templates_path = um_path . 'includes/admin/templates/';
+ $this->templates_path = UM_PATH . 'includes/admin/templates/';
add_action( 'admin_init', array( &$this, 'admin_init' ), 0 );
$prefix = is_network_admin() ? 'network_admin_' : '';
- add_filter( "{$prefix}plugin_action_links_" . um_plugin, array( &$this, 'plugin_links' ) );
+ add_filter( "{$prefix}plugin_action_links_" . UM_PLUGIN, array( &$this, 'plugin_links' ) );
add_action( 'um_admin_do_action__user_cache', array( &$this, 'user_cache' ) );
add_action( 'um_admin_do_action__user_status_cache', array( &$this, 'user_status_cache' ) );
add_action( 'um_admin_do_action__purge_temp', array( &$this, 'purge_temp' ) );
add_action( 'um_admin_do_action__manual_upgrades_request', array( &$this, 'manual_upgrades_request' ) );
add_action( 'um_admin_do_action__duplicate_form', array( &$this, 'duplicate_form' ) );
- add_action( 'um_admin_do_action__um_hide_locale_notice', array( &$this, 'um_hide_notice' ) );
- add_action( 'um_admin_do_action__um_can_register_notice', array( &$this, 'um_hide_notice' ) );
- add_action( 'um_admin_do_action__um_hide_exif_notice', array( &$this, 'um_hide_notice' ) );
add_action( 'um_admin_do_action__user_action', array( &$this, 'user_action' ) );
add_action( 'um_admin_do_action__check_templates_version', array( &$this, 'check_templates_version' ) );
@@ -764,16 +761,16 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
'sanitize' => 'bool',
),
'_max_selections' => array(
- 'sanitize' => 'empty_int',
+ 'sanitize' => 'empty_absint',
),
'_min_selections' => array(
- 'sanitize' => 'empty_int',
+ 'sanitize' => 'empty_absint',
),
'_max_entries' => array(
- 'sanitize' => 'absint',
+ 'sanitize' => 'empty_absint',
),
'_max_words' => array(
- 'sanitize' => 'absint',
+ 'sanitize' => 'empty_absint',
),
'_min' => array(
'sanitize' => 'empty_int',
@@ -782,10 +779,10 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
'sanitize' => 'empty_int',
),
'_min_chars' => array(
- 'sanitize' => 'absint',
+ 'sanitize' => 'empty_absint',
),
'_max_chars' => array(
- 'sanitize' => 'absint',
+ 'sanitize' => 'empty_absint',
),
'_html' => array(
'sanitize' => 'bool',
@@ -1606,22 +1603,17 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
return $classes;
}
-
/**
*
*/
public function manual_upgrades_request() {
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
-
$last_request = get_option( 'um_last_manual_upgrades_request', false );
if ( empty( $last_request ) || time() > $last_request + DAY_IN_SECONDS ) {
if ( is_multisite() ) {
$blogs_ids = get_sites();
- foreach( $blogs_ids as $b ) {
+ foreach ( $blogs_ids as $b ) {
switch_to_blog( $b->blog_id );
wp_clean_update_cache();
@@ -1638,22 +1630,30 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
update_option( 'um_last_manual_upgrades_request', time() );
}
- $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_got_updates' ), admin_url( 'admin.php' ) );
+ $url = add_query_arg(
+ array(
+ 'page' => 'ultimatemember',
+ 'update' => 'um_got_updates',
+ ),
+ admin_url( 'admin.php' )
+ );
} else {
- $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_often_updates' ), admin_url( 'admin.php' ) );
+ $url = add_query_arg(
+ array(
+ 'page' => 'ultimatemember',
+ 'update' => 'um_often_updates',
+ ),
+ admin_url( 'admin.php' )
+ );
}
- exit( wp_redirect( $url ) );
+ wp_safe_redirect( $url );
+ exit;
}
-
/**
- * Core pages installation
+ * Core pages installation.
*/
- function install_core_pages() {
- if ( ! is_admin() ) {
- die();
- }
-
+ public function install_core_pages() {
UM()->setup()->install_default_pages();
//check empty pages in settings
@@ -1664,7 +1664,7 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
foreach ( $pages as $slug => $page_id ) {
$page = get_post( $page_id );
- if ( ! isset( $page->ID ) && in_array( $slug, array_keys( UM()->config()->core_pages ) ) ) {
+ if ( ! isset( $page->ID ) && array_key_exists( $slug, UM()->config()->core_pages ) ) {
$empty_pages[] = $slug;
}
}
@@ -1672,27 +1672,22 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
//if there aren't empty pages - then hide pages notice
if ( empty( $empty_pages ) ) {
- $hidden_notices = get_option( 'um_hidden_admin_notices', array() );
+ $hidden_notices = get_option( 'um_hidden_admin_notices', array() );
$hidden_notices[] = 'wrong_pages';
update_option( 'um_hidden_admin_notices', $hidden_notices );
}
$url = add_query_arg( array( 'page' => 'um_options' ), admin_url( 'admin.php' ) );
- exit( wp_redirect( $url ) );
+ wp_safe_redirect( $url );
+ exit;
}
-
/**
- * Clear all users cache
- *
- * @param $action
+ * Clear all users cache.
*/
- function user_cache( $action ) {
+ public function user_cache() {
global $wpdb;
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE 'um_cache_userdata_%'" );
@@ -1703,21 +1698,14 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
),
admin_url( 'admin.php' )
);
- wp_redirect( $url );
+ wp_safe_redirect( $url );
exit;
}
-
/**
- * Clear all users statuses count cache
- *
- * @param $action
+ * Clear all users statuses count cache.
