WP-Members Membership Plugin - Version 3.1.9

Version Description

  • Improved user search in Users > All Users.
  • Fully deprecated obsolete reCAPTCHA v1. If v1 is selected as a setting, it will be automatically changed to v2. (v1 users check your API keys for compatibility.)
  • Removed obsolete comments_template.php.
  • Set image field to display "medium" image in dashboard/admin user profile. Admin profile image display links to media editor.
  • Added default format to date field shortcode to date format set in WP settings.
  • Added format attribute to date field shortcode for custom date formatting.
  • Deprecated wpmem_user_profile(), wpmem_profile_update(), wpmem_user_profile_multipart(), wpmem_admin_fields(), wpmem_admin_update().
  • Rebuild of dashboard profile functions incorporated into new user profile object class.
  • Fields tab bulk action now checks for both page and tab (rather than just tab) to prevent namespace collisions.
  • Removed $requested_redirect_to argument from login_redirect filter hook.
  • Removed height property of button_div for generic stylesheets.
  • Fixed user edit shortcode to display updated user data without page refresh.
  • Fixed password change so that login state is maintained after password update.
Download this release

Release Info

Developer cbutlerjr
Plugin Icon 128x128 WP-Members Membership Plugin
Version 3.1.9
Comparing to
See all releases

Code changes from version 3.1.8 to 3.1.9

admin/admin.php CHANGED
@@ -26,6 +26,10 @@
26
  * - wpmem_admin_enqueue_scripts
27
  */
28
 
 
 
 
 
29
 
30
  /**
31
  * Filter to add link to settings from plugin panel.
@@ -89,20 +93,24 @@ function wpmem_add_captcha_tab( $tabs ) {
89
  */
90
  function wpmem_admin() {
91
 
92
- $did_update = ( isset( $_POST['wpmem_admin_a'] ) ) ? wpmem_admin_action( $_POST['wpmem_admin_a'] ) : false;
93
 
94
  global $wpmem;
95
 
96
  if ( $wpmem->captcha ) {
97
- add_filter( 'wpmem_admin_tabs', 'wpmem_add_captcha_tab' );
98
  add_action( 'wpmem_admin_do_tab', 'wpmem_a_captcha_tab', 1, 1 );
 
 
 
 
99
  } ?>
100
 
101
  <div class="wrap">
102
  <?php screen_icon( 'options-general' ); ?>
103
  <!--<h2>WP-Members <?php _e('Settings', 'wp-members'); ?></h2>-->
104
  <?php
105
- $tab = ( isset( $_GET['tab'] ) ) ? $_GET['tab'] : 'options';
106
 
107
  // Render the tab being displayed.
108
  $wpmem->admin->do_tabs( $tab );
26
  * - wpmem_admin_enqueue_scripts
27
  */
28
 
29
+ // Exit if accessed directly.
30
+ if ( ! defined( 'ABSPATH' ) ) {
31
+ exit();
32
+ }
33
 
34
  /**
35
  * Filter to add link to settings from plugin panel.
93
  */
94
  function wpmem_admin() {
95
 
96
+ $did_update = ( isset( $_POST['wpmem_admin_a'] ) ) ? wpmem_admin_action( sanitize_text_field( $_POST['wpmem_admin_a'] ) ) : false;
97
 
98
  global $wpmem;
99
 
100
  if ( $wpmem->captcha ) {
101
+ add_filter( 'wpmem_admin_tabs', 'wpmem_add_captcha_tab' );
102
  add_action( 'wpmem_admin_do_tab', 'wpmem_a_captcha_tab', 1, 1 );
103
+ }
104
+ if ( $wpmem->dropins ) {
105
+ add_filter( 'wpmem_admin_tabs', 'wpmem_add_dropins_tab' );
106
+ add_action( 'wpmem_admin_do_tab', 'wpmem_render_dropins_tab', 1, 1 );
107
  } ?>
108
 
109
  <div class="wrap">
110
  <?php screen_icon( 'options-general' ); ?>
111
  <!--<h2>WP-Members <?php _e('Settings', 'wp-members'); ?></h2>-->
112
  <?php
113
+ $tab = ( isset( $_GET['tab'] ) ) ? sanitize_text_field( $_GET['tab'] ) : 'options';
114
 
115
  // Render the tab being displayed.
116
  $wpmem->admin->do_tabs( $tab );
admin/dialogs.php CHANGED
@@ -22,6 +22,11 @@
22
  * - butlerblog_feed_output
23
  */
24
 
 
 
 
 
 
25
  /**
26
  * Outputs the various admin warning messages.
27
  *
22
  * - butlerblog_feed_output
23
  */
24
 
25
+ // Exit if accessed directly.
26
+ if ( ! defined( 'ABSPATH' ) ) {
27
+ exit();
28
+ }
29
+
30
  /**
31
  * Outputs the various admin warning messages.
32
  *
admin/includes/api.php CHANGED
@@ -17,6 +17,11 @@
17
  * - wpmem_is_tab
18
  */
19
 
 
 
 
 
 
20
  /**
21
  * Wrapper function for adding custom emails.
22
  *
17
  * - wpmem_is_tab
18
  */
19
 
20
+ // Exit if accessed directly.
21
+ if ( ! defined( 'ABSPATH' ) ) {
22
+ exit();
23
+ }
24
+
25
  /**
26
  * Wrapper function for adding custom emails.
27
  *
admin/includes/class-wp-members-admin-api.php CHANGED
@@ -7,6 +7,11 @@
7
  * @since 3.1.0
8
  */
9
 
 
 
 
 
 
10
  class WP_Members_Admin_API {
11
 
12
  /**
@@ -67,14 +72,7 @@ class WP_Members_Admin_API {
67
  * @since 3.1.7 Loads all admin dependent files.
68
  */
69
  function load_dependencies() {
70
-
71
- // Default permissions for loading admin dependencies.
72
- $defaults = array(
73
- 'main' => 'edit_theme_options',
74
- 'users' => 'list_users',
75
- 'options' => 'manage_options',
76
- 'posts' => 'edit_posts',
77
- );
78
  /**
79
  * Filter permission defaults.
80
  *
@@ -84,7 +82,12 @@ class WP_Members_Admin_API {
84
  *
85
  * @todo Still needs final evaluation.
86
  */
87
- $permissions = apply_filters( 'wpmem_load_admin_permissions', $defaults );
 
 
 
 
 
88
 
89
  if ( current_user_can( $permissions['main'] ) ) {
90
  require_once( WPMEM_PATH . 'admin/admin.php' );
@@ -92,6 +95,7 @@ class WP_Members_Admin_API {
92
  if ( current_user_can( $permissions['users'] ) ) {
93
  require_once( WPMEM_PATH . 'admin/users.php' );
94
  require_once( WPMEM_PATH . 'admin/user-profile.php' );
 
95
  }
96
  if ( current_user_can( $permissions['options'] ) ) {
97
  require_once( WPMEM_PATH . 'admin/tab-options.php' );
@@ -100,6 +104,7 @@ class WP_Members_Admin_API {
100
  require_once( WPMEM_PATH . 'admin/tab-captcha.php' );
101
  require_once( WPMEM_PATH . 'admin/tab-about.php' );
102
  require_once( WPMEM_PATH . 'admin/tab-dialogs.php' );
 
103
  require_once( WPMEM_PATH . 'admin/dialogs.php' );
104
  }
105
  if ( current_user_can( $permissions['posts'] ) ) {
@@ -107,6 +112,8 @@ class WP_Members_Admin_API {
107
  }
108
  require_once( WPMEM_PATH . 'admin/includes/api.php' );
109
  include_once( WPMEM_PATH . 'inc/wp-registration.php' );
 
 
110
  }
111
 
112
  /**
@@ -126,17 +133,13 @@ class WP_Members_Admin_API {
126
  add_action( 'wpmem_admin_do_tab', 'wpmem_a_about_tab', 999, 1 );
127
 
128
  // If user has a role that cannot edit users, set profile actions for non-admins.
129
- if ( ! current_user_can( 'edit_users' ) ) {
130
- // User actions and filters.
131
- add_action( 'user_edit_form_tag', 'wpmem_user_profile_multipart' );
132
- add_action( 'show_user_profile', 'wpmem_user_profile' );
133
- add_action( 'edit_user_profile', 'wpmem_user_profile' );
134
- add_action( 'profile_update', 'wpmem_profile_update' );
135
- } else {
136
- add_action( 'user_edit_form_tag', 'wpmem_user_profile_multipart' );
137
- add_action( 'show_user_profile', 'wpmem_admin_fields' );
138
- add_action( 'edit_user_profile', 'wpmem_admin_fields' );
139
- add_action( 'profile_update', 'wpmem_admin_update' );
140
  add_action( 'admin_footer-users.php', 'wpmem_bulk_user_action' );
141
  add_action( 'load-users.php', 'wpmem_users_page_load' );
142
  add_action( 'admin_notices', 'wpmem_users_admin_notices' );
@@ -217,14 +220,14 @@ class WP_Members_Admin_API {
217
  * @param array $args Settings array for the email.
218
  */
219
  function do_email_input( $args ) { ?>
220
- <tr valign="top"><td colspan="2"><strong><?php echo $args['heading']; ?></strong></td></tr>
221
  <tr valign="top">
222
- <th scope="row"><?php echo $args['subject_label']; ?></th>
223
- <td><input type="text" name="<?php echo $args['subject_input']; ?>" size="80" value="<?php echo wp_unslash( $args['subject_value'] ); ?>"></td>
224
  </tr>
225
  <tr valign="top">
226
- <th scope="row"><?php echo $args['body_label']; ?></th>
227
- <td><textarea name="<?php echo $args['body_input']; ?>" rows="12" cols="50" id="" class="large-text code"><?php echo wp_unslash( $args['body_value'] ); ?></textarea></td>
228
  </tr>
229
  <tr><td colspan="2"><hr /></td></tr><?php
230
  }
@@ -238,8 +241,8 @@ class WP_Members_Admin_API {
238
  */
239
  function email_update( $args ) {
240
  $settings = array(
241
- 'subj' => wpmem_get( $args['subject_input'] ),
242
- 'body' => wpmem_get( $args['body_input'] ),
243
  );
244
  update_option( $args['name'], $settings, true );
245
  $this->emails[ $args['name'] ]['subject_value'] = $settings['subj'];
@@ -288,8 +291,8 @@ class WP_Members_Admin_API {
288
  */
289
  function do_dialog_input( $args ) { ?>
290
  <tr valign="top">
291
- <th scope="row"><?php echo $args['label']; ?></th>
292
- <td><textarea name="<?php echo $args['name'] . "_dialog"; ?>" rows="3" cols="50" id="" class="large-text code"><?php echo wp_unslash( $args['value'] ); ?></textarea></td>
293
  </tr><?php
294
  }
295
 
@@ -302,7 +305,7 @@ class WP_Members_Admin_API {
302
  $settings = array();
303
  foreach ( $this->dialogs as $dialog ) {
304
  if ( isset( $_POST[ $dialog['name'] . '_dialog' ] ) ) {
305
- $settings[ $dialog['name'] ] = $_POST[ $dialog['name'] . '_dialog' ];
306
  }
307
  }
308
  update_option( 'wpmembers_dialogs', $settings, true );
@@ -494,7 +497,7 @@ class WP_Members_Admin_API {
494
  */
495
  function form_post_url( $args = false ) {
496
  global $pagenow, $plugin_page, $wpmem;
497
- $tab = wpmem_get( 'tab', false, 'get' );
498
  $params = array( 'page' => $plugin_page );
499
  if ( $tab ) {
500
  $params['tab'] = $tab;
@@ -505,7 +508,7 @@ class WP_Members_Admin_API {
505
  }
506
  }
507
  $url = add_query_arg( $params, admin_url( $pagenow ) );
508
- return $url;
509
  }
510
 
511
  } // End of WP_Members_Admin_API class.
7
  * @since 3.1.0
8
  */
9
 
10
+ // Exit if accessed directly.
11
+ if ( ! defined( 'ABSPATH' ) ) {
12
+ exit();
13
+ }
14
+
15
  class WP_Members_Admin_API {
16
 
17
  /**
72
  * @since 3.1.7 Loads all admin dependent files.
73
  */
74
  function load_dependencies() {
75
+
 
 
 
 
 
 
 
76
  /**
77
  * Filter permission defaults.
78
  *
82
  *
83
  * @todo Still needs final evaluation.
84
  */
85
+ $permissions = apply_filters( 'wpmem_load_admin_permissions', array(
86
+ 'main' => 'edit_theme_options',
87
+ 'users' => 'list_users',
88
+ 'options' => 'manage_options',
89
+ 'posts' => 'edit_posts',
90
+ ) );
91
 
92
  if ( current_user_can( $permissions['main'] ) ) {
93
  require_once( WPMEM_PATH . 'admin/admin.php' );
95
  if ( current_user_can( $permissions['users'] ) ) {
96
  require_once( WPMEM_PATH . 'admin/users.php' );
97
  require_once( WPMEM_PATH . 'admin/user-profile.php' );
98
+ require_once( WPMEM_PATH . 'admin/includes/class-wp-members-user-search.php' );
99
  }
100
  if ( current_user_can( $permissions['options'] ) ) {
101
  require_once( WPMEM_PATH . 'admin/tab-options.php' );
104
  require_once( WPMEM_PATH . 'admin/tab-captcha.php' );
105
  require_once( WPMEM_PATH . 'admin/tab-about.php' );
106
  require_once( WPMEM_PATH . 'admin/tab-dialogs.php' );
107
+ require_once( WPMEM_PATH . 'admin/tab-dropins.php' );
108
  require_once( WPMEM_PATH . 'admin/dialogs.php' );
109
  }
110
  if ( current_user_can( $permissions['posts'] ) ) {
112
  }
113
  require_once( WPMEM_PATH . 'admin/includes/api.php' );
114
  include_once( WPMEM_PATH . 'inc/wp-registration.php' );
115
+ //require_once( WPMEM_PATH . 'admin/includes/class-wp-members-user-profile.php' );
116
+ require_once( WPMEM_PATH . 'inc/class-wp-members-user-profile.php' );
117
  }
118
 
119
  /**
133
  add_action( 'wpmem_admin_do_tab', 'wpmem_a_about_tab', 999, 1 );
134
 
135
  // If user has a role that cannot edit users, set profile actions for non-admins.
136
+
137
+ // User actions and filters.
138
+ add_action( 'user_edit_form_tag', array( 'WP_Members_User_Profile', 'add_multipart' ) );
139
+ add_action( 'show_user_profile', array( 'WP_Members_User_Profile', 'profile' ) );
140
+ add_action( 'edit_user_profile', array( 'WP_Members_User_Profile', 'profile' ) );
141
+ add_action( 'profile_update', array( 'WP_Members_User_Profile', 'update' ) );
142
+ if ( current_user_can( 'edit_users' ) ) {
 
 
 
