Commit Graph

2634 Commits

Author SHA1 Message Date
Mykyta Synelnikov c8bd79fceb Add scheduled user account status check and improve approval
Introduce a new `Users` class to handle scheduled tasks for user status checks and batch processing. Refactor user approval functionality to allow silent operations and avoid sending notifications where unnecessary. Enhance user registration to prevent unfinished registrations from being processed in scheduled checks.
2025-04-14 23:12:29 +03:00
ashubawork 08a7b48d53 - add schedule action for account_status check 2025-04-07 15:01:07 +03:00
Mykyta Synelnikov 3858c6af83 Refactor Action Scheduler for not only email handling.
Updated the Action Scheduler implementation to improve flexibility and clarity. Replaced the 'enable_action_scheduler' option with 'enable_as_email_sending' for better specificity. Introduced hook-based checks to selectively enable email scheduling, ensuring compatibility and optimized performance.
2025-04-04 12:59:10 +03:00
Mykyta Synelnikov ccc7cd099b Add comments and legacy key for WooCommerce 9.1.0 support
Added comments to clarify the usage of meta keys introduced in WooCommerce 9.1.0 and marked TODOs for future cleanup. Also included a legacy key, `_money_spent`, for backward compatibility with WooCommerce versions below 9.1.0.
2025-04-03 13:05:10 +03:00
yuriinalivaiko e529b9d50f - fixed PHP Warning that occurs when using the getimagesize function with an image from an external source. 2025-04-02 22:23:14 +03:00
Mykyta Synelnikov 1ff60c2c3a Merge pull request #1663 from ultimatemember/fix/1654_additional
Security patch related to the member directory search
2025-04-01 17:54:50 +03:00
Mykyta Synelnikov 8c7d7cadec Refactor nonce verification handling in search processing
Improved code readability by consolidating and consistently ignoring nonce verification warnings where it has already been verified. This simplifies the logic and ensures clearer handling of `$_POST` variables in the member directory search functionality.
2025-03-26 00:20:45 +02:00
Mykyta Synelnikov 6987660e62 Refactor member directory search to handle missing directory_id.
Ensure proper validation for `directory_id` when processing search queries. Default include and exclude fields are applied if `directory_id` is absent, preserving functionality and preventing errors.
2025-03-26 00:18:52 +02:00
Mykyta Synelnikov 77f6a13730 Refactor and enhance member directory search functionality.
Replaced deprecated and complex search query methods with a more streamlined and flexible implementation. Introduced improved handling of core and custom search fields, optimized search logic, and added better filter support. Incremented plugin version to 2.10.2 to reflect these changes.
2025-03-25 23:31:13 +02:00
Mykyta Synelnikov 7f586ef47e Update Ultimate Member to version 2.10.2 with filesystem fixes
Introduced `maybe_init_wp_filesystem` for better WP_Filesystem initialization and added new utility methods like `remove_dir`. Improved cache handling and documentation annotations for several methods. These changes enhance file management and ensure smoother integration.
2025-03-18 17:28:15 +02:00
Mykyta Synelnikov 51dc3b5747 Refine regex patterns to improve injection protection.
Simplified the regex patterns for detecting and preventing `sleep` and `benchmark` injections. This improves the accuracy and maintainability of the security checks in the member directory code.
2025-03-07 10:51:48 +02:00
Mykyta Synelnikov 7014623010 Enhance SQL injection protection in regex patterns
Updated regular expressions to strengthen protection against sleep and benchmark injection attacks. This change improves the security of queries by handling potential edge cases more effectively.
2025-03-07 01:25:05 +02:00
Mykyta Synelnikov 13fb170740 Merge pull request #1654 from ultimatemember/security/md-search
Security path due to CVE ID: CVE-2025-1702
2025-03-03 16:06:26 +02:00
Mykyta Synelnikov 2f18dccd09 Refactor email activation flow in Ultimate Member.