*/
- function user_status_cache( $action ) {
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
-
+ public function user_status_cache() {
$statuses = array(
'approved',
'awaiting_admin_review',
@@ -1741,43 +1729,37 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
),
admin_url( 'admin.php' )
);
- wp_redirect( $url );
+ wp_safe_redirect( $url );
exit;
}
-
/**
- * Purge temp uploads dir
- * @param $action
+ * Purge temp uploads dir.
*/
- function purge_temp( $action ) {
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
-
+ public function purge_temp() {
UM()->files()->remove_dir( UM()->files()->upload_temp );
- $url = add_query_arg( array( 'page' => 'ultimatemember', 'update' => 'um_purged_temp' ), admin_url( 'admin.php' ) );
- exit( wp_redirect( $url ) );
+ $url = add_query_arg(
+ array(
+ 'page' => 'ultimatemember',
+ 'update' => 'um_purged_temp',
+ ),
+ admin_url( 'admin.php' )
+ );
+ wp_safe_redirect( $url );
+ exit;
}
-
/**
* Duplicate form
- *
- * @param $action
*/
- public function duplicate_form( $action ) {
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
-
- if ( empty( $_REQUEST['post_id'] ) || empty( $_REQUEST['nonce'] ) || ! wp_verify_nonce( $_REQUEST['nonce'], "um-duplicate_form{$_REQUEST['post_id']}" ) ) {
- die();
+ public function duplicate_form() {
+ if ( empty( $_REQUEST['post_id'] ) || empty( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( $_REQUEST['_wpnonce'], "um-duplicate_form{$_REQUEST['post_id']}" ) ) {
+ die( esc_html__( 'Security check', 'ultimate-member' ) );
}
if ( ! is_numeric( $_REQUEST['post_id'] ) ) {
- die();
+ die( esc_html__( 'Wrong ID', 'ultimate-member' ) );
}
$post_id = absint( $_REQUEST['post_id'] );
@@ -1817,26 +1799,10 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
}
/**
- * Action to hide notices in admin
- *
- * @param $action
+ * Various user actions.
*/
- function um_hide_notice( $action ) {
- if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
- die();
- }
-
- update_option( $action, 1 );
- exit( wp_redirect( remove_query_arg( 'um_adm_action' ) ) );
- }
-
- /**
- * Various user actions
- *
- * @param $action
- */
- function user_action( $action ) {
- if ( ! is_admin() || ! current_user_can( 'edit_users' ) ) {
+ public function user_action() {
+ if ( ! current_user_can( 'edit_users' ) ) {
die();
}
if ( ! isset( $_REQUEST['sub'] ) ) {
@@ -1891,17 +1857,14 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
um_reset_user();
- wp_redirect( add_query_arg( 'update', 'um_user_updated', admin_url( '?page=ultimatemember' ) ) );
+ wp_safe_redirect( add_query_arg( 'update', 'um_user_updated', admin_url( '?page=ultimatemember' ) ) );
exit;
-
}
/**
- * Manual check templates versions
- *
- * @param $action
+ * Manual check templates versions.
*/
- public function check_templates_version( $action ) {
+ public function check_templates_version() {
$templates = UM()->admin_settings()->get_override_templates( true );
$out_date = false;
@@ -1928,30 +1891,42 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
}
/**
- * Add any custom links to plugin page
+ * Add any custom links to plugin page.
*
* @param array $links
*
* @return array
*/
- function plugin_links( $links ) {
- $more_links[] = '' . __( 'Docs', 'ultimate-member' ) . '';
- $more_links[] = '' . __( 'Settings', 'ultimate-member' ) . '';
+ public function plugin_links( $links ) {
+ $more_links[] = '' . esc_html__( 'Docs', 'ultimate-member' ) . '';
+ $more_links[] = '' . esc_html__( 'Settings', 'ultimate-member' ) . '';
$links = $more_links + $links;
return $links;
}
-
/**
* Init admin action/filters + request handlers
*/
- function admin_init() {
+ public function admin_init() {
$this->init_variables();
- if ( is_admin() && current_user_can( 'manage_options' ) && ! empty( $_REQUEST['um_adm_action'] ) ) {
+ if ( ! empty( $_REQUEST['um_adm_action'] ) && is_admin() && current_user_can( 'manage_options' ) ) {
$action = sanitize_key( $_REQUEST['um_adm_action'] );
+ $individual_nonce_actions = array(
+ 'user_action',
+ 'duplicate_form',
+ );
+ $individual_nonce_actions = apply_filters( 'um_adm_action_individual_nonce_actions', $individual_nonce_actions );
+
+ // Some actions have their own nonce. Verify individually.