 
143
  add_action( 'admin_footer-users.php', 'wpmem_bulk_user_action' );
144
  add_action( 'load-users.php', 'wpmem_users_page_load' );
145
  add_action( 'admin_notices', 'wpmem_users_admin_notices' );
220
  * @param array $args Settings array for the email.
221
  */
222
  function do_email_input( $args ) { ?>
223
+ <tr valign="top"><td colspan="2"><strong><?php echo esc_html( $args['heading'] ); ?></strong></td></tr>
224
  <tr valign="top">
225
+ <th scope="row"><?php echo esc_html( $args['subject_label'] ); ?></th>
226
+ <td><input type="text" name="<?php echo esc_attr( $args['subject_input'] ); ?>" size="80" value="<?php echo esc_attr( wp_unslash( $args['subject_value'] ) ); ?>"></td>
227
  </tr>
228
  <tr valign="top">
229
+ <th scope="row"><?php echo esc_html( $args['body_label'] ); ?></th>
230
+ <td><textarea name="<?php echo esc_attr( $args['body_input'] ); ?>" rows="12" cols="50" id="" class="large-text code"><?php echo esc_textarea( wp_unslash( $args['body_value'] ) ); ?></textarea></td>
231
  </tr>
232
  <tr><td colspan="2"><hr /></td></tr><?php
233
  }
241
  */
242
  function email_update( $args ) {
243
  $settings = array(
244
+ 'subj' => sanitize_text_field( wpmem_get( $args['subject_input'] ) ),
245
+ 'body' => wp_kses( wpmem_get( $args['body_input'] ), 'post' ),
246
  );
247
  update_option( $args['name'], $settings, true );
248
  $this->emails[ $args['name'] ]['subject_value'] = $settings['subj'];
291
  */
292
  function do_dialog_input( $args ) { ?>
293
  <tr valign="top">
294
+ <th scope="row"><?php echo esc_html( $args['label'] ); ?></th>
295
+ <td><textarea name="<?php echo esc_attr( $args['name'] . "_dialog" ); ?>" rows="3" cols="50" id="" class="large-text code"><?php echo esc_textarea( wp_unslash( $args['value'] ) ); ?></textarea></td>
296
  </tr><?php
297
  }
298
 
305
  $settings = array();
306
  foreach ( $this->dialogs as $dialog ) {
307
  if ( isset( $_POST[ $dialog['name'] . '_dialog' ] ) ) {
308
+ $settings[ $dialog['name'] ] = wp_kses( $_POST[ $dialog['name'] . '_dialog' ], 'post' );
309
  }
310
  }
311
  update_option( 'wpmembers_dialogs', $settings, true );
497
  */
498
  function form_post_url( $args = false ) {
499
  global $pagenow, $plugin_page, $wpmem;
500
+ $tab = sanitize_text_field( wpmem_get( 'tab', false, 'get' ) );
501
  $params = array( 'page' => $plugin_page );
502
  if ( $tab ) {
503
  $params['tab'] = $tab;
508
  }
509
  }
510
  $url = add_query_arg( $params, admin_url( $pagenow ) );
511
+ return esc_url( $url );
512
  }
513
 
514
  } // End of WP_Members_Admin_API class.
admin/includes/class-wp-members-sortable-user-columns.php CHANGED
@@ -5,6 +5,11 @@
5
  * @since 3.0
6
  */
7
 
 
 
 
 
 
8
  if( ! class_exists( 'WP_Members_Sortable_User_Columns' ) ):
9
  /**
10
  * Class to sort WP-Members custom user meta columns
5
  * @since 3.0
6
  */
7
 
8
+ // Exit if accessed directly.
9
+ if ( ! defined( 'ABSPATH' ) ) {
10
+ exit();
11
+ }
12
+
13
  if( ! class_exists( 'WP_Members_Sortable_User_Columns' ) ):
14
  /**
15
  * Class to sort WP-Members custom user meta columns
admin/includes/class-wp-members-tinymce-buttons.php CHANGED
@@ -4,6 +4,12 @@
4
  *
5
  * @since 3.0
6
  */
 
 
 
 
 
 
7
  class WP_Members_TinyMCE_Buttons {
8
 
9
  /**
4
  *
5
  * @since 3.0
6
  */
7
+
8
+ // Exit if accessed directly.
9
+ if ( ! defined( 'ABSPATH' ) ) {
10
+ exit();
11
+ }
12
+
13
  class WP_Members_TinyMCE_Buttons {
14
 
15
  /**
admin/includes/class-wp-members-user-search.php ADDED
@@ -0,0 +1,217 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <?php
2
+ /**
3
+ * The WP_Members Admin User Search Class.
4
+ *
5
+ * An object class to improve the backend user search. Allows
6
+ * searching by selected meta keys as defined in the plugin
7
+ * settings. Hooks into pre_user_query.
8
+ *
9
+ * Modified from Better User Search:
10
+ * https://wordpress.org/plugins/better-user-search/
11
+ *
12
+ * @package WP-Members
13
+ * @subpackage WP_Members User Search Object Class
14
+ * @since 3.1.9
15
+ */
16
+
17
+ // Exit if accessed directly.
18
+ if ( ! defined( 'ABSPATH' ) ) {
19
+ exit();
20
+ }
21
+
22
+ class WP_Members_Admin_User_Search {
23
+
24
+ /**
25
+ * Container for tabs.
26
+ *
27
+ * @since 3.1.9
28
+ * @access public
29
+ * @var array
30
+ */
31
+ public $tabs = array();
32
+
33
+ /**
34
+ * Container for user search meta keys.
35
+ *
36
+ * @since 3.1.9
37
+ * @access public
38
+ * @var array
39
+ */
40
+ public $keys = array();
41
+
42
+ /**
43
+ * Constructor function.
44
+ *
45
+ * @since 3.1.9
46
+ */
47
+ public function __construct() {
48
+ // This plugin is for the backend only
49
+ if ( ! is_admin() ) {
50
+ return;
51
+ }
52
+
53
+ $saved_keys = get_option( 'wpmembers_usfields' );
54
+ if ( $saved_keys ) {
55
+ $this->keys = $saved_keys;
56
+ // Add the overwrite actions for the search
57
+ add_action( 'pre_user_query', array( $this, 'pre_user_query' ), 100 );
58
+ }
59
+ }
60
+
61
+ /**
62
+ * pre_user_query function.
63
+ *
64
+ * @since 3.1.9
65
+ *
66
+ * @param string $user_query
67
+ */
68
+ public function pre_user_query( $user_query ) {
69
+
70
+ // Exit if no search is being done.
71
+ $terms = wpmem_get( 's', false, 'get' );
72
+ if ( ! $terms ) {
73
+ return;
74
+ }
75
+
76
+ global $wpdb;
77
+
78
+ // Get the data we need from helper methods.
79
+ $terms = $this->get_search_terms();
80
+ $meta_keys = $this->get_meta_keys();
81
+
82
+ // If there are meta keys to search.
83
+ if ( ! empty( $meta_keys ) ) {
84
+
85
+ // Are we performing an AND (default) or an OR?
86
+ $search_with_or = in_array( 'or', $terms );
87
+
88
+ if ( $search_with_or ) {
89
+ // Remove the OR keyword(s) from the terms.
90
+ $terms = array_diff( $terms, array( 'or', 'and' ) );
91
+
92
+ // Reset the array keys.
93
+ $terms = array_values( $terms );
94
+ }
95
+
96
+ // Use a permanent table because you cannot reference MySQL temporary tables more than once per query.
97
+ $mktable = "{$wpdb->prefix}wpmembers_user_search_keys";
98
+
99
+ // Create the table to store the meta keys.
100
+ $wpdb->query( $sql = "CREATE TABLE IF NOT EXISTS {$mktable} (meta_key VARCHAR(255) NOT NULL);" );
101
+
102
+ // Empty the table to ensure that we have an accurate set of meta keys.
103
+ $wpdb->query( $sql = "TRUNCATE TABLE {$mktable};" );
104
+
105
+ // Insert the meta keys into the table.
106
+ $prepare_values_array = array_fill( 0, count( $meta_keys ), '(%s)' );
107
+ $prepare_values = implode( ", ", $prepare_values_array );
108
+
109
+ $insert_sql = $wpdb->prepare( "
110
+ INSERT INTO {$mktable}
111
+ (meta_key)
112
+ VALUES
113
+ {$prepare_values};", $meta_keys );
114
+
115
+ $wpdb->query( $insert_sql );
116
+
117
+ // Build data for $wpdb->prepare.
118
+ $values = array();
119
+
120
+ // Make sure we replicate each term XX number of times (refer to query below for correct number).
121
+ foreach ( $terms as $term ) {
122
+ for ( $i = 0; $i < 6; $i++ ) {
123
+ $values[] = "%{$term}%";
124
+ }
125
+ }
126
+
127
+ // Last value is for HAVING COUNT(*), so add that.
128
+ // Note the min count is 1 if we found OR in the terms.
129
+ $values[] = ( $search_with_or !== false ? 1 : count( $terms ) );
130
+
131
+ // Query for matching users.
132
+ $user_ids = $wpdb->get_col( $sql = $wpdb->prepare( "
133
+ SELECT user_id
134
+ FROM (" . implode( 'UNION ALL', array_fill( 0, count( $terms ), "
135
+ SELECT DISTINCT u.ID AS user_id
136
+ FROM {$wpdb->users} u
137
+ INNER JOIN {$wpdb->usermeta} um
138
+ ON um.user_id = u.ID
139
+ INNER JOIN {$mktable} mk
140
+ ON mk.meta_key = um.meta_key
141
+ WHERE LOWER(um.meta_value) LIKE %s
142
+ OR LOWER(u.user_login) LIKE %s
143
+ OR LOWER(u.user_nicename) LIKE %s
144
+ OR LOWER(u.user_email) LIKE %s
145
+ OR LOWER(u.user_url) LIKE %s
146
+ OR LOWER(u.display_name) LIKE %s
147
+ " ) ) . ") AS user_search_union
148
+ GROUP BY user_id
149
+ HAVING COUNT(*) >= %d;", $values ) );
150
+
151
+ // Change query to include the new user IDs.
152
+ if ( is_array( $user_ids ) && count( $user_ids ) ) {
153
+ // Combine the IDs into a comma separated list.
154
+ $id_string = implode( ',', $user_ids );
155
+
156
+ // Build the SQL we are adding to the query.
157
+ $extra_sql = " OR ID IN ({$id_string})";
158
+ $add_after = 'WHERE ';
159
+ $add_position = strpos( $user_query->query_where, $add_after ) + strlen( $add_after );
160
+
161
+ // Add the query to the end.
162
+ $user_query->query_where = substr( $user_query->query_where, 0, $add_position ) . '(' . substr( $user_query->query_where, $add_position ) . ')' . $extra_sql;
163
+ }
164
+ }
165
+ }
166
+
167
+ /**
168
+ * Get array of user search terms.
169
+ *
170
+ * @since 3.1.9
171
+ *
172
+ * @return array $terms
173
+ */
174
+ public function get_search_terms() {
175
+ // Get the WordPress search term(s).
176
+ $terms = ( wpmem_get( 's', false, 'get' ) ) ? trim( strtolower( stripslashes( $_GET['s'] ) ) ) : false;
177
+
178
+ // Quite if no search term(s) exist.
179
+ if ( empty( $terms ) ) {
180
+ return array();
181
+ }
182
+
183
+ // Split terms by space into an array.
184
+ $terms = explode( ' ', $terms );
185
+
186
+ // Remove empty terms.
187
+ foreach ( $terms as $key => $term ) {
188
+ if ( empty( $term ) ) {
189
+ unset( $terms[ $key ] );
190
+ }
191
+ }
192
+
193
+ // Reset the array keys.
194
+ $terms = array_values( $terms );
195
+
196
+ return $terms;
197
+ }
198
+
199
+ /**
200
+ * Get meta keys for query.
201
+ *
202
+ * @since 3.1.9
203
+ *
204
+ * @return array $meta_keys
205
+ */
206
+ public function get_meta_keys() {
207
+ // Setting is an array of meta_key => meta_value, need the key.
208
+ $meta_keys = array();
209
+ if ( $this->keys ) {
210
+ foreach ( $this->keys as $key => $val ) {
211
+ $meta_keys[] = $key;
212
+ }
213
+ }
214
+ // Return the meta keys.
215
+ return $meta_keys;
216
+ }
217
+ }
admin/post.php CHANGED
@@ -25,6 +25,11 @@
25
  * - wpmem_load_tinymce
26
  */
27
 
 
 
 
 
 
28
  /**
29
  * Function to add block/unblock to the bulk dropdown list.
30
  *
@@ -101,7 +106,7 @@ function wpmem_posts_page_load() {
101
  'post_type' => $type,
102
  );
103
  if ( isset( $_GET['post_status'] ) && 'all' != $_GET['post_status'] ) {
104
- $arr['post_status'] = $_GET['post_status'];
105
  }
106
 
107
  $sendback = add_query_arg( array( $arr ), '', $sendback );
@@ -136,7 +141,7 @@ function wpmem_posts_admin_notices() {
136
  global $pagenow, $post_type;
137
  if ( $pagenow == 'edit.php' && isset( $_REQUEST['a'] ) ) {
138
  $msg = ( $_REQUEST['a'] == 'block' ) ? sprintf( __( '%s blocked', 'wp-members' ), $post_type ) : sprintf( __( '%s unblocked', 'wp-members' ), $post_type );
139
- echo '<div class="updated"><p>' . $_REQUEST['n'] . ' ' . $msg . '</p></div>';
140
  }
141
  }
142
 
@@ -259,7 +264,7 @@ function wpmem_block_meta_save( $post_id ) {
259
  }
260
 
261
  // Get value.
262
- $block = isset( $_POST['wpmem_block'] ) ? $_POST['wpmem_block'] : null;
263
 
264
  // Need the post object.
265
  global $post;
@@ -296,7 +301,7 @@ function wpmem_block_meta_save( $post_id ) {
296
  */
297
  function wpmem_post_columns( $columns ) {
298
  global $wpmem;
299
- $post_type = ( isset( $_REQUEST['post_type'] ) ) ? $_REQUEST['post_type'] : 'post';
300
 
301
  if ( $post_type == 'page' || $post_type == 'post' || array_key_exists( $post_type, $wpmem->post_types ) ) {
302
  $columns['wpmem_block'] = ( $wpmem->block[ $post_type ] == 1 ) ? __( 'Unblocked?', 'wp-members' ) : __( 'Blocked?', 'wp-members' );
@@ -317,7 +322,7 @@ function wpmem_post_columns( $columns ) {
317
  function wpmem_post_columns_content( $column_name, $post_ID ) {
318
 
319
  global $wpmem;
320
- $post_type = ( isset( $_REQUEST['post_type'] ) ) ? $_REQUEST['post_type'] : 'post';
321
 
