10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-06-05 15:09:37 +09:00
Code Issues Packages Projects Releases Wiki Activity

- changed clear PHP filter_input to sanitaizing functions;

Browse Source
This commit is contained in:
Mykyta Synelnikov
2023-04-24 03:30:56 +03:00
parent c7efb04288
commit 76dba58342
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-files.php
+2 -2
View File
@@ -339,8 +339,8 @@ if ( ! class_exists( 'um\core\Files' ) ) {
$user_id = empty( $_REQUEST['user_id'] ) ? get_current_user_id() : absint( $_REQUEST['user_id'] );
UM()->fields()->set_id = filter_input( INPUT_POST, 'set_id', FILTER_SANITIZE_NUMBER_INT );
UM()->fields()->set_mode = filter_input( INPUT_POST, 'set_mode', FILTER_SANITIZE_STRING );
UM()->fields()->set_id = isset( $_POST['set_id'] ) ? absint( $_POST['set_id'] ) : null;
UM()->fields()->set_mode = isset( $_POST['set_mode'] ) ? sanitize_text_field( $_POST['set_mode'] ) : null;
if ( UM()->fields()->set_mode != 'register' && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
$ret['error'] = esc_js( __( 'You have no permission to edit this user', 'ultimate-member' ) );
includes/core/class-member-directory.php
+4 -1
View File
@@ -634,13 +634,16 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) {
if ( isset( $_GET[ 'filter_' . $attrs['parent_dropdown_relationship'] . '_' . $unique_hash ] ) ) {
$_POST['parent_option_name'] = $attrs['parent_dropdown_relationship'];
$_POST['parent_option'] = explode( '||', filter_input( INPUT_GET, 'filter_' . $attrs['parent_dropdown_relationship'] . '_' . $unique_hash ) );
$parent_option_value = sanitize_text_field( $_GET[ 'filter_' . $attrs['parent_dropdown_relationship'] . '_' . $unique_hash ] );
$_POST['parent_option'] = explode( '||', $parent_option_value );
}
}
$attrs['custom_dropdown_options_source'] = wp_unslash( $attrs['custom_dropdown_options_source'] );
$ajax_source = apply_filters( "um_custom_dropdown_options_source__{$filter}", $attrs['custom_dropdown_options_source'], $attrs );
$custom_dropdown .= ' data-um-ajax-source="' . esc_attr( $ajax_source ) . '" ';
$attrs['options'] = UM()->fields()->get_options_from_callback( $attrs, $attrs['type'] );