+ if ( ! in_array( $action, $individual_nonce_actions, true ) ) {
+ if ( empty( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( $_REQUEST['_wpnonce'], $action ) ) {
+ wp_die( esc_attr__( 'Security Check', 'ultimate-member' ) );
+ }
+ }
+
/**
* UM hook
*
@@ -1995,7 +1970,6 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
}
}
-
/**
* Updated post messages
*
@@ -2003,31 +1977,30 @@ if ( ! class_exists( 'um\admin\Admin' ) ) {
*
* @return array
*/
- function post_updated_messages( $messages ) {
+ public function post_updated_messages( $messages ) {
global $post_ID;
$post_type = get_post_type( $post_ID );
- if ( $post_type == 'um_form' ) {
+ if ( 'um_form' === $post_type ) {
$messages['um_form'] = array(
- 0 => '',
- 1 => __( 'Form updated.', 'ultimate-member' ),
- 2 => __( 'Custom field updated.', 'ultimate-member' ),
- 3 => __( 'Custom field deleted.', 'ultimate-member' ),
- 4 => __( 'Form updated.', 'ultimate-member' ),
- 5 => isset( $_GET['revision'] ) ? __( 'Form restored to revision.', 'ultimate-member' ) : false,
- 6 => __( 'Form created.', 'ultimate-member' ),
- 7 => __( 'Form saved.', 'ultimate-member' ),
- 8 => __( 'Form submitted.', 'ultimate-member' ),
- 9 => __( 'Form scheduled.', 'ultimate-member' ),
- 10 => __( 'Form draft updated.', 'ultimate-member' ),
+ 0 => '',
+ 1 => __( 'Form updated.', 'ultimate-member' ),
+ 2 => __( 'Custom field updated.', 'ultimate-member' ),
+ 3 => __( 'Custom field deleted.', 'ultimate-member' ),
+ 4 => __( 'Form updated.', 'ultimate-member' ),
+ 5 => isset( $_GET['revision'] ) ? __( 'Form restored to revision.', 'ultimate-member' ) : false,
+ 6 => __( 'Form created.', 'ultimate-member' ),
+ 7 => __( 'Form saved.', 'ultimate-member' ),
+ 8 => __( 'Form submitted.', 'ultimate-member' ),
+ 9 => __( 'Form scheduled.', 'ultimate-member' ),
+ 10 => __( 'Form draft updated.', 'ultimate-member' ),
);
}
return $messages;
}
-
/**
* Gettext filters
*
diff --git a/includes/admin/core/class-admin-columns.php b/includes/admin/core/class-admin-columns.php
index 55a65adb..317b0b36 100644
--- a/includes/admin/core/class-admin-columns.php
+++ b/includes/admin/core/class-admin-columns.php
@@ -117,7 +117,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Columns' ) ) {
'post_type' => 'um_form',
'um_adm_action' => 'duplicate_form',
'post_id' => $id,
- 'nonce' => wp_create_nonce( "um-duplicate_form{$id}" ),
+ '_wpnonce' => wp_create_nonce( "um-duplicate_form{$id}" ),
),
admin_url( 'edit.php' )
);
diff --git a/includes/admin/core/class-admin-metabox.php b/includes/admin/core/class-admin-metabox.php
index 41bd7ebe..4e35a663 100644
--- a/includes/admin/core/class-admin-metabox.php
+++ b/includes/admin/core/class-admin-metabox.php
@@ -1062,24 +1062,23 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
do_action( 'um_admin_custom_login_metaboxes' );
}
-
/**
* Save directory metabox
*
* @param $post_id
* @param $post
*/
- function save_metabox_directory( $post_id, $post ) {
+ public function save_metabox_directory( $post_id, $post ) {
global $wpdb;
// validate nonce
if ( ! isset( $_POST['um_admin_save_metabox_directory_nonce'] ) ||
- ! wp_verify_nonce( $_POST['um_admin_save_metabox_directory_nonce'], basename( __FILE__ ) ) ) {
+ ! wp_verify_nonce( $_POST['um_admin_save_metabox_directory_nonce'], basename( __FILE__ ) ) ) {
return;
}
// validate post type
- if ( $post->post_type != 'um_directory' ) {
+ if ( 'um_directory' !== $post->post_type ) {
return;
}
@@ -1089,15 +1088,13 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
return;
}
- $where = array( 'ID' => $post_id );
-
if ( empty( $_POST['post_title'] ) ) {
+ $where = array( 'ID' => $post_id );
// translators: %s: Directory id.
$_POST['post_title'] = sprintf( __( 'Directory #%s', 'ultimate-member' ), $post_id );
+ $wpdb->update( $wpdb->posts, array( 'post_title' => sanitize_text_field( wp_unslash( $_POST['post_title'] ) ) ), $where );
}
- $wpdb->update( $wpdb->posts, array( 'post_title' => sanitize_text_field( $_POST['post_title'] ) ), $where );
-
do_action( 'um_before_member_directory_save', $post_id );
// save
@@ -1119,17 +1116,17 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
$metadata = UM()->admin()->sanitize_member_directory_meta( $_POST['um_metadata'] );
foreach ( $metadata as $k => $v ) {
- if ( $k == '_um_show_these_users' && trim( $v ) ) {
+ if ( '_um_show_these_users' === $k && trim( $v ) ) {
$v = preg_split( '/[\r\n]+/', $v, -1, PREG_SPLIT_NO_EMPTY );
}
- if ( $k == '_um_exclude_these_users' && trim( $v ) ) {
+ if ( '_um_exclude_these_users' === $k && trim( $v ) ) {
$v = preg_split( '/[\r\n]+/', $v, -1, PREG_SPLIT_NO_EMPTY );
}
if ( strstr( $k, '_um_' ) ) {
- if ( $k === '_um_is_default' ) {
+ if ( '_um_is_default' === $k ) {
$mode = UM()->query()->get_attr( 'mode', $post_id );
@@ -1145,9 +1142,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
foreach ( $posts as $p_id ) {
delete_post_meta( $p_id, '_um_is_default' );
}
-
}
-
}
$v = apply_filters( 'um_member_directory_meta_value_before_save', $v, $k, $post_id );
@@ -1160,14 +1155,13 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
update_post_meta( $post_id, '_um_search_filters_gmt', (int) $_POST['um-gmt-offset'] );
}
-
/**
* Save form metabox
*
* @param $post_id
* @param $post
*/
- function save_metabox_form( $post_id, $post ) {
+ public function save_metabox_form( $post_id, $post ) {
global $wpdb;
// validate nonce
@@ -1177,7 +1171,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
}
// validate post type
- if ( $post->post_type != 'um_form' ) {
+ if ( 'um_form' !== $post->post_type ) {
return;
}
@@ -1187,12 +1181,12 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
return;
}
- $where = array( 'ID' => $post_id );
if ( empty( $_POST['post_title'] ) ) {
+ $where = array( 'ID' => $post_id );
// translators: %s: Form id.