322
  if ( $column_name == 'wpmem_block' ) {
323
 
25
  * - wpmem_load_tinymce
26
  */
27
 
28
+ // Exit if accessed directly.
29
+ if ( ! defined( 'ABSPATH' ) ) {
30
+ exit();
31
+ }
32
+
33
  /**
34
  * Function to add block/unblock to the bulk dropdown list.
35
  *
106
  'post_type' => $type,
107
  );
108
  if ( isset( $_GET['post_status'] ) && 'all' != $_GET['post_status'] ) {
109
+ $arr['post_status'] = sanitize_text_field( $_GET['post_status'] );
110
  }
111
 
112
  $sendback = add_query_arg( array( $arr ), '', $sendback );
141
  global $pagenow, $post_type;
142
  if ( $pagenow == 'edit.php' && isset( $_REQUEST['a'] ) ) {
143
  $msg = ( $_REQUEST['a'] == 'block' ) ? sprintf( __( '%s blocked', 'wp-members' ), $post_type ) : sprintf( __( '%s unblocked', 'wp-members' ), $post_type );
144
+ echo '<div class="updated"><p>' . esc_html( $_REQUEST['n'] ) . ' ' . esc_html( $msg ) . '</p></div>';
145
  }
146
  }
147
 
264
  }
265
 
266
  // Get value.
267
+ $block = ( isset( $_POST['wpmem_block'] ) ) ? sanitize_text_field( $_POST['wpmem_block'] ) : null;
268
 
269
  // Need the post object.
270
  global $post;
301
  */
302
  function wpmem_post_columns( $columns ) {
303
  global $wpmem;
304
+ $post_type = ( isset( $_REQUEST['post_type'] ) ) ? sanitize_text_field( $_REQUEST['post_type'] ) : 'post';
305
 
306
  if ( $post_type == 'page' || $post_type == 'post' || array_key_exists( $post_type, $wpmem->post_types ) ) {
307
  $columns['wpmem_block'] = ( $wpmem->block[ $post_type ] == 1 ) ? __( 'Unblocked?', 'wp-members' ) : __( 'Blocked?', 'wp-members' );
322
  function wpmem_post_columns_content( $column_name, $post_ID ) {
323
 
324
  global $wpmem;
325
+ $post_type = ( isset( $_REQUEST['post_type'] ) ) ? sanitize_text_field( $_REQUEST['post_type'] ) : 'post';
326
 
327
  if ( $column_name == 'wpmem_block' ) {
328
 
admin/tab-about.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
 
3
  /**
4
  * Creates the About tab.
1
  <?php
2
+ // Exit if accessed directly.
3
+ if ( ! defined( 'ABSPATH' ) ) {
4
+ exit();
5
+ }
6
 
7
  /**
8
  * Creates the About tab.
admin/tab-captcha.php CHANGED
@@ -19,6 +19,10 @@
19
  * - wpmem_update_captcha
20
  */
21
 
 
 
 
 
22
 
23
  /**
24
  * Builds the captcha options.
@@ -225,7 +229,7 @@ function wpmem_update_captcha() {
225
  check_admin_referer( 'wpmem-update-captcha' );
226
 
227
  $settings = get_option( 'wpmembers_captcha' );
228
- $update_type = $_POST['wpmem_recaptcha_type'];
229
  $new_settings = array();
230
 
231
  // If there are no current settings.
@@ -239,11 +243,11 @@ function wpmem_update_captcha() {
239
  $new_settings['really_simple'] = $settings['really_simple'];
240
  }
241
  $new_settings['recaptcha'] = array(
242
- 'public' => trim( $_POST['wpmem_captcha_publickey'] ),
243
- 'private' => trim( $_POST['wpmem_captcha_privatekey'] ),
244
  );
245
  if ( $update_type == 'recaptcha' && isset( $_POST['wpmem_captcha_theme'] ) ) {
246
- $new_settings['recaptcha']['theme'] = $_POST['wpmem_captcha_theme'];
247
  }
248
  }
249
 
@@ -252,18 +256,18 @@ function wpmem_update_captcha() {
252
  // Updating really_simple but need to maintain recaptcha.
253
  $new_settings['recaptcha'] = $settings['recaptcha'];
254
  }
255
- $font_color = $_POST['font_color_r'] . ',' . $_POST['font_color_g'] . ',' . $_POST['font_color_b'];
256
- $bg_color = $_POST['bg_color_r'] . ',' . $_POST['bg_color_g'] . ',' . $_POST['bg_color_b'];
257
  $new_settings['really_simple'] = array(
258
- 'characters' => $_POST['characters'],
259
- 'num_char' => $_POST['num_char'],
260
- 'dim_w' => $_POST['dim_w'],
261
- 'dim_h' => $_POST['dim_h'],
262
  'font_color' => $font_color,
263
  'bg_color' => $bg_color,
264
- 'font_size' => $_POST['font_size'],
265
- 'kerning' => $_POST['kerning'],
266
- 'img_type' => $_POST['img_type'],
267
  );
268
  }
269
 
19
  * - wpmem_update_captcha
20
  */
21
 
22
+ // Exit if accessed directly.
23
+ if ( ! defined( 'ABSPATH' ) ) {
24
+ exit();
25
+ }
26
 
27
  /**
28
  * Builds the captcha options.
229
  check_admin_referer( 'wpmem-update-captcha' );
230
 
231
  $settings = get_option( 'wpmembers_captcha' );
232
+ $update_type = sanitize_text_field( $_POST['wpmem_recaptcha_type'] );
233
  $new_settings = array();
234
 
235
  // If there are no current settings.
243
  $new_settings['really_simple'] = $settings['really_simple'];
244
  }
245
  $new_settings['recaptcha'] = array(
246
+ 'public' => sanitize_text_field( $_POST['wpmem_captcha_publickey'] ),
247
+ 'private' => sanitize_text_field( $_POST['wpmem_captcha_privatekey'] ),
248
  );
249
  if ( $update_type == 'recaptcha' && isset( $_POST['wpmem_captcha_theme'] ) ) {
250
+ $new_settings['recaptcha']['theme'] = sanitize_text_field( $_POST['wpmem_captcha_theme'] );
251
  }
252
  }
253
 
256
  // Updating really_simple but need to maintain recaptcha.
257
  $new_settings['recaptcha'] = $settings['recaptcha'];
258
  }
259
+ $font_color = sanitize_text_field( $_POST['font_color_r'] ) . ',' . sanitize_text_field( $_POST['font_color_g'] ) . ',' . sanitize_text_field( $_POST['font_color_b'] );
260
+ $bg_color = sanitize_text_field( $_POST['bg_color_r'] ) . ',' . sanitize_text_field( $_POST['bg_color_g'] ) . ',' . sanitize_text_field( $_POST['bg_color_b'] );
261
  $new_settings['really_simple'] = array(
262
+ 'characters' => sanitize_text_field( $_POST['characters'] ),
263
+ 'num_char' => sanitize_text_field( $_POST['num_char'] ),
264
+ 'dim_w' => sanitize_text_field( $_POST['dim_w'] ),
265
+ 'dim_h' => sanitize_text_field( $_POST['dim_h'] ),
266
  'font_color' => $font_color,
267
  'bg_color' => $bg_color,
268
+ 'font_size' => sanitize_text_field( $_POST['font_size'] ),
269
+ 'kerning' => sanitize_text_field( $_POST['kerning'] ),
270
+ 'img_type' => sanitize_text_field( $_POST['img_type'] ),
271
  );
272
  }
273
 
admin/tab-dialogs.php CHANGED
@@ -18,6 +18,10 @@
18
  * - wpmem_update_dialogs
19
  */
20
 
 
 
 
 
21
 
22
  /**
23
  * Builds the dialogs panel.
@@ -46,7 +50,7 @@ function wpmem_a_build_dialogs() {
46
  <h3><span>WP-Members <?php _e( 'Dialogs and Error Messages', 'wp-members' ); ?></span></h3>
47
  <div class="inside">
48
  <p><?php printf( __( 'You can customize the text for dialogs and error messages. Simple HTML is allowed %s etc.', 'wp-members' ), '- &lt;p&gt;, &lt;b&gt;, &lt;i&gt;,' ); ?></p>
49
- <form name="updatedialogform" id="updatedialogform" method="post" action="<?php echo wpmem_admin_form_post_url(); ?>">
50
  <?php wp_nonce_field( 'wpmem-update-dialogs' ); ?>
51
  <table class="form-table">
52
  <?php if ( ! empty ( $wpmem->admin->dialogs ) ) {
@@ -57,7 +61,7 @@ function wpmem_a_build_dialogs() {
57
  <?php $wpmem_tos = stripslashes( get_option( 'wpmembers_tos' ) ); ?>
58
  <tr valign="top">
59
  <th scope="row"><?php _e( 'Terms of Service (TOS)', 'wp-members' ); ?></th>
60
- <td><textarea name="dialogs_tos" rows="3" cols="50" id="" class="large-text code"><?php echo $wpmem_tos; ?></textarea></td>
61
  </tr>
62
  <tr valign="top">
63
  <th scope="row">&nbsp;</th>
@@ -97,7 +101,7 @@ function wpmem_update_dialogs() {
97
  }
98
 
99
  // Terms of Service.
100
- update_option( 'wpmembers_tos', $_POST['dialogs_tos'] );
101
 
102
  return __( 'WP-Members dialogs were updated', 'wp-members' );
103
  }
18
  * - wpmem_update_dialogs
19
  */
20
 
21
+ // Exit if accessed directly.
22
+ if ( ! defined( 'ABSPATH' ) ) {
23
+ exit();
24
+ }
25
 
26
  /**
27
  * Builds the dialogs panel.
50
  <h3><span>WP-Members <?php _e( 'Dialogs and Error Messages', 'wp-members' ); ?></span></h3>
51
  <div class="inside">
52
  <p><?php printf( __( 'You can customize the text for dialogs and error messages. Simple HTML is allowed %s etc.', 'wp-members' ), '- &lt;p&gt;, &lt;b&gt;, &lt;i&gt;,' ); ?></p>
53
+ <form name="updatedialogform" id="updatedialogform" method="post" action="<?php echo esc_url( wpmem_admin_form_post_url() ); ?>">
54
  <?php wp_nonce_field( 'wpmem-update-dialogs' ); ?>
55
  <table class="form-table">
56
  <?php if ( ! empty ( $wpmem->admin->dialogs ) ) {
61
  <?php $wpmem_tos = stripslashes( get_option( 'wpmembers_tos' ) ); ?>
62
  <tr valign="top">
63
  <th scope="row"><?php _e( 'Terms of Service (TOS)', 'wp-members' ); ?></th>
64
+ <td><textarea name="dialogs_tos" rows="3" cols="50" id="" class="large-text code"><?php echo esc_textarea( $wpmem_tos ); ?></textarea></td>
65
  </tr>
66
  <tr valign="top">
67
  <th scope="row">&nbsp;</th>
101
  }
102
 
103
  // Terms of Service.
104
+ update_option( 'wpmembers_tos', wp_kses( $_POST['dialogs_tos'], 'post' ) );
105
 
