diff --git a/includes/core/class-password.php b/includes/core/class-password.php index 40bfea78..c08fbe0b 100644 --- a/includes/core/class-password.php +++ b/includes/core/class-password.php @@ -219,14 +219,9 @@ if ( ! class_exists( 'um\core\Password' ) ) { */ public function is_reset_request() { // phpcs:ignore WordPress.Security.NonceVerification -- already verified here - if ( isset( $_POST['_um_password_reset'] ) && 1 === absint( $_POST['_um_password_reset'] ) ) { - return true; - } - - return false; + return ! empty( $_POST['_um_password_reset'] ); } - /** * Check if a legitimate password change request is in action * @@ -234,17 +229,19 @@ if ( ! class_exists( 'um\core\Password' ) ) { * * @return bool */ - function is_change_request() { - if ( isset( $_POST['_um_account'] ) == 1 && isset( $_POST['_um_account_tab'] ) && sanitize_key( $_POST['_um_account_tab'] ) === 'password' ) { + public function is_change_request() { + // phpcs:ignore WordPress.Security.NonceVerification -- already verified here + if ( ! empty( $_POST['_um_account'] ) && isset( $_POST['_um_account_tab'] ) && 'password' === sanitize_key( $_POST['_um_account_tab'] ) ) { return true; - } elseif ( isset( $_POST['_um_password_change'] ) && $_POST['_um_password_change'] == 1 ) { + } + + if ( ! empty( $_POST['_um_password_change'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification -- already verified here return true; } return false; } - /** * Password page form */ @@ -483,7 +480,6 @@ if ( ! class_exists( 'um\core\Password' ) ) { exit; } - /** * Error handler: changing password * @@ -496,7 +492,7 @@ if ( ! class_exists( 'um\core\Password' ) ) { wp_die( esc_html__( 'Hello, spam bot!', 'ultimate-member' ) ); } - if ( isset( $args['_um_account'] ) == 1 && isset( $args['_um_account_tab'] ) && 'password' === sanitize_key( $args['_um_account_tab'] ) ) { + if ( ! empty( $args['_um_account'] ) && isset( $args['_um_account_tab'] ) && 'password' === sanitize_key( $args['_um_account_tab'] ) ) { // validate for security on the account change password page if ( ! is_user_logged_in() ) { wp_die( esc_html__( 'This is not possible for security reasons.', 'ultimate-member' ) ); diff --git a/includes/um-short-functions.php b/includes/um-short-functions.php index 244f3f19..df0c93da 100644 --- a/includes/um-short-functions.php +++ b/includes/um-short-functions.php @@ -1376,21 +1376,16 @@ function um_get_metadefault( $id ) { return isset( $core_form_meta_all[ '_um_' . $id ] ) ? $core_form_meta_all[ '_um_' . $id ] : ''; } - /** * boolean for account page editing * * @return bool */ function um_submitting_account_page() { - if ( isset( $_POST['_um_account'] ) && $_POST['_um_account'] == 1 && is_user_logged_in() ) { - return true; - } - - return false; + // phpcs:ignore WordPress.Security.NonceVerification -- already verified here + return ( ! empty( $_POST['_um_account'] ) && is_user_logged_in() ); } - /** * Get a user's display name *