$_POST['post_title'] = sprintf( __( 'Form #%s', 'ultimate-member' ), $post_id );
+ $wpdb->update( $wpdb->posts, array( 'post_title' => sanitize_text_field( wp_unslash( $_POST['post_title'] ) ) ), $where );
}
- $wpdb->update( $wpdb->posts, array( 'post_title' => sanitize_text_field( $_POST['post_title'] ) ), $where );
// save
delete_post_meta( $post_id, '_um_profile_metafields' );
diff --git a/includes/admin/core/class-admin-notices.php b/includes/admin/core/class-admin-notices.php
index c06015dd..72dd29eb 100644
--- a/includes/admin/core/class-admin-notices.php
+++ b/includes/admin/core/class-admin-notices.php
@@ -7,7 +7,6 @@ if ( ! defined( 'ABSPATH' ) ) {
if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
-
/**
* Class Admin_Notices
* @package um\admin\core
@@ -19,16 +18,15 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
*
* @var array
*/
- var $list = array();
-
+ private $list = array();
/**
* Admin_Notices constructor.
*/
- function __construct() {
+ public function __construct() {
add_action( 'admin_init', array( &$this, 'create_languages_folder' ) );
- add_action( 'admin_init', array( &$this, 'create_list' ), 10 );
+ add_action( 'admin_init', array( &$this, 'create_list' ) );
add_action( 'admin_notices', array( &$this, 'render_notices' ), 1 );
add_action( 'wp_ajax_um_dismiss_notice', array( &$this, 'dismiss_notice' ) );
@@ -37,11 +35,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
add_action( 'current_screen', array( &$this, 'create_list_for_screen' ) );
}
-
/**
*
*/
- function create_list() {
+ public function create_list() {
$this->old_extensions_notice();
$this->install_core_page_notice();
$this->exif_extension_notice();
@@ -93,7 +90,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
/**
* @return array
*/
- function get_admin_notices() {
+ public function get_admin_notices() {
return $this->list;
}
@@ -372,7 +369,6 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
);
}
-
/**
* Regarding page setup
*/
@@ -384,9 +380,16 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
foreach ( $pages as $slug => $page_id ) {
$page = get_post( $page_id );
- if ( ! isset( $page->ID ) && in_array( $slug, array_keys( UM()->config()->core_pages ) ) ) {
+ if ( ! isset( $page->ID ) && array_key_exists( $slug, UM()->config()->core_pages ) ) {
+ $url = add_query_arg(
+ array(
+ 'um_adm_action' => 'install_core_pages',
+ '_wpnonce' => wp_create_nonce( 'install_core_pages' ),
+ )
+ );
- ob_start(); ?>
+ ob_start();
+ ?>
-
+
-
+
- add_notice( 'wrong_pages', array(
- 'class' => 'updated',
- 'message' => $message,
- 'dismissible' => true
- ), 20 );
+ $this->add_notice(
+ 'wrong_pages',
+ array(
+ 'class' => 'updated',
+ 'message' => $message,
+ 'dismissible' => true,
+ ),
+ 20
+ );
break;
}
@@ -416,42 +424,46 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
if ( isset( $pages['user'] ) ) {
$test = get_post( $pages['user'] );
if ( isset( $test->post_parent ) && $test->post_parent > 0 ) {
- $this->add_notice( 'wrong_user_page', array(
- 'class' => 'updated',
- 'message' => '' . __( 'Ultimate Member Setup Error: User page can not be a child page.', 'ultimate-member' ) . '
',
- ), 25 );
+ $this->add_notice(
+ 'wrong_user_page',
+ array(
+ 'class' => 'updated',
+ 'message' => '' . esc_html__( 'Ultimate Member Setup Error: User page can not be a child page.', 'ultimate-member' ) . '
',
+ ),
+ 25
+ );
}
}
if ( isset( $pages['account'] ) ) {
$test = get_post( $pages['account'] );
if ( isset( $test->post_parent ) && $test->post_parent > 0 ) {
- $this->add_notice( 'wrong_account_page', array(
- 'class' => 'updated',
- 'message' => '' . __( 'Ultimate Member Setup Error: Account page can not be a child page.', 'ultimate-member' ) . '
',
- ), 30 );
+ $this->add_notice(
+ 'wrong_account_page',
+ array(
+ 'class' => 'updated',
+ 'message' => '' . esc_html__( 'Ultimate Member Setup Error: Account page can not be a child page.', 'ultimate-member' ) . '
',
+ ),
+ 30
+ );
}
}
-
}
}
-
/**
* EXIF library notice
*/
public function exif_extension_notice() {
- $hide_exif_notice = get_option( 'um_hide_exif_notice' );
-
- if ( ! extension_loaded( 'exif' ) && ! $hide_exif_notice ) {
+ if ( ! extension_loaded( 'exif' ) ) {
$this->add_notice(
'exif_disabled',
array(
- 'class' => 'updated',
+ 'class' => 'updated',
// translators: %s: query args.
