From 67420b11b0b26a92181fdab9b66785f37429b0ef Mon Sep 17 00:00:00 2001 From: nikitasinelnikov Date: Fri, 4 Dec 2020 00:10:20 +0200 Subject: [PATCH] - Fixed: Vulnerability with timestamp field on UM Forms - changed readme; --- includes/core/class-fields.php | 2 +- includes/core/class-gdpr.php | 4 +--- includes/core/class-user.php | 2 +- includes/core/um-actions-global.php | 2 -- includes/core/um-actions-register.php | 6 ++++++ readme.txt | 6 +++++- templates/register.php | 2 +- ultimate-member.php | 2 +- 8 files changed, 16 insertions(+), 10 deletions(-) diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php index 05aed232..33ed449a 100644 --- a/includes/core/class-fields.php +++ b/includes/core/class-fields.php @@ -2366,7 +2366,7 @@ if ( ! class_exists( 'um\core\Fields' ) ) { $output .= '
get_atts( $key, $classes, $conditional, $data ) . '>'; if ( isset( $data['label'] ) ) { - + $data['label'] = __( $data['label'], 'ultimate-member' ); $output .= $this->field_label( sprintf( __( 'Confirm %s', 'ultimate-member' ), $data['label'] ), $key, $data ); diff --git a/includes/core/class-gdpr.php b/includes/core/class-gdpr.php index 7f12c626..28be93ca 100644 --- a/includes/core/class-gdpr.php +++ b/includes/core/class-gdpr.php @@ -81,9 +81,7 @@ if ( ! class_exists( 'um\core\GDPR' ) ) { */ function email_registration_data( $submitted ) { if ( ! empty( $submitted['use_gdpr_agreement'] ) ) { - $timestamp = ! empty( $submitted['timestamp'] ) ? $submitted['timestamp'] : $submitted['use_gdpr_agreement']; - - $submitted['GDPR Applied'] = date( "d M Y H:i", $timestamp ); + $submitted['GDPR Applied'] = date( "d M Y H:i", $submitted['use_gdpr_agreement'] ); unset( $submitted['use_gdpr_agreement'] ); } diff --git a/includes/core/class-user.php b/includes/core/class-user.php index 8efac0f6..08b31861 100644 --- a/includes/core/class-user.php +++ b/includes/core/class-user.php @@ -1228,7 +1228,7 @@ if ( ! class_exists( 'um\core\User' ) ) { * Set last login for new registered users */ function set_last_login() { - update_user_meta( $this->id, '_um_last_login', current_time( 'timestamp' ) ); + update_user_meta( $this->id, '_um_last_login', current_time( 'timestamp' ) ); } diff --git a/includes/core/um-actions-global.php b/includes/core/um-actions-global.php index e87db7e2..a01cf312 100644 --- a/includes/core/um-actions-global.php +++ b/includes/core/um-actions-global.php @@ -24,8 +24,6 @@ function um_add_security_checks( $args ) { return; } ?> - -

diff --git a/includes/core/um-actions-register.php b/includes/core/um-actions-register.php index fb1e9a24..7ef63bd5 100644 --- a/includes/core/um-actions-register.php +++ b/includes/core/um-actions-register.php @@ -386,6 +386,12 @@ function um_submit_form_register( $args ) { } $args['submitted'] = array_merge( $args['submitted'], $credentials ); + + // set timestamp + $timestamp = current_time( 'timestamp' ); + $args['submitted']['timestamp'] = $timestamp; + $args['timestamp'] = $timestamp; + $args = array_merge( $args, $credentials ); //get user role from global or form's settings diff --git a/readme.txt b/readme.txt index 3f0f480d..a9620398 100644 --- a/readme.txt +++ b/readme.txt @@ -6,7 +6,7 @@ Donate link: Tags: community, member, membership, user-profile, user-registration Requires PHP: 5.6 Requires at least: 5.0 -Tested up to: 5.5.1 +Tested up to: 5.6 Stable tag: 2.1.12 License: GNU Version 2 or Any Later Version License URI: http://www.gnu.org/licenses/gpl-3.0.txt @@ -167,6 +167,10 @@ The plugin works with popular caching plugins by automatically excluding Ultimat - Fixed: Upgrade process on websites where a hosting locks the frequent AJAX requests (added default JS throttle between requests) - Fixed: Getting page content of the GDPR privacy policies - Fixed: Password strength validation for Unicode symbols + - Fixed: Issue with apostrophe options in the multiselect/checkbox fields (#689) + - Fixed: Translation for Password field's label + - Fixed: Download Personal Data URL + - Fixed: Vulnerability with timestamp field on UM Forms * Tweaks: diff --git a/templates/register.php b/templates/register.php index 5ebf9e27..c0c445b3 100644 --- a/templates/register.php +++ b/templates/register.php @@ -135,7 +135,7 @@ if ( ! is_user_logged_in() ) { * } * ?> */ - do_action( "um_after_form", $args ); ?> + do_action( 'um_after_form', $args ); ?> diff --git a/ultimate-member.php b/ultimate-member.php index ac456030..2af25d89 100644 --- a/ultimate-member.php +++ b/ultimate-member.php @@ -3,7 +3,7 @@ Plugin Name: Ultimate Member Plugin URI: http://ultimatemember.com/ Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress -Version: 2.1.13-beta1 +Version: 2.1.13-rc.1 Author: Ultimate Member Author URI: http://ultimatemember.com/ Text Domain: ultimate-member