10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-06-05 15:09:37 +09:00
Code Issues Packages Projects Releases Wiki Activity

Update 'ultimatemember_searchform' shortcode in Ultimate Member plugin

Browse Source 
Refactored template, CSS and JS to fix the security vulnerability.
This commit is contained in:
Mykyta Synelnikov
2026-01-28 11:52:06 +02:00
parent fd44b978cf
commit 9ba4e4b8d4
9 changed files with 126 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/css/um-styles.css
+4 -4
View File
@@ -900,14 +900,14 @@ small.um-max-filesize span{
max-width: 300px;
}
.um-search-area .um-search-field {
.um .um-form.um-search-area .um-search-field {
width: 100%;
margin: 0;
padding-left: 25px;
padding-left: 25px !important;
}
.rtl .um-search-area .um-search-field {
padding-right: 25px;
.rtl .um .um-form.um-search-area .um-search-field {
padding-right: 25px !important;
padding-left: initial;
}
assets/css/um-styles.min.css
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
assets/js/um-scripts.js
+48 -45
View File
@@ -440,60 +440,63 @@ jQuery(document).ready(function() {
return false;
});
jQuery( document.body ).on('click', '#um-search-button', function() {
var action = jQuery(this).parents('.um-search-form').data('members_page');
jQuery( document.body ).on('click', '#um-search-button', function(e) {
e.preventDefault();
var search_keys = [];
jQuery(this).parents('.um-search-form').find('input[name="um-search-keys[]"]').each( function() {
search_keys.push( jQuery(this).val() );
});
var search = jQuery(this).parents('.um-search-form').find('.um-search-field').val();
var url;
if ( search === '' ) {
url = action;
} else {
var query = '?';
for ( var i = 0; i < search_keys.length; i++ ) {
query += search_keys[i] + '=' + search;
if ( i !== search_keys.length - 1 ) {
query += '&';
}
}
url = action + query;
let $btn = jQuery(this);
if ( $btn.hasClass( 'um-disabled' ) ) {
return;
}
window.location = url;
let $form = $btn.parents('.um-search-form');
let search = $form.find('.um-search-field').val();
let nonce = $form.data('nonce');
$btn.addClass('um-disabled');
wp.ajax.send( 'um_search_widget_request', {
data: {
search: search,
_wpnonce: nonce
},
success: function(response) {
$btn.removeClass('um-disabled');
window.location = response.url;
},
error: function(e) {
console.log(e);
$btn.removeClass('um-disabled');
}
});
});
//make search on Enter click
jQuery( document.body ).on( 'keypress', '.um-search-field', function(e) {
if ( e.which === 13 ) {
var action = jQuery(this).parents('.um-search-form').data('members_page');
let $field = jQuery(this);
let $form = $field.parents('.um-search-form');
var search_keys = [];
jQuery(this).parents('.um-search-form').find('input[name="um-search-keys[]"]').each( function() {
search_keys.push( jQuery(this).val() );
});
var search = jQuery(this).val();
var url;
if ( search === '' ) {
url = action;
} else {
var query = '?';
for ( var i = 0; i < search_keys.length; i++ ) {
query += search_keys[i] + '=' + search;
if ( i !== search_keys.length - 1 ) {
query += '&';
}
}
url = action + query;
let $btn = $form.find('#um-search-button');
if ( $btn.hasClass( 'um-disabled' ) ) {
return;
}
window.location = url;
let search = $field.val();
let nonce = $form.data('nonce');
$btn.addClass('um-disabled');
wp.ajax.send( 'um_search_widget_request', {
data: {
search: search,
_wpnonce: nonce
},
success: function(response) {
$btn.removeClass('um-disabled');
window.location = response.url;
},
error: function(e) {
console.log(e);
$btn.removeClass('um-disabled');
}
});
}
});
assets/js/um-scripts.min.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
includes/ajax/class-pages.php
+57
View File
@@ -19,6 +19,9 @@ class Pages {
*/
public function __construct() {
add_action( 'wp_ajax_um_get_pages_list', array( $this, 'get_pages_list' ) );
add_action( 'wp_ajax_um_search_widget_request', array( $this, 'search_widget_request' ) );
add_action( 'wp_ajax_nopriv_um_search_widget_request', array( $this, 'search_widget_request' ) );
}
/**
@@ -98,4 +101,58 @@ class Pages {
wp_send_json( $return );
}
/**
* AJAX callback for getting search widget redirect to a proper member directory page.