- 'message' => '' . sprintf( __( 'Exif is not enabled on your server. Mobile photo uploads will not be rotated correctly until you enable the exif extension. Hide this notice', 'ultimate-member' ), add_query_arg( 'um_adm_action', 'um_hide_exif_notice' ) ) . '
',
- ),
- 10
+ 'message' => '' . esc_html__( 'Exif is not enabled on your server. Mobile photo uploads will not be rotated correctly until you enable the exif extension.', 'ultimate-member' ) . '
',
+ 'dismissible' => true,
+ )
);
}
}
@@ -885,7 +897,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
}
$global_role = get_option( 'default_role' ); // WP Global settings
- $caps = get_role( $global_role )->capabilities;
+ $global_role = get_role( $global_role );
+ $caps = ( null !== $global_role && ! empty( $global_role->capabilities ) ) ? $global_role->capabilities : array();
foreach ( array_keys( $caps ) as $cap ) {
if ( in_array( $cap, $arr_banned_caps, true ) ) {
ob_start();
@@ -910,7 +923,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
$um_global_role = UM()->options()->get( 'register_role' ); // UM Settings Global settings
if ( ! empty( $um_global_role ) ) {
- $caps = get_role( $um_global_role )->capabilities;
+ $um_global_role = get_role( $um_global_role );
+ $caps = ( null !== $um_global_role && ! empty( $um_global_role->capabilities ) ) ? $um_global_role->capabilities : array();
foreach ( array_keys( $caps ) as $cap ) {
if ( in_array( $cap, $arr_banned_caps, true ) ) {
ob_start();
@@ -966,7 +980,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Notices' ) ) {
continue;
}
- $caps = get_role( $role )->capabilities;
+ $role = get_role( $role );
+ $caps = ( null !== $role && ! empty( $role->capabilities ) ) ? $role->capabilities : array();
foreach ( array_keys( $caps ) as $cap ) {
if ( in_array( $cap, $arr_banned_caps, true ) ) {
$content .= '
' . get_the_title( $form_id ) . ' contains administrative role.';
diff --git a/includes/admin/core/class-admin-settings.php b/includes/admin/core/class-admin-settings.php
index d8a7cb4e..3a1bb03b 100644
--- a/includes/admin/core/class-admin-settings.php
+++ b/includes/admin/core/class-admin-settings.php
@@ -689,6 +689,9 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
'use_um_gravatar_default_image' => array(
'sanitize' => 'bool',
),
+ 'toggle_password' => array(
+ 'sanitize' => 'bool',
+ ),
'require_strongpass' => array(
'sanitize' => 'bool',
),
@@ -1088,6 +1091,12 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
'tooltip' => __( 'Do you want to use the plugin default avatar instead of the gravatar default photo (If the user did not upload a custom profile photo / avatar)', 'ultimate-member' ),
'conditional' => array( 'use_um_gravatar_default_builtin_image', '=', 'default' ),
),
+ array(
+ 'id' => 'toggle_password',
+ 'type' => 'checkbox',
+ 'label' => __( 'Show/hide password button', 'ultimate-member' ),
+ 'tooltip' => __( 'Enable visibility for show/hide password button for the password field-type.', 'ultimate-member' ),
+ ),
array(
'id' => 'require_strongpass',
'type' => 'checkbox',
@@ -3072,10 +3081,17 @@ if ( ! class_exists( 'um\admin\core\Admin_Settings' ) ) {
*/
public function settings_override_templates_tab() {
$um_check_version = get_transient( 'um_check_template_versions' );
+
+ $check_url = add_query_arg(
+ array(
+ 'um_adm_action' => 'check_templates_version',
+ '_wpnonce' => wp_create_nonce( 'check_templates_version' ),
+ )
+ );
?>
-
+
get_var(
FROM {$wpdb->options}
WHERE option_name LIKE 'um_cache_userdata_%'"
);
+
+$url_user_cache = add_query_arg(
+ array(
+ 'um_adm_action' => 'user_cache',
+ '_wpnonce' => wp_create_nonce( 'user_cache' ),
+ )
+);
+
+$url_user_status_cache = add_query_arg(
+ array(
+ 'um_adm_action' => 'user_status_cache',
+ '_wpnonce' => wp_create_nonce( 'user_status_cache' ),
+ )
+);
?>
-
+
-
+
-
+
diff --git a/includes/admin/templates/dashboard/purge.php b/includes/admin/templates/dashboard/purge.php
index b1facb25..5e80926b 100644
--- a/includes/admin/templates/dashboard/purge.php
+++ b/includes/admin/templates/dashboard/purge.php
@@ -1,7 +1,15 @@
- 'purge_temp',
+ '_wpnonce' => wp_create_nonce( 'purge_temp' ),
+ )
+);
+
if ( $this->dir_size( 'temp' ) > 0.1 ) { ?>
@@ -12,8 +20,8 @@ if ( $this->dir_size( 'temp' ) > 0.1 ) { ?>
-
-
+
+
diff --git a/includes/admin/templates/dashboard/upgrade-request.php b/includes/admin/templates/dashboard/upgrade-request.php
index b5061d8e..0d10fd17 100644
--- a/includes/admin/templates/dashboard/upgrade-request.php
+++ b/includes/admin/templates/dashboard/upgrade-request.php
@@ -1,9 +1,19 @@
-
+ 'manual_upgrades_request',
+ '_wpnonce' => wp_create_nonce( 'manual_upgrades_request' ),
+ )
+);
+?>
-
+
-
-
+
+
-
\ No newline at end of file
+
diff --git a/includes/admin/templates/extensions.php b/includes/admin/templates/extensions.php
index e4ec4052..be183050 100644
--- a/includes/admin/templates/extensions.php
+++ b/includes/admin/templates/extensions.php
@@ -163,6 +163,13 @@ $premium['profile-tabs'] = array(
'desc' => 'Add custom tabs to profiles',
);
+$premium['stripe'] = array(
+ 'url' => 'https://ultimatemember.com/extensions/stripe/',
+ 'img' => 'stripe.png',
+ 'name' => 'Stripe',
+ 'desc' => 'Sell paid memberships to access your website via Stripe subscriptions',
+);
+
$free['jobboardwp'] = array(
'url' => 'https://wordpress.org/plugins/um-jobboardwp',
'img' => 'jobboardwp.png',
diff --git a/includes/class-config.php b/includes/class-config.php
index 4e7eb202..d7ce85bb 100644
--- a/includes/class-config.php
+++ b/includes/class-config.php
@@ -520,6 +520,7 @@ if ( ! class_exists( 'um\Config' ) ) {
'use_gravatars' => 0,
'use_um_gravatar_default_builtin_image' => 'default',
'use_um_gravatar_default_image' => 0,
+ 'toggle_password' => false,
'require_strongpass' => 0,
'password_min_chars' => 8,
'password_max_chars' => 30,
diff --git a/includes/core/class-account.php b/includes/core/class-account.php
index ce4b5a15..1b016584 100644
--- a/includes/core/class-account.php
+++ b/includes/core/class-account.php
@@ -180,8 +180,7 @@ if ( ! class_exists( 'um\core\Account' ) ) {
*
* @since 1.3.x
* @hook um_account_shortcode_args_filter
- * @deprecated 2.6.8
- * @todo Fully deprecate since 2.6.9. Use `shortcode_atts_ultimatemember_account` instead.