106
  return __( 'WP-Members dialogs were updated', 'wp-members' );
107
  }
admin/tab-dropins.php ADDED
@@ -0,0 +1,391 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <?php
2
+ /**
3
+ * WP-Members Dropins Admin Functions
4
+ *
5
+ * This file is part of the WP-Members plugin by Chad Butler
6
+ * You can find out more about this plugin at http://rocketgeek.com/plugins/wp-members/extensions/editor/
7
+ * Copyright (c) 2006-2017 Chad Butler
8
+ * WP-Members(tm) is a trademark of butlerblog.com
9
+ *
10
+ * @package WP-Members
11
+ * @subpackage WP-Members Editor
12
+ * @author Chad Butler
13
+ * @copyright 2006-2017
14
+ */
15
+
16
+ // Exit if accessed directly.
17
+ if ( ! defined( 'ABSPATH' ) ) {
18
+ exit();
19
+ }
20
+
21
+ /**
22
+ * Load WP_Members_Fields_Table object
23
+ */
24
+ if( ! class_exists( 'WP_List_Table' ) ) {
25
+ require_once( ABSPATH . 'wp-admin/includes/class-wp-list-table.php' );
26
+ }
27
+
28
+ /**
29
+ * Display the Dropins tab.
30
+ *
31
+ * @since 3.1.9
32
+ *
33
+ * @global $wpmem
34
+ */
35
+ function wpmem_dropins_render_tab() { ?>
36
+ <div class="wrap">
37
+ <?php
38
+
39
+ global $wpmem;
40
+
41
+ // Get old settings to see if they are being updated.
42
+ $old_settings = get_option( 'wpmembers_dropins' );
43
+
44
+ // Update settings.
45
+ $wpmem_dropins_saved = false;
46
+ if ( ( isset( $_GET['tab'] ) && $_GET['tab'] == 'dropins' ) && isset( $_POST['wpmembers_dropins'] ) ) {
47
+ $settings = array();
48
+ $post_vals = wpmem_get( 'wpmembers_dropins', false );
49
+ if ( $post_vals ) {
50
+ foreach ( $post_vals as $key => $val ) {
51
+ // Check against default strings. Only save if different.
52
+ if ( html_entity_decode( wpmem_gettext( $key ) ) != html_entity_decode( $val ) ) {
53
+ $settings['text'][ $key ] = $val;
54
+ } else {
55
+ if ( ! empty( $old_settings['text'] ) && array_key_exists( $key, $old_settings['text'] ) ) {
56
+ $settings['text'][ $key ] = $val;
57
+ }
58
+ }
59
+ }
60
+ // Double check settings for defaults.
61
+ foreach ( $settings['text'] as $k => $v ) {
62
+ if ( wpmem_gettext( $k ) == $v ) {
63
+ unset( $settings['text'][ $k ] );
64
+ }
65
+ }
66
+ }
67
+
68
+ // If there are any changes, update settings.
69
+ if ( ! empty( $settings ) ) {
70
+ update_option( 'wpmembers_dropins', $settings );
71
+ } else {
72
+ // Delete if empty.
73
+ delete_option( 'wpmembers_dropins' );
74
+ }
75
+
76
+ $wpmem_dropins_saved = true;
77
+ }
78
+ if ( $wpmem_dropins_saved ) { ?>
79
+ <div id="message" class="message"><p><strong><?php _e( 'WP-Members Dropin settings were updated', 'wp-members' ); ?></strong></p></div>
80
+ <?php } ?>
81
+
82
+ <?php
83
+ }
84
+
85
+ /**
86
+ * Adds Dropins Tab to the admin tab array.
87
+ *
88
+ * @since 3.1.9
89
+ *
90
+ * @param array $tabs The WP-Members admin panel tabs array.
91
+ */
92
+ function wpmem_add_dropins_tab( $tabs ) {
93
+ return array_merge(
94
+ array_slice( $tabs, 0, 1 ),
95
+ array( 'dropins' => 'Dropins' ),
96
+ array_slice( $tabs, 1 )
97
+ );
98
+ }
99
+
100
+ /**
101
+ * Builds the Dropins tab in the admin.
102
+ *
103
+ * @since 3.1.9
104
+ *
105
+ * @param string $tab The WP-Members admin panel tab being displayed.
106
+ */
107
+ function wpmem_render_dropins_tab( $tab ) {
108
+ if ( $tab == 'dropins' ) {
109
+ wpmem_a_render_dropins_table();
110
+ }
111
+ return;
112
+ }
113
+
114
+ /**
115
+ * Check dropins directory.
116
+ *
117
+ * @since 3.1.9
118
+ *
119
+ * @return boolean
120
+ */
121
+ function wpmem_dropins_check_dir() {
122
+
123
+ /** This filter is documented in inc/class-wp-members.php */
124
+ $folder = apply_filters( 'wpmem_dropin_folder', WPMEM_DROPIN_DIR );
125
+ $check = false;
126
+ if ( file_exists( $folder ) ) {
127
+ $file = $folder . '.htaccess';
128
+ if ( ! file_exists ( $file ) ) {
129
+ $check = wpmem_dropins_create_htaccess( $file );
130
+ } else {
131
+ $handle = fopen( $file, "r" );
132
+ if ( $handle ) {
133
+ // Read file line-by-line
134
+ while ( ( $buffer = fgets( $handle ) ) !== false ) {
135
+ if ( strpos( $buffer, "Options -Indexes" ) !== false )
136
+ $check = true;
137
+ break;
138
+ }
139
+ }
140
+ fclose( $handle );
141
+ $check = ( false === $check ) ? wpmem_dropins_create_htaccess( $file ) : $check;
142
+ }
143
+ }
144
+ return $check;
145
+ }
146
+
147
+ /**
148
+ * Creates .htaccess in dropins directory if none exists.
149
+ *
150
+ * @since 3.1.9
151
+ *
152
+ * @param string
153
+ * @return boolean
154
+ */
155
+ function wpmem_dropins_create_htaccess( $file ) {
156
+ $handle = fopen( $file, "w" );
157
+ fwrite( $handle, "Options -Indexes" );
158
+ fclose( $handle );
159
+ return ( $handle ) ? true : false;
160
+ }
161
+
162
+ /**
163
+ * Function to display the table of fields in the field manager tab.
164
+ *
165
+ * @since 3.1.9
166
+ *
167
+ * @global object $wpmem
168
+ */
169
+ function wpmem_a_render_dropins_table() {
170
+ global $wpmem;
171
+
172
+ // Get the dropin folder.
173
+ $folder = apply_filters( 'wpmem_dropin_folder', WPMEM_DROPIN_DIR );
174
+
175
+ // Set file headers for dropins.
176
+ $headers = array(
177
+ 'Dropin Name' => 'Dropin Name',
178
+ 'Dropin Description' => 'Dropin Description',
179
+ 'Version' => 'Version',
180
+ );
181
+
182
+ // Array container for dropin file info.
183
+ $field_items = array();
184
+
185
+ // Parse dropins.
186
+ foreach ( glob( $folder . '*.php' ) as $filename ) {
187
+ $file_data = get_file_data( $filename, $headers );
188
+
189
+ $filename = explode( '/', $filename );
190
+ $filename = end( $filename );
191
+ if ( ! empty( $file_data['Dropin Name'] ) ) {
192
+ $field_items[] = array(
193
+ 'dropin_name' => $file_data['Dropin Name'],
194
+ 'dropin_file' => $filename,
195
+ 'dropin_version' => $file_data['Version'],
196
+ 'dropin_description' => $file_data['Dropin Description'],
197
+ );
198
+ }
199
+ }
200
+
201
+ // Set up table.
202
+ $table = new WP_Members_Dropins_Table();
203
+
204
+ $heading = __( 'Manage Dropins', 'wp-members' );
205
+ $loc_info = __( 'Current dropin folder: ', 'wp-members' );
206
+ $loc_desc = __( 'You can change location of the dropin folder using the <code>wpmem_dropin_folder</code> filter.', 'wp-members' );
207
+ echo '<div class="wrap">';
208
+ printf( '<h3 class="title">%s</h3>', $heading );
209
+ printf( '<p><strong>%s</strong></p>', $loc_info );
210
+ printf( '<p>%s</p>', $loc_desc );
211
+ printf( '<form name="updatedropinsform" id="updatedropinsform" method="post" action="%s">', wpmem_admin_form_post_url() );
212
+ $table->items = $field_items;
213
+ $table->prepare_items();
214
+ $table->display();
215
+ echo '</form>';
216
+ echo '</div>';
217
+ }
218
+
219
+ /**
220
+ * Extends the WP_List_Table to create a table of dropin files.
221
+ *
222
+ * @since 3.1.9
223
+ */
224
+ class WP_Members_Dropins_Table extends WP_List_Table {
225
+
226
+ /**
227
+ * Constructor.
228
+ *
229
+ * @since 3.1.9
230
+ */
231
+ function __construct(){
232
+ global $status, $page;
233
+
234
+ //Set parent defaults
235
+ parent::__construct( array(
236
+ 'singular' => 'dropin',
237
+ 'plural' => 'dropins',
238
+ 'ajax' => false,
239
+ ) );
240
+
241
+ $this->dropins = get_option( 'wpmembers_dropins', array() ); //print_r( $this->dropins );
242
+ }
243
+
244
+ /**
245
+ * Checkbox at start of row.
246
+ *
247
+ * @since 3.1.9
248
+ *
249
+ * @param $item
250
+ * @return string The checkbox.
251
+ */
252
+ function column_cb( $item ) {
253
+ global $wpmem;
254
+ $checked = checked( true, in_array( $item['dropin_file'], $wpmem->dropins_enabled ), false );
255
+ //return sprintf( '<input type="checkbox" name="delete[]" value="%s" title="%s" />', $item['dropin_file'], __( 'delete', 'wp-members' ) );
256
+ return sprintf( '<input type="checkbox" name="%s[]" value="%s" %s />', $this->_args['singular'], $item['dropin_file'], $checked );
257
+ }
258
+
259
+ /**
260
+ * Returns table columns.
261
+ *
262
+ * @since 3.1.9
263
+ *
264
+ * @return array
265
+ */
266
+ function get_columns() {
267
+ return array(
268
+ 'cb' => '<input type="checkbox" />',
269
+ 'dropin_name' => __( 'Name', 'wp-members' ),
270
+ 'dropin_file' => __( 'File', 'wp-members' ),
271
+ 'dropin_version' => __( 'Version', 'wp-members' ),
272
+ 'dropin_description' => __( 'Description', 'wp-members' ),
273
+ );
274
+ }
275
+
276
+ /**
277
+ * Set up table columns.
278
+ *
279
+ * @since 3.1.9
280
+ */
281
+ function prepare_items() {
282
+ $columns = $this->get_columns();
283
+ $hidden = array();
284
+ $sortable = array();
285
+ $this->_column_headers = array( $columns, $hidden, $sortable );
286
+ $this->process_bulk_action();
287
+ }
288
+
289
+ /**
290
+ * Iterates through the columns
291
+ *
292
+ * @since 3.1.9
293
+ *
294
+ * @param array $item
295
+ * @param string $column_name
296
+ * @return string $item[ $column_name ]
297
+ */
298
+ function column_default( $item, $column_name ) {
299
+ switch( $column_name ) {
300
+ default:
301
+ return $item[ $column_name ];
302
+ }
303
+ }
304
+
305
+ /**
306
+ * Sets actions in the bulk menu.
307
+ *
308
+ * @since 3.1.9
309
+ *
310
+ * @return array $actions
311
+ */
312
+ function get_bulk_actions() {
313
+ $actions = array(
314
+ //'delete' => __( 'Delete Selected', 'wp-members' ),
315
+ 'save' => __( 'Save Settings', 'wp-members' ),
316
+ );
317
+ return $actions;
318
+ }
319
+
320
+ /**
321
+ * Handles "delete" column - checkbox
322
+ *
323
+ * @since 3.1.9
324
+ *
325
+ * @param array $item
326
+ * @return string
327
+ */
328
+ function column_delete( $item ) {
329
+
330
+ }
331
+
332
+ /**
333
+ * Sets rows so that they have field IDs in the id.
334
+ *
335
+ * @since 3.1.9
336
+ *
337
+ * @global wpmem
338
+ * @param array $columns
339
+ */
340
+ function single_row( $columns ) {
341
+ echo '<tr id="list_items_' . $columns['dropin_name'] . '" class="list_item" list_item="' . $columns['dropin_name'] . '">';
342
+ echo $this->single_row_columns( $columns );
343
+ echo "</tr>\n";
344
+ }
345
+
346
+ public function process_bulk_action() {
347
+
348
+ global $wpmem;
349
+
350
+ //nonce validations,etc
351
+
352
+ $dir_chk = wpmem_dropins_check_dir();
353
+
354
+ //echo ( $dir_chk ) ? '.htaccess OK!' : 'NO .htaccess!!!';
355
+
356
+ $action = $this->current_action();
357
+
358
+ switch ( $action ) {
359
+
360
+ case 'delete':
361
+
362
+ // Do whatever you want
363
+ //wp_redirect( esc_url( add_query_arg() ) );
364
+ break;
365
+
366
+ case 'save':
367
+ $settings = array();
368
+ //echo "SAVING SETTINGS";print_r( $_REQUEST['dropin'] );
369
+ if ( wpmem_get( 'dropin' ) ) {
370
+ foreach( wpmem_get( 'dropin' ) as $dropin ) {
371
+ $settings[] = $dropin;
372
+ }
373
+ update_option( 'wpmembers_dropins', $settings, true );
374
+ } else {
375
+ delete_option( 'wpmembers_dropins' );
376
+ }
377
+ $wpmem->dropins_enabled = $settings;
378
+ echo '<div id="message" class="message"><p><strong>' . __( 'WP-Members Dropin settings were updated', 'wp-members' ) . '</strong></p></div>';
379
+ break;
380
+
381
+ default:
382
+ // do nothing or something else
383
+ return;
384
+ break;
385
+ }
386
+ return;
387
+ }
388
+
389
+ }
390
+
391
+ // End of file.
admin/tab-emails.php CHANGED
@@ -18,6 +18,10 @@
18
  * - wpmem_update_emails
19
  */
20
 
 
 
 
 
21
 
22
  /**
23
  * Builds the emails panel.
@@ -42,16 +46,16 @@ function wpmem_a_build_emails() {
42
  <?php _e( 'A list of shortcodes is available here.', 'wp-members' ); ?></a>
43
  </p>
44
  <hr />
45
- <form name="updateemailform" id="updateemailform" method="post" action="<?php echo wpmem_admin_form_post_url(); ?>">
46
  <?php wp_nonce_field( 'wpmem-update-emails' ); ?>
47
  <table class="form-table">
48
  <tr valign="top">
49
  <th scope="row"><?php _e( 'Set a custom email address', 'wp-members' ); ?></th>
50
- <td><input type="text" name="wp_mail_from" size="40" value="<?php echo $wpmem->email['from']; ?>" />&nbsp;<span class="description"><?php _e( '(optional)', 'wp-members' ); ?> email@yourdomain.com</span></td>
51
  </tr>
52
  <tr valign="top">
53
  <th scope="row"><?php _e( 'Set a custom email name', 'wp-members' ); ?></th>
54
- <td><input type="text" name="wp_mail_from_name" size="40" value="<?php echo stripslashes( $wpmem->email['from_name'] ); ?>" />&nbsp;<span class="description"><?php _e( '(optional)', 'wp-members' ); ?> John Smith</span></td>
55
  </tr>
56
  <tr><td colspan="2"><hr /></td></tr>
57
  <?php if ( ! empty ( $wpmem->admin->emails ) ) {
@@ -62,7 +66,7 @@ function wpmem_a_build_emails() {
62
  $arr = get_option( 'wpmembers_email_footer' ); ?>
63
  <tr valign="top">
64
  <th scope="row"><strong><?php echo __( "Email Signature", 'wp-members' ); ?></strong> <span class="description"><?php _e( '(optional)', 'wp-members' ); ?></span></th>
65
- <td><textarea name="<?php echo 'wpmembers_email_footer_body'; ?>" rows="10" cols="50" id="" class="large-text code"><?php echo stripslashes( $arr ); ?></textarea></td>
66
  </tr>
67
  <tr><td colspan="2"><hr /></td></tr>
68
  <tr valign="top">
@@ -106,11 +110,11 @@ function wpmem_update_emails() {
106
 
107
  // Update the email address (if applicable).
108
  if ( $wpmem->email['from'] != $_POST['wp_mail_from'] || $wpmem->email['from_name'] != $_POST['wp_mail_from_name'] ) {
109
- $wpmem->email['from'] = $_POST['wp_mail_from'];
110
- $wpmem->email['from_name'] = $_POST['wp_mail_from_name'];
111
  $wpmem_newsettings = get_option( 'wpmembers_settings' );
112
- $wpmem_newsettings['email']['from'] = $_POST['wp_mail_from'];
113
- $wpmem_newsettings['email']['from_name'] = $_POST['wp_mail_from_name'];
114
  update_option( 'wpmembers_settings', $wpmem_newsettings );
115
  }
116
 
@@ -123,15 +127,15 @@ function wpmem_update_emails() {
123
 
124
  for ( $row = 0; $row < ( count( $arr ) - 1 ); $row++ ) {
125
  $arr2 = array(
126
- "subj" => $_POST[ $arr[ $row ] . '_subj' ],
127
- "body" => $_POST[ $arr[ $row ] . '_body' ],
128
  );
129
  update_option( $arr[ $row ], $arr2, false );
130
  $arr2 = '';
131
  }
132
 
133
  // Updated the email footer.
134
- update_option( $arr[ $row ], $_POST[ $arr[ $row ] . '_body' ], false );
135
 
136
  if ( ! empty ( $wpmem->admin->emails ) ) {
137
  foreach( $wpmem->admin->emails as $email ) {
18
  * - wpmem_update_emails
19
  */
20
 
21
+ // Exit if accessed directly.
22
+ if ( ! defined( 'ABSPATH' ) ) {
23
+ exit();
24
+ }
25
 
26
  /**
27
  * Builds the emails panel.
46
  <?php _e( 'A list of shortcodes is available here.', 'wp-members' ); ?></a>
47
  </p>
48
  <hr />
49
+ <form name="updateemailform" id="updateemailform" method="post" action="<?php echo esc_url( wpmem_admin_form_post_url() ); ?>">
50
  <?php wp_nonce_field( 'wpmem-update-emails' ); ?>
51
  <table class="form-table">
52
  <tr valign="top">
53
  <th scope="row"><?php _e( 'Set a custom email address', 'wp-members' ); ?></th>
54
+ <td><input type="text" name="wp_mail_from" size="40" value="<?php echo esc_attr( $wpmem->email['from'] ); ?>" />&nbsp;<span class="description"><?php _e( '(optional)', 'wp-members' ); ?> email@yourdomain.com</span></td>
55
  </tr>
56
  <tr valign="top">
57
  <th scope="row"><?php _e( 'Set a custom email name', 'wp-members' ); ?></th>
58
+ <td><input type="text" name="wp_mail_from_name" size="40" value="<?php echo esc_attr( stripslashes( $wpmem->email['from_name'] ) ); ?>" />&nbsp;<span class="description"><?php _e( '(optional)', 'wp-members' ); ?> John Smith</span></td>
59
  </tr>
60
  <tr><td colspan="2"><hr /></td></tr>
61
  <?php if ( ! empty ( $wpmem->admin->emails ) ) {
66
  $arr = get_option( 'wpmembers_email_footer' ); ?>
67
  <tr valign="top">
68
  <th scope="row"><strong><?php echo __( "Email Signature", 'wp-members' ); ?></strong> <span class="description"><?php _e( '(optional)', 'wp-members' ); ?></span></th>
69
+ <td><textarea name="<?php echo 'wpmembers_email_footer_body'; ?>" rows="10" cols="50" id="" class="large-text code"><?php echo esc_textarea( stripslashes( $arr ) ); ?></textarea></td>
70
  </tr>
71
  <tr><td colspan="2"><hr /></td></tr>
72
  <tr valign="top">
110
 
