10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-06-05 15:09:37 +09:00
Code Issues Packages Projects Releases Wiki Activity

Update dynamic function blacklist for security enhancement

Browse Source 
Added a mechanism to dynamically retrieve and merge updated WordPress function lists into the blacklist to prevent unsafe usage in dropdown options. Addresses a security issue (CVE-2025-47691) by using a JSON-based function source tied to WordPress versioning.
This commit is contained in:
Mykyta Synelnikov
2025-05-12 13:16:17 +03:00
parent 1181b7956d
commit 9d83fba560
7 changed files with 3941 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-fields.php
+24 -2
View File
@@ -1379,8 +1379,30 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
public function dropdown_options_source_blacklist() {
$list = get_defined_functions();
$blacklist = ! empty( $list['internal'] ) ? $list['internal'] : array();
$blacklist = apply_filters( 'um_dropdown_options_source_blacklist', $blacklist );
return $blacklist;
// Get the saved version from the database
$wp_functions_version = get_option( 'um_wp_functions_version' );
if ( empty( $wp_functions_version ) || version_compare( UM_WP_FUNCTIONS_VERSION, $wp_functions_version, '>' ) ) {
// Load the JSON file's content
$jsonContent = file_get_contents( UM_PATH . 'includes/lib/php-scoper-wordpress-excludes/exclude-wordpress-functions.json' );
// Parse the JSON string into a PHP array
$um_wp_native_functions_list = json_decode( $jsonContent, true );
// Save the decoded JSON into wp_option
update_option( 'um_wp_functions_list', $um_wp_native_functions_list );
// Update the saved version in the database
update_option( 'um_wp_functions_version', UM_WP_FUNCTIONS_VERSION );
} else {
$um_wp_native_functions_list = get_option( 'um_wp_functions_list', array() );
}
if ( ! empty( $um_wp_native_functions_list ) ) {
$blacklist = array_merge( $blacklist, $um_wp_native_functions_list );
}
return apply_filters( 'um_dropdown_options_source_blacklist', $blacklist );
}
/**