+ * @deprecated 2.6.9
*
* @param {array} $args Shortcode arguments.
*
@@ -194,13 +193,33 @@ if ( ! class_exists( 'um\core\Account' ) ) {
* }
* add_filter( 'um_account_shortcode_args_filter', 'my_account_shortcode_args' );
*/
- $args = apply_filters( 'um_account_shortcode_args_filter', $args );
+ $args = apply_filters_deprecated( 'um_account_shortcode_args_filter', array( $args ), '2.6.9', 'shortcode_atts_ultimatemember_account' );
$account_hash = md5( wp_json_encode( $args ) );
- if ( in_array( $account_hash, $this->account_exist, true ) ) {
+
+ /**
+ * Filters variable for enable singleton shortcode loading on the same page.
+ * Note: Set it to `false` if you don't need to render the same form twice or more on the same page.
+ *
+ * @since 2.6.9
+ *
+ * @hook um_ultimatemember_account_shortcode_disable_singleton
+ *
+ * @param {bool} $disable Disabled singleton. By default, it's `true`.
+ * @param {array} $args Shortcode arguments.
+ *
+ * @return {bool} Disabled singleton or not.
+ *
+ * @example Turn off ability to use ultimatemember_account shortcode twice.
+ * add_filter( 'um_ultimatemember_account_shortcode_disable_singleton', '__return_false' );
+ */
+ $disable_singleton_shortcode = apply_filters( 'um_ultimatemember_account_shortcode_disable_singleton', true, $args );
+ if ( false === $disable_singleton_shortcode && in_array( $account_hash, $this->account_exist, true ) ) {
return '';
}
+ ob_start();
+
if ( ! empty( $args['tab'] ) ) {
if ( 'account' === $args['tab'] ) {
diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php
index a9510b69..c901eeec 100644
--- a/includes/core/class-fields.php
+++ b/includes/core/class-fields.php
@@ -2437,9 +2437,17 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$field_name = $key . $form_suffix;
$field_value = $this->field_value( $key, $default, $data );
- $output .= '
+ if ( UM()->options()->get( 'toggle_password' ) ) {
+ $output .= '
+
+
+
+ ';
+ } else {
+ $output .= '
';
+ }
if ( $this->is_error( $key ) ) {
$output .= $this->field_error( $this->show_error( $key ) );
@@ -2467,9 +2475,17 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$field_name = $key . $form_suffix;
$field_value = $this->field_value( $key, $default, $data );
- $output .= '
+ if ( UM()->options()->get( 'toggle_password' ) ) {
+ $output .= '
+
+
+
+ ';
+ } else {
+ $output .= '
';
+ }
if ( $this->is_error( $key ) ) {
$output .= $this->field_error( $this->show_error( $key ) );
@@ -2507,10 +2523,17 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
}
$field_value = $this->field_value( $key, $default, $data );
+ if ( UM()->options()->get( 'toggle_password' ) ) {
+ $output .= '
+
+
+
+ ';
+ } else {
+ $output .= '
- $output .= '
-
- ';
+ ';
+ }
if ( $this->is_error( $key ) ) {
$output .= $this->field_error( $this->show_error( $key ) );
@@ -2555,7 +2578,11 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
$placeholder = sprintf( __( 'Confirm %s', 'ultimate-member' ), $data['label'] );
}
- $output .= '';
+ if ( UM()->options()->get( 'toggle_password' ) ) {
+ $output .= '
';
+ } else {
+ $output .= '';
+ }
$output .= '';
diff --git a/includes/core/class-permalinks.php b/includes/core/class-permalinks.php
index 59f9e6cd..0bbb47bf 100644
--- a/includes/core/class-permalinks.php
+++ b/includes/core/class-permalinks.php
@@ -482,13 +482,20 @@ if ( ! class_exists( 'um\core\Permalinks' ) ) {
* @param $action
* @param $subaction
*
+ * @deprecated 2.6.9
+ *
* @return mixed|string|void
*/
public function admin_act_url( $action, $subaction ) {
- $url = $this->get_current_url();
- $url = add_query_arg( 'um_adm_action', $action, $url );
- $url = add_query_arg( 'sub', $subaction, $url );
- $url = add_query_arg( 'user_id', um_user( 'ID' ), $url );
+ _deprecated_function( __METHOD__, '2.6.9' );
+ $url = add_query_arg(
+ array(
+ 'um_adm_action' => $action,
+ 'sub' => $subaction,
+ 'user_id' => um_user( 'ID' ),
+ '_wpnonce' => wp_create_nonce( $action ),
+ )
+ );
return $url;
}
diff --git a/includes/core/class-plugin-updater.php b/includes/core/class-plugin-updater.php
index 677f5f8b..f9961135 100644
--- a/includes/core/class-plugin-updater.php
+++ b/includes/core/class-plugin-updater.php
@@ -21,7 +21,7 @@ if ( ! class_exists( 'um\core\Plugin_Updater' ) ) {
function __construct() {
//cron request to UM()->store_url;
add_action( 'um_daily_scheduled_events', array( &$this, 'um_checklicenses' ) );
-
+
// clean update plugin cache
add_action( 'upgrader_process_complete', array( &$this, 'clean_update_plugins_cache' ), 20, 2 );
@@ -56,10 +56,10 @@ if ( ! class_exists( 'um\core\Plugin_Updater' ) ) {
return $should_update;
}
-
+
/**
* This action is documented in wp-admin/includes/class-wp-upgrader.php