111
  // Update the email address (if applicable).
112
  if ( $wpmem->email['from'] != $_POST['wp_mail_from'] || $wpmem->email['from_name'] != $_POST['wp_mail_from_name'] ) {
113
+ $wpmem->email['from'] = sanitize_email( $_POST['wp_mail_from'] );
114
+ $wpmem->email['from_name'] = sanitize_text_field( $_POST['wp_mail_from_name'] );
115
  $wpmem_newsettings = get_option( 'wpmembers_settings' );
116
+ $wpmem_newsettings['email']['from'] = sanitize_email( $_POST['wp_mail_from'] );
117
+ $wpmem_newsettings['email']['from_name'] = sanitize_text_field( $_POST['wp_mail_from_name'] );
118
  update_option( 'wpmembers_settings', $wpmem_newsettings );
119
  }
120
 
127
 
128
  for ( $row = 0; $row < ( count( $arr ) - 1 ); $row++ ) {
129
  $arr2 = array(
130
+ "subj" => sanitize_text_field( $_POST[ $arr[ $row ] . '_subj' ] ),
131
+ "body" => wp_kses( $_POST[ $arr[ $row ] . '_body' ], 'post' ),
132
  );
133
  update_option( $arr[ $row ], $arr2, false );
134
  $arr2 = '';
135
  }
136
 
137
  // Updated the email footer.
138
+ update_option( $arr[ $row ], wp_kses( $_POST[ $arr[ $row ] . '_body' ], 'post' ), false );
139
 
140
  if ( ! empty ( $wpmem->admin->emails ) ) {
141
  foreach( $wpmem->admin->emails as $email ) {
admin/tab-fields.php CHANGED
@@ -14,6 +14,11 @@
14
  * @copyright 2006-2017
15
  */
16
 
 
 
 
 
 
17
  /**
18
  * Load WP_Members_Fields_Table object
19
  */
@@ -96,8 +101,8 @@ function wpmem_a_render_fields_tab() {
96
 
97
  global $wpmem, $did_update, $delete_action;
98
  $wpmem_fields = wpmem_fields();
99
- $edit_meta = wpmem_get( 'field', false, 'get' );
100
- $add_meta = wpmem_get( 'add_field', false );
101
 
102
  if ( 'delete' == $delete_action ) {
103
  $delete_fields = wpmem_get( 'delete' ); ?>
@@ -105,11 +110,12 @@ function wpmem_a_render_fields_tab() {
105
  <p><?php _e( 'Are you sure you want to delete the following fields?', 'wp-members' ); ?></p>
106
 
107
  <?php foreach ( $delete_fields as $meta ) {
108
- echo $wpmem->fields[ $meta ]['label'] . ' (meta key: ' . $meta . ')<br />';
 
109
  } ?>
110
- <form name="<?php echo $delete_action; ?>" id="<?php echo $delete_action; ?>" method="post" action="<?php echo wpmem_admin_form_post_url(); ?>">
111
  <?php // wp_nonce_field( 'wpmem-delete-fields' ); ?>
112
- <input type="hidden" name="delete_fields" value="<?php echo implode( ",", $delete_fields ); ?>" />
113
  <input type="hidden" name="dodelete" value="delete_confirmed" />
114
  <?php submit_button( 'Delete Fields' ); ?>
115
  </form><?php
@@ -119,7 +125,8 @@ function wpmem_a_render_fields_tab() {
119
  if ( 'delete_confirmed' == wpmem_get( 'dodelete' ) ) {
120
  // validate wpmem-delete-fields nonce
121
 
122
- $delete_fields = explode( ",", wpmem_get( 'delete_fields', array() ) );
 
123
  $wpmem_new_fields = array();
124
  foreach ( $wpmem_fields as $field ) {
125
  if ( ! in_array( $field[2], $delete_fields ) ) {
@@ -134,7 +141,7 @@ function wpmem_a_render_fields_tab() {
134
  <div id="message" class="updated fade"><p><strong><?php echo $did_update; ?></strong></p></div>
135
  <?php }
136
  if ( $edit_meta || $add_meta ) {
137
- $mode = ( $edit_meta ) ? wpmem_get( 'mode', false, 'get' ) : 'add';
138
  wpmem_a_render_fields_tab_field_edit( $mode, $wpmem_fields, $edit_meta );
139
  } else {
140
  wpmem_a_render_fields_tab_field_table();
@@ -284,7 +291,7 @@ function wpmem_a_render_fields_tab_field_edit( $mode, $wpmem_fields, $meta_key )
284
  </li>
285
  <li>
286
  <label><?php _e( 'Stored value if checked:', 'wp-members' ); ?> <span class="req"><?php _e( '(required)', 'wp-members' ); ?></span></label>
287
- <input type="text" name="add_checked_value" value="<?php echo ( $mode == 'edit' && $field['type'] == 'checkbox' ) ? $field['checked_value'] : false; ?>" class="small-text" />
288
  </li>
289
  <?php echo ( $mode == 'add' ) ? '</div>' : ''; ?>
290
  <?php }
@@ -387,6 +394,8 @@ function wpmem_a_render_fields_tab_field_table() {
387
 
388
  $wpmem_ut_fields_skip = array( 'user_email', 'confirm_email', 'password', 'confirm_password' );
389
  $wpmem_ut_fields = get_option( 'wpmembers_utfields' );
 
 
390
 
391
  $wpmem_fields = get_option( 'wpmembers_fields', array() );
392
  foreach ( $wpmem_fields as $key => $field ) {
@@ -395,8 +404,8 @@ function wpmem_a_render_fields_tab_field_table() {
395
  if ( is_numeric( $key ) ) {
396
 
397
  $meta = $field[2];
398
-
399
  $ut_checked = ( ( $wpmem_ut_fields ) && ( in_array( $field[1], $wpmem_ut_fields ) ) ) ? $field[1] : '';
 
400
  $field_items[] = array(
401
  'order' => $field[0],
402
  'label' => $field[1],
@@ -406,40 +415,47 @@ function wpmem_a_render_fields_tab_field_table() {
406
  'req' => ( $meta != 'user_email' ) ? wpmem_create_formfield( $meta . "_required", 'checkbox', 'y', $field[5] ) : '',
407
  //'profile' => ( $meta != 'user_email' ) ? wpmem_create_formfield( $meta . "_profile", 'checkbox', true, $field[6] ) : '',
408
  'edit' => wpmem_fields_edit_link( $meta ),
409
- 'userscrn' => ( ! in_array( $meta, $wpmem_ut_fields_skip ) ) ? wpmem_create_formfield( 'ut_fields[' . $meta . ']', 'checkbox', $field[1], $ut_checked ) : '',
 
410
  'sort' => '<span class="ui-icon ui-icon-grip-dotted-horizontal" title="' . __( 'Drag and drop to reorder fields', 'wp-members' ) . '"></span>',
411
  );
412
  }
413
  }
414
 
415
- $extra_user_screen_items = array(
416
- 'user_registered' => 'Registration Date',
417
- 'active' => 'Active',
418
- 'wpmem_reg_ip' => 'Registration IP',
419
- 'exp_type' => 'Subscription Type',
420
- 'expires' => 'Expires',
 
421
  );
422
 
423
  foreach ( $extra_user_screen_items as $key => $item ) {
424
  $ut_checked = ( ( $wpmem_ut_fields ) && ( in_array( $item, $wpmem_ut_fields ) ) ) ? $item : '';
425
- if ( 'user_registered' == $key || ( 'active' == $key && 1 == $wpmem->mod_reg ) || 'wpmem_reg_ip' == $key || defined( 'WPMEM_EXP_MODULE' ) && $wpmem->use_exp == 1 && ( 'exp_type' == $key || 'expires' == $key ) ) {
 
 
 
 
426
  $user_screen_items[ $key ] = array( 'label' => __( $item, 'wp-members' ), 'meta' => $key,
427
  'userscrn' => wpmem_create_formfield( "ut_fields[{$key}]", 'checkbox', $item, $ut_checked ),
428
  );
429
  }
430
  }
431
-
432
  foreach ( $user_screen_items as $screen_item ) {
433
  $field_items[] = array(
434
- 'label' => $screen_item['label'],
435
- 'meta' => $screen_item['meta'],
436
- 'type' => '',
437
- 'display' => '',
438
- 'req' => '',
439
- 'profile' => '',
440
- 'edit' => '',
441
  'userscrn' => $screen_item['userscrn'],
442
- 'sort' => '',
 
443
  );
444
  }
445
 
@@ -468,7 +484,7 @@ function wpmem_a_render_fields_tab_field_table() {
468
  */
469
  class WP_Members_Fields_Table extends WP_List_Table {
470
 
471
- private $excludes = array( 'user_registered', 'active', 'wpmem_reg_ip', 'exp_type', 'expires' );
472
 
473
  private $no_delete = array( 'user_email', 'first_name', 'last_name', 'user_url' );
474
 
@@ -506,6 +522,7 @@ class WP_Members_Fields_Table extends WP_List_Table {
506
  //'profile' => __( 'Profile Only', 'wp-members' ),
507
  'edit' => __( 'Edit', 'wp-members' ),
508
  'userscrn' => __( 'Users Screen', 'wp-members' ),
 
509
  'sort' => '',
510
  );
511
  }
@@ -576,11 +593,11 @@ class WP_Members_Fields_Table extends WP_List_Table {
576
  */
577
  function single_row( $columns ) {
578
  if ( in_array( $columns['meta'], $this->excludes ) ) {
579
- echo '<tr id="' . $columns['meta'] . '" class="nodrag nodrop">';
580
  echo $this->single_row_columns( $columns );
581
  echo "</tr>\n";
582
  } else {
583
- echo '<tr id="list_items_' . $columns['order'] . '" class="list_item" list_item="' . $columns['order'] . '">';
584
  echo $this->single_row_columns( $columns );
585
  echo "</tr>\n";
586
  }
@@ -617,8 +634,7 @@ class WP_Members_Fields_Table extends WP_List_Table {
617
  */
618
  add_action( 'admin_footer', 'wpmem_bulk_fields_action' );
619
  function wpmem_bulk_fields_action() {
620
- // if ( isset( $_GET['tab'] ) && $_GET['tab'] == 'fields' ) {
621
- if ( isset( $_GET['tab'] ) && $_GET['tab'] == 'fields' ) {
622
  ?><script type="text/javascript">
623
  (function($) {
624
  $(document).ready(function() {
@@ -647,12 +663,12 @@ function wpmem_admin_fields_update() {
647
 
648
  global $wpmem, $did_update, $delete_action;
649
 
650
- if ( isset( $_GET['tab'] ) && $_GET['tab'] == 'fields' ) {
651
  // Get the current fields.
652
  $wpmem_fields = get_option( 'wpmembers_fields' );
653
 
654
- $action = wpmem_get( 'action', false );
655
- $action = ( -1 == $action ) ? wpmem_get( 'action2' ) : $action;
656
 
657
  $delete_action = false;
658
 
@@ -662,8 +678,20 @@ function wpmem_admin_fields_update() {
662
  //check_admin_referer( 'wpmem-update-fields' );
663
 
664
  // Update user table fields.
665
- $arr = ( isset( $_POST['ut_fields'] ) ) ? $_POST['ut_fields'] : '';
666
- update_option( 'wpmembers_utfields', $arr );
 
 
 
 
 
 
 
 
 
 
 
 
667
 
668
  // Update display/required settings
669
  foreach ( $wpmem_fields as $key => $field ) {
@@ -688,7 +716,7 @@ function wpmem_admin_fields_update() {
688
  } elseif ( 'add_field' == wpmem_get( 'wpmem_admin_a' ) || 'edit_field' == wpmem_get( 'wpmem_admin_a' ) ) {
689
 
690
  // Set action.
691
- $action = wpmem_get( 'wpmem_admin_a' );
692
 
693
  // Check nonce.
694
  //check_admin_referer( 'wpmem-add-fields' );
@@ -696,8 +724,8 @@ function wpmem_admin_fields_update() {
696
  global $add_field_err_msg;
697
 
698
  $add_field_err_msg = false;
699
- $add_name = wpmem_get( 'add_name' );
700
- $add_option = wpmem_get( 'add_option' );
701
 
702
  // Error check that field label and option name are included and unique.
703
  $add_field_err_msg = ( ! $add_name ) ? __( 'Field Label is required. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
@@ -723,34 +751,34 @@ function wpmem_admin_fields_update() {
723
 
724
  $arr = array();
725
 
726
- $type = wpmem_get( 'add_type' );
727
 
728
- $arr[0] = wpmem_get( 'add_order_id' );
729
- $arr[1] = stripslashes( wpmem_get( 'add_name' ) );
730
  $arr[2] = $us_option;
731
  $arr[3] = $type;
732
- $arr[4] = wpmem_get( 'add_display', 'n' );
733
- $arr[5] = wpmem_get( 'add_required', 'n' );
734
  $arr[6] = ( $us_option == 'user_nicename' || $us_option == 'display_name' || $us_option == 'nickname' ) ? 'y' : 'n';
735
 
736
  if ( 'text' == $type || 'email' == $type || 'textarea' == $type || 'password' == $type || 'url' == $type || 'number' == $type || 'date' == $type ) {
737
- $arr['placeholder'] = wpmem_get( 'add_placeholder' );
738
  }
739
 
740
  if ( 'text' == $type || 'email' == $type || 'password' == $type || 'url' == $type || 'number' == $type || 'date' == $type ) {
741
- $arr['pattern'] = wpmem_get( 'add_pattern' );
742
- $arr['title'] = wpmem_get( 'add_title' );
743
  }
744
 
745
  if ( 'number' == $type || 'date' == $type ) {
746
- $arr['min'] = wpmem_get( 'add_min' );
747
- $arr['max'] = wpmem_get( 'add_max' );
748
  }
749
 
750
  if ( $type == 'checkbox' ) {
751
  $add_field_err_msg = ( ! $_POST['add_checked_value'] ) ? __( 'Checked value is required for checkboxes. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
752
- $arr[7] = wpmem_get( 'add_checked_value', false );
753
- $arr[8] = wpmem_get( 'add_checked_default', 'n' );
754
  }
755
 
