bug with approval HTML e-mail
+
+= 1.2.3: April 16, 2015 =
+
+* Fixed: major bug with admin capability / editing user profiles via frontend
+
 = 1.2.2: April 15, 2015 =
 
 * New: added caching to user roles and user permissions to save queries

templates/password-reset.php

@@ -18,7 +18,7 @@
 			
 				echo '<div class="um-field-block">';
 				
-				echo '<p>A password reset link has been sent to <strong>' . $ultimatemember->password->reset_request['user_email'] . '</strong>. Please check your inbox!</p>';
+				echo '<p>' . __('We have sent you a password reset link to your e-mail. Please check your inbox.','ultimatemember') . '</p>';
 				
 				echo '</div>';
 				

um-config.php

@@ -1482,15 +1482,19 @@ $tab_options[] = array(
 );
 
 foreach( $tabs as $id => $tab ) {
-$tab_options[] = array(
+	
-                'id'       		=> 'profile_tab_' . $id,
+	if ( isset( $tab['_builtin'] ) ) continue;
-                'type'     		=> 'switch',
+
-                'title'    		=> sprintf(__('%s Tab','ultimatemember'), $tab ),
+	$tab_options[] = array(
-				'default' 		=> 1,
+					'id'       		=> 'profile_tab_' . $id,
-				'required'		=> array( 'profile_menu', '=', 1 ),
+					'type'     		=> 'switch',
-				'on'			=> __('On','ultimatemember'),
+					'title'    		=> sprintf(__('%s Tab','ultimatemember'), $tab ),
-				'off'			=> __('Off','ultimatemember'),
+					'default' 		=> 1,
-);
+					'required'		=> array( 'profile_menu', '=', 1 ),
+					'on'			=> __('On','ultimatemember'),
+					'off'			=> __('Off','ultimatemember'),
+	);
+
 }
 
 $tab_options[] = array(

um-init.php

@@ -25,6 +25,7 @@ class UM_API {
 			'nl_NL' => 'Nederlands',
 			'fi_FI' => 'Suomi',
 			'pl_PL' => 'Polski',
+			'ru_RU' => 'Русский',
 			'tr_TR' => 'Türkçe',
 			'ar' 	=> 'العربية'
 		);