Improved readability and clarity of the email activation process by updating comments and restructuring conditional checks. Added hooks and filters for better customization, including redirect URL filtering. Replaced `wp_redirect` with `um_safe_redirect` for safer redirection handling.
2025-02-28 14:21:54 +02:00
Mykyta Synelnikov c0d506b199 Merge remote-tracking branch 'origin/development/2.9.x' into fix/activate_account_via_email_link 2025-02-28 13:35:20 +02:00
Mykyta Synelnikov 74647d42cc Fix improper namespace usage and enhance regex validation due to CVE ID: CVE-2025-1702
Replaced \WP_User_Query with correctly imported WP_User_Query to ensure proper namespace handling. Added a new regex pattern to block sleep injections, enhancing security within the member directory query validation.
2025-02-28 12:13:15 +02:00
Mykyta Synelnikov d107153244 Refactor profile image handling in Ultimate Member.
Simplified Gravatar image logic and improved code readability by restructuring the image processing flow. Removed redundant variable initialization and adjusted handling of `$image_info`. This ensures cleaner, more maintainable code while preserving existing functionality.
2025-02-28 11:22:24 +02:00
yuriinalivaiko 468c9748fc - fixed image metadata for Gravatar 2025-02-21 13:47:50 +02:00
Mykyta Synelnikov 959bd82cdc Update Ultimate Member plugin honeypot CSS and JS
Removed wp_add_inline_script/style and used `um_request` as default honeypot key in um-styles.css and um-scripts.js.
2025-02-19 12:36:26 +02:00
Mykyta Synelnikov a0d19b7ab6 Simplify honeypot script and inline style logic.
Removed unnecessary condition checks around honeypot script and style injection. Streamlined the code to always enqueue the honeypot logic, improving maintainability and reducing complexity.
2025-02-19 01:03:46 +02:00
yuriinalivaiko 945ed3775a Task CU-86cy0809h
- fixed redirect to the Password Change page after the account activation.
2025-02-14 21:57:47 +02:00
Mykyta Synelnikov 0c183594b1 Update Ultimate Member to version 2.10.0
Bump plugin version to 2.10.0, update documentation, and adjust URLs and metadata accordingly. This release includes increased minimum PHP and WordPress requirements and addresses security-related issues. Users are strongly advised to update immediately.
2025-02-13 11:28:28 +02:00
Mykyta Synelnikov 2c01e25b5c Enhance form preview options and improve code consistency
Added separate buttons for 'Live Preview Screen' and 'Live Preview Mobile' in the form builder for better user experience. Updated coding standards for consistency, including proper handling of PHP tags and escaping functions. These changes improve readability, maintainability, and enhance functionality.

Issue #1646
2025-02-12 18:44:46 +02:00
Mykyta Synelnikov aadad09ea9 Fix spacing for query arguments in action listener.
Adjusted spacing for better code readability and consistency in the query arguments within the class-actions-listener.php file. This change ensures the code aligns with coding standards without affecting functionality.
2025-02-12 18:26:37 +02:00
Mykyta Synelnikov 3ada6c71d9 Update PHP requirement and improve user action handling
Raised minimum PHP version to 7.0 and finalized the plugin version to 2.9.3. Introduced a centralized user actions array and replaced 'manage_options' capability with 'edit_users' for better permission handling. Optimized the nonce actions extension method for cleaner code.

* reviewed #1619
2025-02-12 18:25:26 +02:00
Mykyta Synelnikov c3755baa16 Merge pull request #1624 from ultimatemember/fix/um-erase-data
The "Erase of your data" layout (CU-86cxneg3d)
2025-02-12 17:58:06 +02:00
Mykyta Synelnikov 422d2b7c67 Refactor password handling to bypass wp_unslash.
Introduce a dedicated method to handle password fields securely, avoiding `wp_unslash` for these fields. This enhances consistency and security when processing form data across the plugin.
