- fixed some styles;

- fixed modal fonticons close;
- fixed vulnerability with sanitizing $_POST;

assets/css/um-modal.css

@@ -181,6 +181,10 @@
 	text-decoration: none !important;
 }
 
+a.um-modal-btn:visited {
+	color: #fff;
+}
+
 .um-modal-btn:hover {
 	background: #44b0ec;
 	color: #fff;

includes/admin/assets/css/um-admin-forms.css

@@ -14,6 +14,11 @@
     padding: 0 0 15px 0;
 }
 
+.um-form-table.um-top-label .um-forms-line td label {
+    margin: 0 0 5px 0;
+    display: inline-block;
+}
+
 .um-form-table.um-top-label .um-forms-line[data-field_type="icon"] td label {
     width: 100%;
     display: block;

includes/admin/assets/js/um-admin-forms.js

@@ -139,6 +139,25 @@ jQuery(document).ready( function() {
 		um_add_same_page_log( field_key, wp.i18n.__( 'Your upgrade was crashed, please contact with support', 'ultimate-member' ) );
 	}
 
+	/**
+	 * Sortable items
+	 */
+	jQuery('.um-sortable-items-field').sortable({
+		items:                  '.um-sortable-item',
+		connectWith:            '.um-admin-drag-col,.um-admin-drag-group',
+		forcePlaceholderSize:   true,
+		update: function( event, ui ) {
+			var sortable_value = [];
+			jQuery(this).find('li').each( function() {
+				if ( jQuery(this).hasClass( 'um-hidden-item' ) ) {
+					return;
+				}
+				sortable_value.push( jQuery(this).data('tab-id') );
+			});
+
+			jQuery(this).siblings('.um-sortable-items-value' ).val( sortable_value.join( ',' ) );
+		}
+	});
 
 
 	/**

includes/admin/assets/js/um-admin-modal.js

@@ -411,12 +411,12 @@ jQuery(document).ready(function() {
 	jQuery(document.body).on('click', 'span.um-admin-icon-clear', function(){
 		var element = jQuery(this).parents('p');
 		jQuery('#UM_fonticons a.um-admin-modal-back').attr('data-code', '');
-		element.find('input[type=hidden]').val('');
-		element.find('.um-admin-icon-value').html('No Icon');
+		element.find('input[type="hidden"]').val('');
+		element.find('.um-admin-icon-value').html( wp.i18n.__( 'No Icon', 'ultimate-member' ) );
 
 		element = jQuery(this).parents('td');
-		element.find('input[type=hidden]').val('');
-		element.find('.um-admin-icon-value').html('No Icon');
+		element.find('input[type="hidden"]').val('');
+		element.find('.um-admin-icon-value').html( wp.i18n.__( 'No Icon', 'ultimate-member' ) );
 		jQuery(this).hide();
 	});
 	
@@ -424,7 +424,7 @@ jQuery(document).ready(function() {
 		search font icons
 	**/
 	jQuery(document.body).on('keyup blur', '#_icon_search', function(){
-		if ( jQuery(this).val().toLowerCase() != '' ) {
+		if ( jQuery(this).val().toLowerCase() !== '' ) {
 			jQuery('.um-admin-icons span').hide();
 			jQuery('.um-admin-icons span[data-code*="'+jQuery(this).val().toLowerCase()+'"]').show();
 		} else {

includes/admin/core/class-admin-enqueue.php

@@ -270,7 +270,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Enqueue' ) ) {
 			wp_register_style( 'um_admin_modal', $this->css_url . 'um-admin-modal.css', array( 'wp-color-picker' ), ultimatemember_version );
 			wp_enqueue_style( 'um_admin_modal' );
 
-			wp_register_script( 'um_admin_modal', $this->js_url . 'um-admin-modal.js', array( 'jquery', 'editor', 'wp-util', 'wp-color-picker', 'wp-tinymce' ), ultimatemember_version, true );
+			wp_register_script( 'um_admin_modal', $this->js_url . 'um-admin-modal.js', array( 'jquery', 'editor', 'wp-util', 'wp-color-picker', 'wp-tinymce', 'wp-i18n' ), ultimatemember_version, true );
 			wp_enqueue_script( 'um_admin_modal' );
 		}
 

includes/admin/core/class-admin-metabox.php

@@ -20,6 +20,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 		 */
 		private $form_nonce_added = false;
 		private $directory_nonce_added = false;
+		private $custom_nonce_added = false;
 
 
 		/**
@@ -787,7 +788,10 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 			$path = str_replace('}','', $path );
 
 			include_once $path . 'includes/admin/templates/'. $box['id'] . '.php';
-			wp_nonce_field( basename( __FILE__ ), 'um_admin_save_metabox_custom_nonce' );
+			if ( ! $this->custom_nonce_added ) {
+				$this->custom_nonce_added = true;
+				wp_nonce_field( basename( __FILE__ ), 'um_admin_save_metabox_custom_nonce' );
+			}
 		}
 
 

includes/admin/core/class-admin-upgrade.php

@@ -353,7 +353,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Upgrade' ) ) {
 				exit('');
 			} else {
 				ob_start();
-				include_once $this->packages_dir . DIRECTORY_SEPARATOR . $_POST['pack'] . DIRECTORY_SEPARATOR . 'init.php';
+				include_once $this->packages_dir . DIRECTORY_SEPARATOR . sanitize_text_field( $_POST['pack'] ) . DIRECTORY_SEPARATOR . 'init.php';
 				ob_get_flush();
 				exit;
 			}

includes/admin/templates/modal/fonticons.php

@@ -11,7 +11,7 @@
 
 	<div class="um-admin-modal-foot">
 		<a href="javascript:void(0);" class="button-primary um-admin-modal-back" data-code=""><?php _e( 'Finish', 'ultimate-member' ) ?></a>
-		<a href="javascript:void(0);" class="button um-admin-modal-back um-admin-modal-cancel"><?php _e( 'Cancel', 'ultimate-member' ) ?></a>
+		<a href="javascript:void(0);" class="button um-admin-modal-back um-admin-modal-cancel" data-action="UM_remove_modal"><?php _e( 'Cancel', 'ultimate-member' ) ?></a>
 	</div>
 
 </div>