756
  if ( $type == 'select'
@@ -770,23 +798,23 @@ function wpmem_admin_fields_update() {
770
  }
771
  // If multiselect or multicheckbox, set delimiter.
772
  if ( 'multiselect' == $type || 'multicheckbox' == $type ) {
773
- $arr[8] = ( isset( $_POST['add_delimiter_value'] ) ) ? $_POST['add_delimiter_value'] : '|';
774
  }
775
  }
776
 
777
  if ( $type == 'file' || $type == 'image' ) {
778
- $arr[7] = stripslashes( $_POST['add_file_value'] );
779
  }
780
 
781
  if ( wpmem_get( 'add_type' ) == 'hidden' ) {
782
  $add_field_err_msg = ( ! $_POST['add_hidden_value'] ) ? __( 'A value is required for hidden fields. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
783
- $arr[7] = ( isset( $_POST['add_hidden_value'] ) ) ? stripslashes( $_POST['add_hidden_value'] ) : '';
784
  }
785
 
786
  if ( $action == 'add_field' ) {
787
  if ( ! $add_field_err_msg ) {
788
  array_push( $wpmem_fields, $arr );
789
- $did_update = sprintf( __( '%s was added', 'wp-members' ), $_POST['add_name'] );
790
  } else {
791
  $did_update = $add_field_err_msg;
792
  }
@@ -799,8 +827,8 @@ function wpmem_admin_fields_update() {
799
  }
800
  }
801
  }
802
- $did_update = sprintf( __( '%s was updated', 'wp-members' ), $add_name );
803
- $did_update.= '<p><a href="' . add_query_arg( array( 'page' => 'wpmem-settings', 'tab' => 'fields' ), get_admin_url() . 'options-general.php' ) . '">&laquo; ' . __( 'Return to Fields Table', 'wp-members' ) . '</a></p>';
804
  }
805
 
806
  $wpmem_newfields = $wpmem_fields;
14
  * @copyright 2006-2017
15
  */
16
 
17
+ // Exit if accessed directly.
18
+ if ( ! defined( 'ABSPATH' ) ) {
19
+ exit();
20
+ }
21
+
22
  /**
23
  * Load WP_Members_Fields_Table object
24
  */
101
 
102
  global $wpmem, $did_update, $delete_action;
103
  $wpmem_fields = wpmem_fields();
104
+ $edit_meta = sanitize_text_field( wpmem_get( 'field', false, 'get' ) );
105
+ $add_meta = sanitize_text_field( wpmem_get( 'add_field', false ) );
106
 
107
  if ( 'delete' == $delete_action ) {
108
  $delete_fields = wpmem_get( 'delete' ); ?>
110
  <p><?php _e( 'Are you sure you want to delete the following fields?', 'wp-members' ); ?></p>
111
 
112
  <?php foreach ( $delete_fields as $meta ) {
113
+ $meta = esc_html( $meta );
114
+ echo esc_html( $wpmem->fields[ $meta ]['label'] ) . ' (meta key: ' . $meta . ')<br />';
115
  } ?>
116
+ <form name="<?php echo esc_attr( $delete_action ); ?>" id="<?php echo esc_attr( $delete_action ); ?>" method="post" action="<?php echo esc_url( wpmem_admin_form_post_url() ); ?>">
117
  <?php // wp_nonce_field( 'wpmem-delete-fields' ); ?>
118
+ <input type="hidden" name="delete_fields" value="<?php echo esc_attr( implode( ",", $delete_fields ) ); ?>" />
119
  <input type="hidden" name="dodelete" value="delete_confirmed" />
120
  <?php submit_button( 'Delete Fields' ); ?>
121
  </form><?php
125
  if ( 'delete_confirmed' == wpmem_get( 'dodelete' ) ) {
126
  // validate wpmem-delete-fields nonce
127
 
128
+ $delete_fields = sanitize_text_field( wpmem_get( 'delete_fields', array() ) );
129
+ $delete_fields = explode( ",", $delete_fields );
130
  $wpmem_new_fields = array();
131
  foreach ( $wpmem_fields as $field ) {
132
  if ( ! in_array( $field[2], $delete_fields ) ) {
141
  <div id="message" class="updated fade"><p><strong><?php echo $did_update; ?></strong></p></div>
142
  <?php }
143
  if ( $edit_meta || $add_meta ) {
144
+ $mode = ( $edit_meta ) ? sanitize_text_field( wpmem_get( 'mode', false, 'get' ) ) : 'add';
145
  wpmem_a_render_fields_tab_field_edit( $mode, $wpmem_fields, $edit_meta );
146
  } else {
147
  wpmem_a_render_fields_tab_field_table();
291
  </li>
292
  <li>
293
  <label><?php _e( 'Stored value if checked:', 'wp-members' ); ?> <span class="req"><?php _e( '(required)', 'wp-members' ); ?></span></label>
294
+ <input type="text" name="add_checked_value" value="<?php echo ( $mode == 'edit' && $field['type'] == 'checkbox' ) ? $field['checked_value'] : false; ?>" />
295
  </li>
296
  <?php echo ( $mode == 'add' ) ? '</div>' : ''; ?>
297
  <?php }
394
 
395
  $wpmem_ut_fields_skip = array( 'user_email', 'confirm_email', 'password', 'confirm_password' );
396
  $wpmem_ut_fields = get_option( 'wpmembers_utfields' );
397
+ $wpmem_us_fields_skip = array( 'user_email', 'confirm_email', 'password', 'confirm_password' );
398
+ $wpmem_us_fields = get_option( 'wpmembers_usfields' );
399
 
400
  $wpmem_fields = get_option( 'wpmembers_fields', array() );
401
  foreach ( $wpmem_fields as $key => $field ) {
404
  if ( is_numeric( $key ) ) {
405
 
406
  $meta = $field[2];
 
407
  $ut_checked = ( ( $wpmem_ut_fields ) && ( in_array( $field[1], $wpmem_ut_fields ) ) ) ? $field[1] : '';
408
+ $us_checked = ( ( $wpmem_us_fields ) && ( in_array( $field[1], $wpmem_us_fields ) ) ) ? $field[1] : '';
409
  $field_items[] = array(
410
  'order' => $field[0],
411
  'label' => $field[1],
415
  'req' => ( $meta != 'user_email' ) ? wpmem_create_formfield( $meta . "_required", 'checkbox', 'y', $field[5] ) : '',
416
  //'profile' => ( $meta != 'user_email' ) ? wpmem_create_formfield( $meta . "_profile", 'checkbox', true, $field[6] ) : '',
417
  'edit' => wpmem_fields_edit_link( $meta ),
418
+ 'userscrn' => ( ! in_array( $meta, $wpmem_ut_fields_skip ) ) ? wpmem_create_formfield( 'ut_fields[' . $meta . ']', 'checkbox', $field[1], $ut_checked ) : '',
419
+ 'usearch' => ( ! in_array( $meta, $wpmem_us_fields_skip ) ) ? wpmem_create_formfield( 'us_fields[' . $meta . ']', 'checkbox', $field[1], $us_checked ) : '',
420
  'sort' => '<span class="ui-icon ui-icon-grip-dotted-horizontal" title="' . __( 'Drag and drop to reorder fields', 'wp-members' ) . '"></span>',
421
  );
422
  }
423
  }
424
 
425
+ $extra_user_screen_items = array(
426
+ 'user_registered' => __( 'Registration Date', 'wp-members' ),
427
+ 'active' => __( 'Active', 'wp-members' ),
428
+ 'wpmem_reg_ip' => __( 'Registration IP', 'wp-members' ),
429
+ 'exp_type' => __( 'Subscription Type', 'wp-members' ),
430
+ 'expires' => __( 'Expires', 'wp-members' ),
431
+ 'user_id' => __( 'User ID', 'wp-members' ),
432
  );
433
 
434
  foreach ( $extra_user_screen_items as $key => $item ) {
435
  $ut_checked = ( ( $wpmem_ut_fields ) && ( in_array( $item, $wpmem_ut_fields ) ) ) ? $item : '';
436
+ if ( 'user_id' == $key
437
+ || 'user_registered' == $key
438
+ || 'wpmem_reg_ip' == $key
439
+ || ( 'active' == $key && 1 == $wpmem->mod_reg )
440
+ || defined( 'WPMEM_EXP_MODULE' ) && $wpmem->use_exp == 1 && ( 'exp_type' == $key || 'expires' == $key ) ) {
441
  $user_screen_items[ $key ] = array( 'label' => __( $item, 'wp-members' ), 'meta' => $key,
442
  'userscrn' => wpmem_create_formfield( "ut_fields[{$key}]", 'checkbox', $item, $ut_checked ),
443
  );
444
  }
445
  }
446
+
447
  foreach ( $user_screen_items as $screen_item ) {
448
  $field_items[] = array(
449
+ 'label' => $screen_item['label'],
450
+ 'meta' => $screen_item['meta'],
451
+ 'type' => '',
452
+ 'display' => '',
453
+ 'req' => '',
454
+ 'profile' => '',
455
+ 'edit' => '',
456
  'userscrn' => $screen_item['userscrn'],
457
+ 'usearch' => '',
458
+ 'sort' => '',
459
  );
460
  }
461
 
484
  */
485
  class WP_Members_Fields_Table extends WP_List_Table {
486
 
487
+ private $excludes = array( 'user_registered', 'active', 'wpmem_reg_ip', 'exp_type', 'expires', 'user_id' );
488
 
489
  private $no_delete = array( 'user_email', 'first_name', 'last_name', 'user_url' );
490
 
522
  //'profile' => __( 'Profile Only', 'wp-members' ),
523
  'edit' => __( 'Edit', 'wp-members' ),
524
  'userscrn' => __( 'Users Screen', 'wp-members' ),
525
+ 'usearch' => __( 'Users Search', 'wp-members' ),
526
  'sort' => '',
527
  );
528
  }
593
  */
594
  function single_row( $columns ) {
595
  if ( in_array( $columns['meta'], $this->excludes ) ) {
596
+ echo '<tr id="' . esc_attr( $columns['meta'] ) . '" class="nodrag nodrop">';
597
  echo $this->single_row_columns( $columns );
598
  echo "</tr>\n";
599
  } else {
600
+ echo '<tr id="list_items_' . esc_attr( $columns['order'] ) . '" class="list_item" list_item="' . esc_attr( $columns['order'] ) . '">';
601
  echo $this->single_row_columns( $columns );
602
  echo "</tr>\n";
603
  }
634
  */
635
  add_action( 'admin_footer', 'wpmem_bulk_fields_action' );
636
  function wpmem_bulk_fields_action() {
637
+ if ( 'wpmem-settings' == wpmem_get( 'page', false, 'get' ) && 'fields' == wpmem_get( 'tab', false, 'get' ) ) {
 
638
  ?><script type="text/javascript">
639
  (function($) {
640
  $(document).ready(function() {
663
 
664
  global $wpmem, $did_update, $delete_action;
665
 
666
+ if ( 'wpmem-settings' == wpmem_get( 'page', false, 'get' ) && 'fields' == wpmem_get( 'tab', false, 'get' ) ) {
667
  // Get the current fields.
668
  $wpmem_fields = get_option( 'wpmembers_fields' );
669
 
670
+ $action = sanitize_text_field( wpmem_get( 'action', false ) );
671
+ $action = ( -1 == $action ) ? sanitize_text_field( wpmem_get( 'action2' ) ) : $action;
672
 
673
  $delete_action = false;
674
 
678
  //check_admin_referer( 'wpmem-update-fields' );
679
 
680
  // Update user table fields.
681
+ $arr = ( isset( $_POST['ut_fields'] ) ) ? $_POST['ut_fields'] : array();
682
+ $ut_fields_arr = array();
683
+ foreach ( $arr as $key => $item ) {
684
+ $ut_fields_arr[ sanitize_text_field( $key ) ] = sanitize_text_field( $item );
685
+ }
686
+ update_option( 'wpmembers_utfields', $ut_fields_arr );
687
+
688
+ // Update user search fields.
689
+ $arr = ( isset( $_POST['us_fields'] ) ) ? $_POST['us_fields'] : array();
690
+ $us_fields_arr = array();
691
+ foreach ( $arr as $key => $item ) {
692
+ $us_fields_arr[ sanitize_text_field( $key ) ] = sanitize_text_field( $item );
693
+ }
694
+ update_option( 'wpmembers_usfields', $us_fields_arr );
695
 
696
  // Update display/required settings
697
  foreach ( $wpmem_fields as $key => $field ) {
716
  } elseif ( 'add_field' == wpmem_get( 'wpmem_admin_a' ) || 'edit_field' == wpmem_get( 'wpmem_admin_a' ) ) {
717
 
718
  // Set action.
719
+ $action = sanitize_text_field( wpmem_get( 'wpmem_admin_a' ) );
720
 
721
  // Check nonce.
722
  //check_admin_referer( 'wpmem-add-fields' );
724
  global $add_field_err_msg;
725
 
726
  $add_field_err_msg = false;
727
+ $add_name = sanitize_text_field( wpmem_get( 'add_name' ) );
728
+ $add_option = sanitize_text_field( wpmem_get( 'add_option' ) );
729
 
730
  // Error check that field label and option name are included and unique.
731
  $add_field_err_msg = ( ! $add_name ) ? __( 'Field Label is required. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
751
 
752
  $arr = array();
753
 
754
+ $type = sanitize_text_field( wpmem_get( 'add_type' ) );
755
 
756
+ $arr[0] = filter_var( wpmem_get( 'add_order_id' ), FILTER_SANITIZE_NUMBER_INT );
757
+ $arr[1] = sanitize_text_field( stripslashes( wpmem_get( 'add_name' ) ) );
758
  $arr[2] = $us_option;
759
  $arr[3] = $type;
760
+ $arr[4] = ( 'y' == wpmem_get( 'add_display', 'n' ) ) ? 'y' : 'n';
761
+ $arr[5] = ( 'y' == wpmem_get( 'add_required', 'n' ) ) ? 'y' : 'n';
762
  $arr[6] = ( $us_option == 'user_nicename' || $us_option == 'display_name' || $us_option == 'nickname' ) ? 'y' : 'n';
763
 
764
  if ( 'text' == $type || 'email' == $type || 'textarea' == $type || 'password' == $type || 'url' == $type || 'number' == $type || 'date' == $type ) {
765
+ $arr['placeholder'] = sanitize_text_field( stripslashes( wpmem_get( 'add_placeholder' ) ) );
766
  }
767
 
768
  if ( 'text' == $type || 'email' == $type || 'password' == $type || 'url' == $type || 'number' == $type || 'date' == $type ) {
769
+ $arr['pattern'] = sanitize_text_field( stripslashes( wpmem_get( 'add_pattern' ) ) );
770
+ $arr['title'] = sanitize_text_field( stripslashes( wpmem_get( 'add_title' ) ) );
771
  }
772
 