2025-02-12 17:47:19 +02:00
Mykyta Synelnikov cbc8c24b35 Merge pull request #1647 from ultimatemember/fix/password
Password set in Dashboard can't be used for UM login or vice versa (CU-86cxwy7ww)
2025-02-12 17:21:27 +02:00
Mykyta Synelnikov 38593400ba Merge pull request #1644 from ultimatemember/fix/updates-request
Fixes updates request
2025-02-12 17:16:56 +02:00
yuriinalivaiko 17d95a189b Task CU-86cxwy7ww
- password sanitize has been changed to the standard WordPress one.
2025-02-04 23:23:26 +02:00
Mykyta Synelnikov 4adbe19cbe * fixed CVE-2024-12276;
* reviewed using $wpdb and WPCS;
* set minimum required version to 6.2 due to using %i for $wpdb->prepare;
2025-02-03 16:17:37 +02:00
Mykyta Synelnikov a760a6242e * updated requests to site URL;
* WPCS;
2025-01-31 15:19:28 +02:00
Mykyta Synelnikov 865fbf83c2 * added honeypot scripts/styles via
`wp_add_inline_script()`, `wp_add_inline_style()`
2025-01-30 13:00:17 +02:00
Mykyta Synelnikov 4d43d94502 * related to https://github.com/ultimatemember/ultimatemember/commit/8ca44d02a02e887fc4ab9bcb8ea9ff18ab2c0413 2025-01-30 12:33:49 +02:00
Mykyta Synelnikov bb0a49e08a * update dropdown items texts on cover photo change/remove;
* WPCS;
2025-01-29 16:44:29 +02:00
Mykyta Synelnikov fce490f54b * update dropdown items texts on cover photo change/remove;
* WPCS;
2025-01-29 16:43:05 +02:00
Mykyta Synelnikov 4dd1be344e * backward compatibility;
* update dropdown items texts on profile photo change/remove;
* added escapers;
* WPCS;
2025-01-29 16:01:02 +02:00
Mykyta Synelnikov 0520a55cc4 * removed hidden inputs on view mode;
* handle data attribute instead of the hidden input;
* WPCS;
2025-01-29 14:49:47 +02:00
Mykyta Synelnikov 817bc4b2e3 * fixed #1636 2025-01-24 18:32:11 +02:00
Mykyta Synelnikov 5fc2cd54a4 * Reviewed #1634 2025-01-24 18:19:14 +02:00
yuriinalivaiko 5952c06c59 Task CU-86cxq9tuk
- changed Open Graph image size.
2025-01-19 14:58:59 +02:00
yuriinalivaiko 8bf8a0130b fixed "Download your data" and "Erase of your data" fields layout. 2025-01-17 16:03:51 +02:00
Mykyta Synelnikov b0b9f82ebe * fixed order_count meta table update 2025-01-15 12:02:08 +02:00
Mykyta Synelnikov 0624a634d2 * fixed money_spent meta table update 2025-01-14 17:36:20 +02:00
Mykyta Synelnikov 5cb6ae6dc5 * prepared to the release 2025-01-14 15:39:01 +02:00
Mykyta Synelnikov 27aeef42af * prepared to the release 2025-01-14 15:24:03 +02:00
Mykyta Synelnikov dc81fa44ae Merge pull request #1607 from ultimatemember/fix/remove_mobile_detect
Deprecates mobile detect library
2025-01-14 12:02:23 +02:00
Mykyta Synelnikov 5ebefde6b8 * fixed security issue CVE ID: CVE-2025-0308 2025-01-10 02:17:18 +02:00
Mykyta Synelnikov e5fe05503a * fixed security issue CVE ID: CVE-2025-0308
* fixed security issue CVE ID: CVE-2025-0318
2025-01-08 12:20:35 +02:00
Mykyta Synelnikov a0892e18aa * enhancements related to #1599; 2024-12-19 17:24:52 +02:00