- *
+ *
* @see file /wp-admin/includes/class-plugin-upgrader.php method bulk_upgrade()
* @since 2.1.1 [2019-11-15]
*
@@ -71,118 +71,113 @@ if ( ! class_exists( 'um\core\Plugin_Updater' ) ) {
wp_clean_plugins_cache( true );
}
}
-
/**
* Get all paid UM extensions
*
* @return array
*/
- function get_active_plugins() {
+ public function get_active_plugins() {
$paid_extensions = array(
- 'um-bbpress/um-bbpress.php' => array(
+ 'um-bbpress/um-bbpress.php' => array(
'key' => 'bbpress',
'title' => 'bbPress',
),
- 'um-followers/um-followers.php' => array(
+ 'um-followers/um-followers.php' => array(
'key' => 'followers',
'title' => 'Followers',
),
- 'um-friends/um-friends.php' => array(
+ 'um-friends/um-friends.php' => array(
'key' => 'friends',
'title' => 'Friends',
),
- 'um-groups/um-groups.php' => array(
+ 'um-groups/um-groups.php' => array(
'key' => 'groups',
'title' => 'Groups',
),
- 'um-instagram/um-instagram.php' => array(
+ 'um-instagram/um-instagram.php' => array(
'key' => 'instagram',
'title' => 'Instagram',
),
- 'um-mailchimp/um-mailchimp.php' => array(
+ 'um-mailchimp/um-mailchimp.php' => array(
'key' => 'mailchimp',
'title' => 'MailChimp',
),
- 'um-messaging/um-messaging.php' => array(
+ 'um-messaging/um-messaging.php' => array(
'key' => 'messaging',
'title' => 'Private Messages',
),
- 'um-mycred/um-mycred.php' => array(
+ 'um-mycred/um-mycred.php' => array(
'key' => 'mycred',
'title' => 'myCRED',
),
- 'um-notices/um-notices.php' => array(
+ 'um-notices/um-notices.php' => array(
'key' => 'notices',
'title' => 'Notices',
),
- 'um-notifications/um-notifications.php' => array(
+ 'um-notifications/um-notifications.php' => array(
'key' => 'notifications',
'title' => 'Real-time Notifications',
),
- 'um-profile-completeness/um-profile-completeness.php' => array(
+ 'um-profile-completeness/um-profile-completeness.php' => array(
'key' => 'profile_completeness',
'title' => 'Profile Completeness',
),
- 'um-reviews/um-reviews.php' => array(
+ 'um-reviews/um-reviews.php' => array(
'key' => 'reviews',
'title' => 'User Reviews',
),
- 'um-social-activity/um-social-activity.php' => array(
+ 'um-social-activity/um-social-activity.php' => array(
'key' => 'activity',
'title' => 'Social Activity',
),
- 'um-social-login/um-social-login.php' => array(
+ 'um-social-login/um-social-login.php' => array(
'key' => 'social_login',
'title' => 'Social Login',
),
- 'um-user-tags/um-user-tags.php' => array(
+ 'um-user-tags/um-user-tags.php' => array(
'key' => 'user_tags',
'title' => 'User Tags',
),
- 'um-verified-users/um-verified-users.php' => array(
+ 'um-verified-users/um-verified-users.php' => array(
'key' => 'verified',
'title' => 'Verified Users',
),
- 'um-woocommerce/um-woocommerce.php' => array(
+ 'um-woocommerce/um-woocommerce.php' => array(
'key' => 'woocommerce',
'title' => 'WooCommerce',
),
- 'um-user-photos/um-user-photos.php' => array(
+ 'um-user-photos/um-user-photos.php' => array(
'key' => 'user_photos',
'title' => 'User Photos',
),
- 'um-private-content/um-private-content.php' => array(
+ 'um-private-content/um-private-content.php' => array(
'key' => 'private_content',
'title' => 'Private Content',
),
- 'um-user-bookmarks/um-user-bookmarks.php' => array(
+ 'um-user-bookmarks/um-user-bookmarks.php' => array(
'key' => 'user_bookmarks',
'title' => 'User Bookmarks',
),
- 'um-unsplash/um-unsplash.php' => array(
+ 'um-unsplash/um-unsplash.php' => array(
'key' => 'unsplash',
'title' => 'Unsplash',
),
- 'um-user-locations/um-user-locations.php' => array(
+ 'um-user-locations/um-user-locations.php' => array(
'key' => 'user_locations',
'title' => 'User Locations',
),
- 'um-profile-tabs/um-profile-tabs.php' => array(
+ 'um-profile-tabs/um-profile-tabs.php' => array(
'key' => 'profile_tabs',
'title' => 'Profile tabs',
),
- 'um-user-notes/um-user-notes.php' => array(
+ 'um-user-notes/um-user-notes.php' => array(
'key' => 'user_notes',
'title' => 'User Notes',
),
- 'um-frontend-posting/um-frontend-posting.php' => array(
- 'key' => 'frontend_posting',
- 'title' => 'Frontend Posting',
- ),
- 'um-google-authenticator/um-google-authenticator.php' => array(
- 'key' => 'google_authenticator',
- 'title' => 'Google Authenticator',
+ 'um-stripe/um-stripe.php' => array(
+ 'key' => 'stripe',
+ 'title' => 'Stripe',
),
);
diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php
index 6c3f1432..d65b304e 100644
--- a/includes/core/class-shortcodes.php
+++ b/includes/core/class-shortcodes.php
@@ -603,21 +603,23 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
*/
public function ultimatemember( $args = array() ) {
/**
- * Filters variable for disable singleton shortcode loading on the same page.