773
  if ( 'number' == $type || 'date' == $type ) {
774
+ $arr['min'] = filter_var( wpmem_get( 'add_min' ), FILTER_SANITIZE_NUMBER_INT );
775
+ $arr['max'] = filter_var( wpmem_get( 'add_max' ), FILTER_SANITIZE_NUMBER_INT );
776
  }
777
 
778
  if ( $type == 'checkbox' ) {
779
  $add_field_err_msg = ( ! $_POST['add_checked_value'] ) ? __( 'Checked value is required for checkboxes. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
780
+ $arr[7] = sanitize_text_field( wpmem_get( 'add_checked_value', false ) );
781
+ $arr[8] = ( 'y' == wpmem_get( 'add_checked_default', 'n' ) ) ? 'y' : 'n';
782
  }
783
 
784
  if ( $type == 'select'
798
  }
799
  // If multiselect or multicheckbox, set delimiter.
800
  if ( 'multiselect' == $type || 'multicheckbox' == $type ) {
801
+ $arr[8] = ( ',' === wpmem_get( 'add_delimiter_value', '|' ) ) ? ',' : '|';
802
  }
803
  }
804
 
805
  if ( $type == 'file' || $type == 'image' ) {
806
+ $arr[7] = sanitize_text_field( stripslashes( $_POST['add_file_value'] ) );
807
  }
808
 
809
  if ( wpmem_get( 'add_type' ) == 'hidden' ) {
810
  $add_field_err_msg = ( ! $_POST['add_hidden_value'] ) ? __( 'A value is required for hidden fields. Nothing was updated.', 'wp-members' ) : $add_field_err_msg;
811
+ $arr[7] = ( isset( $_POST['add_hidden_value'] ) ) ? sanitize_text_field( stripslashes( $_POST['add_hidden_value'] ) ) : '';
812
  }
813
 
814
  if ( $action == 'add_field' ) {
815
  if ( ! $add_field_err_msg ) {
816
  array_push( $wpmem_fields, $arr );
817
+ $did_update = sprintf( __( '%s was added', 'wp-members' ), esc_html( $_POST['add_name'] ) );
818
  } else {
819
  $did_update = $add_field_err_msg;
820
  }
827
  }
828
  }
829
  }
830
+ $did_update = sprintf( __( '%s was updated', 'wp-members' ), esc_html( stripslashes( $add_name ) ) );
831
+ $did_update.= '<p><a href="' . esc_url( add_query_arg( array( 'page' => 'wpmem-settings', 'tab' => 'fields' ), get_admin_url() . 'options-general.php' ) ) . '">&laquo; ' . __( 'Return to Fields Table', 'wp-members' ) . '</a></p>';
832
  }
833
 
834
  $wpmem_newfields = $wpmem_fields;
admin/tab-options.php CHANGED
@@ -22,6 +22,10 @@
22
  * - wpmem_admin_page_list
23
  */
24
 
 
 
 
 
25
 
26
  /**
27
  * Builds the settings panel.
@@ -156,10 +160,14 @@ function wpmem_a_build_options() {
156
  }?></ul>
157
  <h3><?php _e( 'Other Settings', 'wp-members' ); ?></h3>
158
  <ul>
159
- <?php $arr = array(
 
 
 
160
  array(__('Notify admin','wp-members'),'wpmem_settings_notify',sprintf(__('Notify %s for each new registration? %s','wp-members'),$admin_email,$chg_email),'notify'),
161
  array(__('Moderate registration','wp-members'),'wpmem_settings_moderate',__('Holds new registrations for admin approval','wp-members'),'mod_reg'),
162
  array(__('Ignore warning messages','wp-members'),'wpmem_settings_ignore_warnings',__('Ignores WP-Members warning messages in the admin panel','wp-members'),'warnings'),
 
163
  );
164
  for ( $row = 0; $row < count( $arr ); $row++ ) { ?>
165
  <li>
@@ -177,7 +185,7 @@ function wpmem_a_build_options() {
177
  <label><?php _e( 'Enable CAPTCHA', 'wp-members' ); ?></label>
178
  <?php $captcha = array( __( 'None', 'wp-members' ) . '|0' );
179
  if ( 1 == $wpmem->captcha ) {
180
- $captcha[] = 'reCAPTCHA v1 (deprecated)|1';
181
  }
182
  $captcha[] = __( 'reCAPTCHA', 'wp-members' ) . '|3';
183
  $captcha[] = __( 'Really Simple CAPTCHA', 'wp-members' ) . '|2';
@@ -307,7 +315,7 @@ function wpmem_update_cpts() {
307
  $post_vals = ( isset( $_POST['wpmembers_handle_cpts'] ) ) ? $_POST['wpmembers_handle_cpts'] : false;
308
  if ( $post_vals ) {
309
  foreach ( $post_vals as $val ) {
310
- $cpts[ $val ] = $post_arr[ $val ];
311
  }
312
  } else {
313
  $cpts = array();
@@ -363,43 +371,44 @@ function wpmem_update_options() {
363
  // Check nonce.
364
  check_admin_referer( 'wpmem-update-settings' );
365
 
366
- $wpmem_settings_msurl = ( $_POST['wpmem_settings_mspage'] == 'use_custom' ) ? $_POST['wpmem_settings_msurl'] : '';
367
- $wpmem_settings_mspage = ( $_POST['wpmem_settings_mspage'] == 'use_custom' ) ? '' : $_POST['wpmem_settings_mspage'];
368
  if ( $wpmem_settings_msurl != wpmem_use_ssl() && $wpmem_settings_msurl != 'use_custom' && ! $wpmem_settings_mspage ) {
369
  $msurl = trim( $wpmem_settings_msurl );
370
  } else {
371
  $msurl = $wpmem_settings_mspage;
372
  }
373
 
374
- $wpmem_settings_regurl = ( $_POST['wpmem_settings_regpage'] == 'use_custom' ) ? $_POST['wpmem_settings_regurl'] : '';
375
- $wpmem_settings_regpage = ( $_POST['wpmem_settings_regpage'] == 'use_custom' ) ? '' : $_POST['wpmem_settings_regpage'];
376
  if ( $wpmem_settings_regurl != wpmem_use_ssl() && $wpmem_settings_regurl != 'use_custom' && ! $wpmem_settings_regpage ) {
377
  $regurl = trim( $wpmem_settings_regurl );
378
  } else {
379
  $regurl = $wpmem_settings_regpage;
380
  }
381
 
382
- $wpmem_settings_logurl = ( $_POST['wpmem_settings_logpage'] == 'use_custom' ) ? $_POST['wpmem_settings_logurl'] : '';
383
- $wpmem_settings_logpage = ( $_POST['wpmem_settings_logpage'] == 'use_custom' ) ? '' : $_POST['wpmem_settings_logpage'];
384
  if ( $wpmem_settings_logurl != wpmem_use_ssl() && $wpmem_settings_logurl != 'use_custom' && ! $wpmem_settings_logpage ) {
385
  $logurl = trim( $wpmem_settings_logurl );
386
  } else {
387
  $logurl = $wpmem_settings_logpage;
388
  }
389
 
390
- $wpmem_settings_cssurl = $_POST['wpmem_settings_cssurl'];
391
  $cssurl = ( $wpmem_settings_cssurl != wpmem_use_ssl() ) ? trim( $wpmem_settings_cssurl ) : '';
392
 
393
- $wpmem_settings_style = ( isset( $_POST['wpmem_settings_style'] ) ) ? $_POST['wpmem_settings_style'] : false;
394
 
395
  $wpmem_newsettings = array(
396
  'version' => WPMEM_VERSION,
397
- 'notify' => wpmem_get( 'wpmem_settings_notify', 0 ),
398
- 'mod_reg' => wpmem_get( 'wpmem_settings_moderate', 0 ),
399
- 'captcha' => wpmem_get( 'wpmem_settings_captcha', 0 ),
400
- 'use_exp' => wpmem_get( 'wpmem_settings_time_exp', 0 ),
401
- 'use_trial' => wpmem_get( 'wpmem_settings_trial', 0 ),
402
- 'warnings' => wpmem_get( 'wpmem_settings_ignore_warnings', 0 ),
 
403
  'user_pages' => array(
404
  'profile' => ( $msurl ) ? $msurl : '',
405
  'register' => ( $regurl ) ? $regurl : '',
@@ -407,7 +416,7 @@ function wpmem_update_options() {
407
  ),
408
  'cssurl' => ( $cssurl ) ? $cssurl : '',
409
  'style' => $wpmem_settings_style,
410
- 'attrib' => wpmem_get( 'attribution', 0 ),
411
  );
412
 
413
  // Build an array of post types
@@ -437,12 +446,12 @@ function wpmem_update_options() {
437
  $post_var = 'wpmem_' . $option_group_item . '_' . $post_type;
438
  if ( $option_group_item == 'autoex' ) {
439
  // Auto excerpt is an array.
440
- $arr[ $post_type ]['enabled'] = ( isset( $_POST[ $post_var ] ) ) ? $_POST[ $post_var ] : 0;
441
- $arr[ $post_type ]['length'] = ( isset( $_POST[ $post_var . '_len' ] ) ) ? ( ( $_POST[ $post_var . '_len' ] == '' ) ? 0 : $_POST[ $post_var . '_len' ] ) : '';
442
- $arr[ $post_type ]['text'] = ( isset( $_POST[ $post_var . '_text' ] ) ) ? $_POST[ $post_var . '_text' ] : '';
443
  } else {
444
  // All other settings are 0|1.
445
- $arr[ $post_type ] = ( isset( $_POST[ $post_var ] ) ) ? $_POST[ $post_var ] : 0;
446
  }
447
  }
448
  $wpmem_newsettings[ $option_group_item ] = $arr;
22
  * - wpmem_admin_page_list
23
  */
24
 
25
+ // Exit if accessed directly.
26
+ if ( ! defined( 'ABSPATH' ) ) {
27
+ exit();
28
+ }
29
 
30
  /**
31
  * Builds the settings panel.
160
  }?></ul>
161
  <h3><?php _e( 'Other Settings', 'wp-members' ); ?></h3>
162
  <ul>
163
+ <?php
164
+ /** This filter is defined in class-wp-members.php */
165
+ $dropin_folder = apply_filters( 'wpmem_dropin_folder', WPMEM_DROPIN_DIR );
166
+ $arr = array(
167
  array(__('Notify admin','wp-members'),'wpmem_settings_notify',sprintf(__('Notify %s for each new registration? %s','wp-members'),$admin_email,$chg_email),'notify'),
168
  array(__('Moderate registration','wp-members'),'wpmem_settings_moderate',__('Holds new registrations for admin approval','wp-members'),'mod_reg'),
169
  array(__('Ignore warning messages','wp-members'),'wpmem_settings_ignore_warnings',__('Ignores WP-Members warning messages in the admin panel','wp-members'),'warnings'),
170
+ //array(__('Enable dropins', 'wp-members'),'wpmem_settings_enable_dropins',sprintf(__('Enables dropins in %s', 'wp-members'), $dropin_folder),'dropins'),
171
  );
172
  for ( $row = 0; $row < count( $arr ); $row++ ) { ?>
173
  <li>
185
  <label><?php _e( 'Enable CAPTCHA', 'wp-members' ); ?></label>
186
  <?php $captcha = array( __( 'None', 'wp-members' ) . '|0' );
187
  if ( 1 == $wpmem->captcha ) {
188
+ $wpmem->captcha = 3; // @todo reCAPTCHA v1 is fully obsolete. Change it to v2.
189
  }
190
  $captcha[] = __( 'reCAPTCHA', 'wp-members' ) . '|3';
191
  $captcha[] = __( 'Really Simple CAPTCHA', 'wp-members' ) . '|2';
315
  $post_vals = ( isset( $_POST['wpmembers_handle_cpts'] ) ) ? $_POST['wpmembers_handle_cpts'] : false;
316
  if ( $post_vals ) {
317
  foreach ( $post_vals as $val ) {
318
+ $cpts[ $val ] = sanitize_text_field( $post_arr[ $val ] );
319
  }
320
  } else {
321
  $cpts = array();
371
  // Check nonce.
372
  check_admin_referer( 'wpmem-update-settings' );
373
 
374
+ $wpmem_settings_msurl = ( $_POST['wpmem_settings_mspage'] == 'use_custom' ) ? esc_url( $_POST['wpmem_settings_msurl'] ) : '';
375
+ $wpmem_settings_mspage = ( $_POST['wpmem_settings_mspage'] == 'use_custom' ) ? '' : filter_var( $_POST['wpmem_settings_mspage'], FILTER_SANITIZE_NUMBER_INT );
376
  if ( $wpmem_settings_msurl != wpmem_use_ssl() && $wpmem_settings_msurl != 'use_custom' && ! $wpmem_settings_mspage ) {
377
  $msurl = trim( $wpmem_settings_msurl );
378
  } else {
379
  $msurl = $wpmem_settings_mspage;
380
  }
381
 
382
+ $wpmem_settings_regurl = ( $_POST['wpmem_settings_regpage'] == 'use_custom' ) ? esc_url( $_POST['wpmem_settings_regurl'] ) : '';
383
+ $wpmem_settings_regpage = ( $_POST['wpmem_settings_regpage'] == 'use_custom' ) ? '' : filter_var( $_POST['wpmem_settings_regpage'], FILTER_SANITIZE_NUMBER_INT );
384
  if ( $wpmem_settings_regurl != wpmem_use_ssl() && $wpmem_settings_regurl != 'use_custom' && ! $wpmem_settings_regpage ) {
385
  $regurl = trim( $wpmem_settings_regurl );
386
  } else {
387
  $regurl = $wpmem_settings_regpage;
388
  }
389
 
390
+ $wpmem_settings_logurl = ( $_POST['wpmem_settings_logpage'] == 'use_custom' ) ? esc_url( $_POST['wpmem_settings_logurl'] ) : '';
391
+ $wpmem_settings_logpage = ( $_POST['wpmem_settings_logpage'] == 'use_custom' ) ? '' : filter_var( $_POST['wpmem_settings_logpage'], FILTER_SANITIZE_NUMBER_INT );
392
  if ( $wpmem_settings_logurl != wpmem_use_ssl() && $wpmem_settings_logurl != 'use_custom' && ! $wpmem_settings_logpage ) {
393
  $logurl = trim( $wpmem_settings_logurl );
394
  } else {
395
  $logurl = $wpmem_settings_logpage;
396
  }
397
 
398
+ $wpmem_settings_cssurl = esc_url( $_POST['wpmem_settings_cssurl'] );
399
  $cssurl = ( $wpmem_settings_cssurl != wpmem_use_ssl() ) ? trim( $wpmem_settings_cssurl ) : '';
400
 
401
+ $wpmem_settings_style = ( isset( $_POST['wpmem_settings_style'] ) ) ? sanitize_text_field( $_POST['wpmem_settings_style'] ) : false;
402
 