*/
public function search_widget_request() {
check_ajax_referer( 'um_search_widget_request' );
if ( ! UM()->options()->get( 'members_page' ) ) {
wp_send_json_error( __( 'No members page enabled', 'ultimate-member' ) );
}
$member_directory_ids = array();
$page_id = UM()->config()->permalinks['members'];
if ( ! empty( $page_id ) ) {
$member_directory_ids = UM()->member_directory()->get_member_directory_id( $page_id );
}
if ( empty( $member_directory_ids ) ) {
wp_send_json_error( __( 'No members page enabled', 'ultimate-member' ) );
}
$url = um_get_predefined_page_url( 'members' );
$search = isset( $_POST['search'] ) ? sanitize_text_field( $_POST['search'] ) : '';
if ( empty( $search ) ) {
wp_send_json_success( array( 'url' => $url ) );
}
// Current user priority role
$priority_user_role = false;
if ( is_user_logged_in() ) {
$priority_user_role = UM()->roles()->get_priority_user_role( get_current_user_id() );
}
foreach ( $member_directory_ids as $directory_id ) {
$directory_data = UM()->query()->post_data( $directory_id );
if ( isset( $directory_data['roles_can_search'] ) ) {
$directory_data['roles_can_search'] = maybe_unserialize( $directory_data['roles_can_search'] );
}
$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'], true ) );
if ( empty( $directory_data['search'] ) || ! $show_search ) {
continue;
}
$hash = UM()->member_directory()->get_directory_hash( $directory_id );
$url = add_query_arg( array( 'search_' . $hash => $search ), $url );
}
wp_send_json_success( array( 'url' => $url ) );
}
}
includes/core/class-shortcodes.php
+5 -8
View File
@@ -1370,12 +1370,10 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
}
/**
* @param array $args
* @param string $content
*
* @return string
*/
public function ultimatemember_searchform( $args = array(), $content = '' ) {
public function ultimatemember_searchform() {
if ( ! UM()->options()->get( 'members_page' ) ) {
return '';
}
@@ -1391,7 +1389,7 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
return '';
}
//current user priority role
// Current user priority role
$priority_user_role = false;
if ( is_user_logged_in() ) {
$priority_user_role = UM()->roles()->get_priority_user_role( get_current_user_id() );
@@ -1405,7 +1403,7 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
$directory_data['roles_can_search'] = maybe_unserialize( $directory_data['roles_can_search'] );
}
$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'] ) );
$show_search = empty( $directory_data['roles_can_search'] ) || ( ! empty( $priority_user_role ) && in_array( $priority_user_role, $directory_data['roles_can_search'], true ) );
if ( empty( $directory_data['search'] ) || ! $show_search ) {
continue;
}
@@ -1419,12 +1417,11 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
return '';
}
$query = array_filter( $query );
$search_value = array_values( $query );
$t_args = array(
'query' => $query,
'search_value' => $search_value[0],
'members_page' => um_get_core_page( 'members' ),
'search_value' => ! empty( $search_value ) ? $search_value[0] : '',
);
return UM()->get_template( 'searchform.php', '', $t_args );
}
includes/um-deprecated-functions.php
+1 -5
View File
@@ -462,11 +462,7 @@ function um_members( $argument ) {
function um_get_search_form() {
//um_deprecated_function( 'um_get_search_form', '2.1.0', 'do_shortcode( \'[ultimatemember_searchform]\' )' );
if ( version_compare( get_bloginfo('version'),'5.4', '<' ) ) {
return do_shortcode( '[ultimatemember_searchform]' );
} else {
return apply_shortcodes( '[ultimatemember_searchform]' );
}
return apply_shortcodes( '[ultimatemember_searchform]' );
}
includes/widgets/class-um-search-widget.php
+1 -6
View File
@@ -58,12 +58,7 @@ class UM_Search_Widget extends \WP_Widget {
}
// display the search form
if ( version_compare( get_bloginfo('version'),'5.4', '<' ) ) {
echo do_shortcode( '[ultimatemember_searchform /]' );
} else {
echo apply_shortcodes( '[ultimatemember_searchform /]' );
}
echo apply_shortcodes( '[ultimatemember_searchform /]' );
echo $args['after_widget'];
}
templates/searchform.php
+8 -13
View File
@@ -6,23 +6,18 @@
*
* Call: function ultimatemember_searchform()
*
* @version 2.6.1
* @version 2.11.2
*
* @var string $members_page
* @var string $search_value
* @var array $query
*/
if ( ! defined( 'ABSPATH' ) ) {
exit;
} ?>
<div class="search-form um-search-form" data-members_page="<?php echo esc_url( $members_page ); ?>">
<?php foreach ( array_keys( $query ) as $key ) { ?>
<input type="hidden" name="um-search-keys[]" value="<?php echo esc_attr( $key ) ?>" />
<?php } ?>
<div class="um-search-area">
<span class="screen-reader-text"><?php echo _x( 'Search for:', 'label' ); ?></span>
<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder' ); ?>" value="<?php echo esc_attr( $search_value ); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label' ); ?>" />
<a href="javascript:void(0);" id="um-search-button" class="um-search-icon um-faicon um-faicon-search"></a>
}
?>
<div class="um search-form um-search-form" data-nonce="<?php echo esc_attr( wp_create_nonce( 'um_search_widget_request' ) ); ?>">
<div class="um-form um-search-area">
<span class="screen-reader-text"><?php echo esc_html_x( 'Search for:', 'label', 'ultimate-member' ); ?></span>
<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder', 'ultimate-member' ); ?>" value="<?php echo esc_attr( $search_value ); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label', 'ultimate-member' ); ?>" />
<a href="#" id="um-search-button" class="um-search-icon um-faicon um-faicon-search"></a>
</div>
</div>