- * Note: Set it to `true` if you need to render the same form twice or more on the same page.
+ * Filters variable for enable singleton shortcode loading on the same page.
+ * Note: Set it to `false` if you don't need to render the same form twice or more on the same page.
*
* @since 2.6.8
+ * @since 2.6.9 $disable argument set to `true` by default
+ *
* @hook um_ultimatemember_shortcode_disable_singleton
*
- * @param {bool} $disable Disabled singleton. By default, it's `false`.
+ * @param {bool} $disable Disabled singleton. By default, it's `true`.
* @param {array} $args Shortcode arguments.
*
* @return {bool} Disabled singleton or not.
*
- * @example Turn on ability to use ultimatemember shortcode twice.
- * add_filter( 'um_ultimatemember_shortcode_disable_singleton', '__return_true' );
+ * @example Turn off ability to use ultimatemember shortcode twice.
+ * add_filter( 'um_ultimatemember_shortcode_disable_singleton', '__return_false' );
*/
- $disable_singleton_shortcode = apply_filters( 'um_ultimatemember_shortcode_disable_singleton', false, $args );
+ $disable_singleton_shortcode = apply_filters( 'um_ultimatemember_shortcode_disable_singleton', true, $args );
if ( false === $disable_singleton_shortcode ) {
if ( isset( $args['form_id'] ) ) {
$id = $args['form_id'];
diff --git a/includes/core/um-actions-account.php b/includes/core/um-actions-account.php
index 2bd2366f..9d4c4e02 100644
--- a/includes/core/um-actions-account.php
+++ b/includes/core/um-actions-account.php
@@ -1,8 +1,8 @@
-
*/
$redirect_url = apply_filters( 'um_delete_account_redirect_url', um_user( 'delete_redirect_url' ), $user_id );
- exit( wp_redirect( $redirect_url ) );
+ um_safe_redirect( $redirect_url );
} else {
um_redirect_home();
}
@@ -588,55 +588,71 @@ function um_after_account_privacy( $args ) {
-
+
- get_row(
- "SELECT ID
- FROM $wpdb->posts
- WHERE post_author = $user_id AND
- post_type = 'user_request' AND
- post_name = 'export_personal_data' AND
- post_status = 'request-completed'
- ORDER BY ID DESC
- LIMIT 1",
- ARRAY_A );
+ get_row(
+ $wpdb->prepare(
+ "SELECT ID
+ FROM $wpdb->posts
+ WHERE post_author = %d AND
+ post_type = 'user_request' AND
+ post_name = 'export_personal_data' AND
+ post_status = 'request-completed'
+ ORDER BY ID DESC
+ LIMIT 1",
+ $user_id
+ ),
+ ARRAY_A
+ );
if ( ! empty( $completed ) ) {
$exports_url = wp_privacy_exports_url();
echo '' . esc_html__( 'You could download your previous data:', 'ultimate-member' ) . '
';
- echo '' . esc_html__( 'Download Personal Data', 'ultimate-member' ) . '';
+ echo '' . esc_html__( 'Download Personal Data', 'ultimate-member' ) . '';
echo '' . esc_html__( 'You could send a new request for an export of personal your data.', 'ultimate-member' ) . '
';
}
$pending = $wpdb->get_row(
- "SELECT ID, post_status
- FROM $wpdb->posts
- WHERE post_author = $user_id AND
- post_type = 'user_request' AND
- post_name = 'export_personal_data' AND
- post_status != 'request-completed'
- ORDER BY ID DESC
- LIMIT 1",
- ARRAY_A );
+ $wpdb->prepare(
+ "SELECT ID, post_status
+ FROM $wpdb->posts
+ WHERE post_author = %d AND
+ post_type = 'user_request' AND
+ post_name = 'export_personal_data' AND
+ post_status != 'request-completed'
+ ORDER BY ID DESC
+ LIMIT 1",
+ $user_id
+ ),
+ ARRAY_A
+ );
- if ( ! empty( $pending ) && $pending['post_status'] == 'request-pending' ) {
+ if ( ! empty( $pending ) && 'request-pending' === $pending['post_status'] ) {
echo '' . esc_html__( 'A confirmation email has been sent to your email. Click the link within the email to confirm your export request.', 'ultimate-member' ) . '
';
- } elseif ( ! empty( $pending ) && $pending['post_status'] == 'request-confirmed' ) {
+ } elseif ( ! empty( $pending ) && 'request-confirmed' === $pending['post_status'] ) {
echo '' . esc_html__( 'The administrator has not yet approved downloading the data. Please expect an email with a link to your data.', 'ultimate-member' ) . '
';
} else {
- if ( UM()->account()->current_password_is_required( 'privacy_download_data' ) ) { ?>
-
+ if ( UM()->account()->current_password_is_required( 'privacy_download_data' ) ) {
+ ?>
-
+ options()->get( 'toggle_password' ) ) { ?>
+
+
+
+
+
+
+
@@ -664,22 +680,27 @@ function um_after_account_privacy( $args ) {
-
+
' . esc_html__( 'A confirmation email has been sent to your email. Click the link within the email to confirm your deletion request.', 'ultimate-member' ) . '
';
- } elseif ( ! empty( $pending ) && $pending['post_status'] == 'request-confirmed' ) {
+ } elseif ( ! empty( $pending ) && 'request-confirmed' === $pending['post_status'] ) {
echo '' . esc_html__( 'The administrator has not yet approved deleting your data. Please expect an email with a link to your data.', 'ultimate-member' ) . '
';
} else {
- if ( UM()->account()->current_password_is_required( 'privacy_erase_data' ) ) { ?>
-
+ if ( UM()->account()->current_password_is_required( 'privacy_erase_data' ) ) {
+ ?>