403
  $wpmem_newsettings = array(
404
  'version' => WPMEM_VERSION,
405
+ 'notify' => filter_var( wpmem_get( 'wpmem_settings_notify', 0 ), FILTER_SANITIZE_NUMBER_INT ),
406
+ 'mod_reg' => filter_var( wpmem_get( 'wpmem_settings_moderate', 0 ), FILTER_SANITIZE_NUMBER_INT ),
407
+ 'captcha' => filter_var( wpmem_get( 'wpmem_settings_captcha', 0 ), FILTER_SANITIZE_NUMBER_INT ),
408
+ 'use_exp' => filter_var( wpmem_get( 'wpmem_settings_time_exp', 0 ), FILTER_SANITIZE_NUMBER_INT ),
409
+ 'use_trial' => filter_var( wpmem_get( 'wpmem_settings_trial', 0 ), FILTER_SANITIZE_NUMBER_INT ),
410
+ 'warnings' => filter_var( wpmem_get( 'wpmem_settings_ignore_warnings', 0 ), FILTER_SANITIZE_NUMBER_INT ),
411
+ 'dropins' => filter_var( wpmem_get( 'wpmem_settings_enable_dropins', 0 ), FILTER_SANITIZE_NUMBER_INT ),
412
  'user_pages' => array(
413
  'profile' => ( $msurl ) ? $msurl : '',
414
  'register' => ( $regurl ) ? $regurl : '',
416
  ),
417
  'cssurl' => ( $cssurl ) ? $cssurl : '',
418
  'style' => $wpmem_settings_style,
419
+ 'attrib' => filter_var( wpmem_get( 'attribution', 0 ), FILTER_SANITIZE_NUMBER_INT ),
420
  );
421
 
422
  // Build an array of post types
446
  $post_var = 'wpmem_' . $option_group_item . '_' . $post_type;
447
  if ( $option_group_item == 'autoex' ) {
448
  // Auto excerpt is an array.
449
+ $arr[ $post_type ]['enabled'] = ( isset( $_POST[ $post_var ] ) ) ? filter_var( $_POST[ $post_var ], FILTER_SANITIZE_NUMBER_INT ) : 0;
450
+ $arr[ $post_type ]['length'] = ( isset( $_POST[ $post_var . '_len' ] ) ) ? ( ( $_POST[ $post_var . '_len' ] == '' ) ? 0 : filter_var( $_POST[ $post_var . '_len' ], FILTER_SANITIZE_NUMBER_INT ) ) : '';
451
+ $arr[ $post_type ]['text'] = ( isset( $_POST[ $post_var . '_text' ] ) ) ? sanitize_text_field( $_POST[ $post_var . '_text' ] ) : '';
452
  } else {
453
  // All other settings are 0|1.
454
+ $arr[ $post_type ] = ( isset( $_POST[ $post_var ] ) ) ? filter_var( $_POST[ $post_var ], FILTER_SANITIZE_NUMBER_INT ) : 0;
455
  }
456
  }
457
  $wpmem_newsettings[ $option_group_item ] = $arr;
admin/user-export.php CHANGED
@@ -14,6 +14,10 @@
14
  * @copyright 2006-2017
15
  */
16
 
 
 
 
 
17
 
18
  /**
19
  * New export function to export all or selected users
14
  * @copyright 2006-2017
15
  */
16
 
17
+ // Exit if accessed directly.
18
+ if ( ! defined( 'ABSPATH' ) ) {
19
+ exit();
20
+ }
21
 
22
  /**
23
  * New export function to export all or selected users
admin/user-profile.php CHANGED
@@ -14,285 +14,16 @@
14
  * @copyright 2006-2017
15
  *
16
  * Functions included:
17
- * - wpmem_admin_fields
18
- * - wpmem_admin_update
19
  * - wpmem_profile_show_activate
20
  * - wpmem_profile_show_expiration
21
  * - wpmem_profile_show_ip
22
  */
23
 
24
- /**
25
- * Add WP-Members fields to the WP user profile screen.
26
- *
27
- * @since 2.1
28
- *
29
- * @global array $current_screen The WordPress screen object
30
- * @global int $user_ID The user ID
31
- */
32
- function wpmem_admin_fields() {
33
-
34
- global $current_screen, $user_ID, $wpmem;
35
- $user_id = ( $current_screen->id == 'profile' ) ? $user_ID : $_REQUEST['user_id']; ?>
36
-
37
- <h3><?php
38
- /**
39
- * Filter the heading for additional profile fields.
40
- *
41
- * @since 2.8.2
42
- *
43
- * @param string The default additional fields heading.
44
- */
45
- echo apply_filters( 'wpmem_admin_profile_heading', __( 'WP-Members Additional Fields', 'wp-members' ) ); ?></h3>
46
- <table class="form-table">
47
- <?php
48
- // Get fields.
49
- $wpmem_fields = wpmem_fields( 'admin_profile' );
50
- // Get excluded meta.
51
- $exclude = wpmem_get_excluded_meta( 'admin-profile' );
52
-
53
- /**
54
- * Fires at the beginning of generating the WP-Members fields in the user profile.
55
- *
56
- * @since 2.9.3
57
- *
58
- * @param int $user_id The user's ID.
59
- * @param array $wpmem_fields The WP-Members fields.
60
- */
61
- do_action( 'wpmem_admin_before_profile', $user_id, $wpmem_fields );
62
-
63
- // Assemble form rows array.
64
- $rows = array();
65
- foreach ( $wpmem_fields as $meta => $field ) {
66
-
67
- $valtochk = ''; $values = '';
68
-
69
- // Determine which fields to show in the additional fields area.
70
- $show = ( ! $field['native'] && ! in_array( $meta, $exclude ) ) ? true : false;
71
- $show = ( $field['label'] == 'TOS' && $field['register'] ) ? null : $show;
72
-
73
- if ( $show ) {
74
-
75
- $val = get_user_meta( $user_id, $meta, true );
76
- $val = ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) ? $val : htmlspecialchars( $val );
77
- if ( $field['type'] == 'checkbox' ) {
78
- $valtochk = $val;
79
- $val = $field['checked_value'];
80
- }
81
-
82
- if ( 'multicheckbox' == $field['type'] || 'select' == $field['type'] || 'multiselect' == $field['type'] || 'radio' == $field['type'] ) {
83
- $values = $field['values'];
84
- $valtochk = $val;
85
- }
86
-
87
- // Is this an image or a file?
88
- if ( 'file' == $field['type'] || 'image' == $field['type'] ) {
89
- $attachment_url = wp_get_attachment_url( $val );
90
- $empty_file = '<span class="description">' . __( 'None' ) . '</span>';
91
- if ( 'file' == $field['type'] ) {
92
- $input = ( $attachment_url ) ? '<a href="' . $attachment_url . '">' . $attachment_url . '</a>' : $empty_file;
93
- } else {
94
- $input = ( $attachment_url ) ? '<img src="' . $attachment_url . '">' : $empty_file;
95
- }
96
- $input.= '<br />' . $wpmem->get_text( 'profile_upload' ) . '<br />';
97
- $input.= wpmem_form_field( array(
98
- 'name' => $meta,
99
- 'type' => $field['type'],
100
- 'value' => $val,
101
- 'compare' => $valtochk,
102
- ) );
103
- } else {
104
- if ( 'select' == $field['type'] || 'radio' == $field['type'] ) {
105
- $input = wpmem_create_formfield( $meta, $field['type'], $values, $valtochk );
106
- } elseif( 'multicheckbox' == $field['type'] || 'multiselect' == $field['type'] ) {
107
- $input = $wpmem->forms->create_form_field( array( 'name'=>$meta, 'type'=>$field['type'], 'value'=>$values, 'compare'=>$valtochk, 'delimiter'=>$field['delimiter'] ) );
108
- } else {
109
- $field['type'] = ( 'hidden' == $field['type'] ) ? 'text' : $field['type'];
110
- $input = wpmem_create_formfield( $meta, $field['type'], $val, $valtochk );
111
- }
112
- }
113
-
114
- // Is the field required?
115
- $req = ( $field['required'] ) ? ' <span class="description">' . __( '(required)' ) . '</span>' : '';
116
- $label = '<label>' . __( $field['label'], 'wp-members' ) . $req . '</label>';
117
-
118
- // Build the form rows for filtering.
119
- $rows[ $meta ] = array(
120
- 'meta' => $meta,
121
- 'type' => $field['type'],
122
- 'value' => $val,
123
- 'values' => $values,
124
- 'label_text' => __( $field['label'], 'wp-members' ),
125
- 'row_before' => '',
126
- 'label' => $label,
127
- 'field_before' => '',
128
- 'field' => $input,
129
- 'field_after' => '',
130
- 'row_after' => '',
131
- );
132
- }
133
- }
134
-
135
- /**
136
- * Filter for rows
137
- *
138
- * @since 3.1.0
139
- * @since 3.1.6 Deprecated $order.
140
- *
141
- * @param array $rows {
142
- * An array of the profile rows.
143
- *
144
- * @type string $meta The meta key.
145
- * @type string $type The field type.
146
- * @type string $value Value if set.
147
- * @type string $values Possible values (select, multiselect, multicheckbox, radio).
148
- * @type string $label_text Raw label text (no HTML).
149
- * @type string $row_before HTML before the row.
150
- * @type string $label HTML label.
151
- * @type string $field_before HTML before the field input tag.
152
- * @type string $field HTML for field input.
153
- * @type string $field_after HTML after the field.
154
- * @type string $row_after HTML after the row.
155
- * }
156
- * @param string $toggle
157
- */
158
- $rows = apply_filters( 'wpmem_register_form_rows_admin', $rows, 'adminprofile' );
159
-
160
- // Handle form rows display from array.
161
- foreach ( $rows as $row ) {
162
- $show_field = '
163
- <tr>
164
- <th>' . $row['label'] . '</th>
165
- <td>' . $row['field'] . '</td>
166
- </tr>';
167
-
168
- /**
169
- * Filter the profile field.
170
- *
171
- * @since 2.8.2
172
- * @since 3.1.1 Added $user_id and $row
173
- *
174
- * @param string $show_field The HTML string for the additional profile field.
175
- * @param string $user_id
176
- * @param array $row
177
- */
178
- echo apply_filters( 'wpmem_admin_profile_field', $show_field, $user_id, $row );
179
- }
180
-
181
- /**
182
- * Fires after generating the WP-Members fields in the user profile.
183
- *
184
- * @since 2.9.3
185
- *
186
- * @param int $user_id The user's ID.
187
- * @param array $wpmem_fields The WP-Members fields.
188
- */
189
- do_action( 'wpmem_admin_after_profile', $user_id, $wpmem_fields ); ?>
190
-
191
- </table><?php
192
- }
193
-
194
-
195
- /**
196
- * Updates WP-Members fields from the WP user profile screen.
197
- *
198
- * @since 2.1
199
- *
200
- * @global object $wpmem
201
- */
202
- function wpmem_admin_update() {
203
-
204
- $user_id = wpmem_get( 'user_id', false, 'request' ); //$_REQUEST['user_id'];
205
-
206
- if ( ! $user_id ) {
207
- // With no user id, no user can be updated.
208
- return;
209
- }
210
-
211
- global $wpmem;
212
- $wpmem_fields = wpmem_fields( 'admin_profile_update' );
213
-
214
- /**
215
- * Fires before the user profile is updated.
216
- *
217
- * @since 2.9.2
218
- *
219
- * @param int $user_id The user ID.
220
- * @param array $wpmem_fields Array of the custom fields.
221
- */
222
- do_action( 'wpmem_admin_pre_user_update', $user_id, $wpmem_fields );
223
-
224
- $fields = array();
225
- $chk_pass = false;
226
- foreach ( $wpmem_fields as $meta => $field ) {
227
- if ( ! $field['native']
228
- && $field['type'] != 'password'
229
- && $field['type'] != 'checkbox'
230
- && $field['type'] != 'multiselect'
231
- && $field['type'] != 'multicheckbox'
232
- && $field['type'] != 'file'
233
- && $field['type'] != 'image' ) {
234
- ( isset( $_POST[ $meta ] ) ) ? $fields[ $meta ] = $_POST[ $meta ] : false;
235
- } elseif ( $meta == 'password' && $field['register'] ) {
236
- $chk_pass = true;
237
- } elseif ( $field['type'] == 'checkbox' ) {
238
- $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? $_POST[ $meta ] : '';
239
- } elseif ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
240
- $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], $_POST[ $meta ] ) : '';
241
- }
242
- }
243
-
244
- /**
245
- * Filter the submitted field values for backend profile update.
246
- *
247
- * @since 2.8.2
248
- *
249
- * @param array $fields An array of the posted form values.
250
- * @param int $user_id The ID of the user being updated.
251
- */
252
- $fields = apply_filters( 'wpmem_admin_profile_update', $fields, $user_id );
253
-
254
- // Get any excluded meta fields.
255
- $exclude = wpmem_get_excluded_meta( 'admin-profile' );
256
- foreach ( $fields as $key => $val ) {
257
- if ( ! in_array( $key, $exclude ) ) {
258
- update_user_meta( $user_id, $key, $val );
259
- }
260
- }
261
-
262
- if ( ! empty( $_FILES ) ) {
263
- $wpmem->user->upload_user_files( $user_id, $wpmem->fields );
264
- }
265
-
266
- if ( $wpmem->mod_reg == 1 ) {
267
-
268
- $wpmem_activate_user = ( isset( $_POST['activate_user'] ) == '' ) ? -1 : $_POST['activate_user'];
269
-
270
- if ( $wpmem_activate_user == 1 ) {
271
- wpmem_a_activate_user( $user_id, $chk_pass );
272
- } elseif ( $wpmem_activate_user == 0 ) {
273
- wpmem_a_deactivate_user( $user_id );
274
- }
275
- }
276
-
277
- if ( defined( 'WPMEM_EXP_MODULE' ) && $wpmem->use_exp == 1 ) {
278
- if ( function_exists( 'wpmem_a_extenduser' ) ) {
279
- wpmem_a_extend_user( $user_id );
280
- }
281
- }
282
-
283
- /**
284
- * Fires after the user profile is updated.
285
- *
286
- * @since 2.9.2
287
- *
288
- * @param int $user_id The user ID.
289
- */
290
- do_action( 'wpmem_admin_after_user_update', $user_id );
291
-
292
- return;
293
  }
294
 
295
-
296
  /**
297
  * Adds user activation to the user profile.
298
  *
14
  * @copyright 2006-2017
15
  *
16
  * Functions included:
 
 
17
  * - wpmem_profile_show_activate
18
  * - wpmem_profile_show_expiration
19
  * - wpmem_profile_show_ip
20
  */
21
 
22
+ // Exit if accessed directly.
23
+ if ( ! defined( 'ABSPATH' ) ) {
24
+ exit();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
25
  }
26
 
 
27
  /**
28
  * Adds user activation to the user profile.
29
  *
admin/users.php CHANGED
@@ -30,6 +30,11 @@
30
  * - wpmem_set_user_status
31
  */
32
 
 
 
 
 
 
33
  /**
34
  * Function to add activate/export to the bulk dropdown list.
35
  *
@@ -84,8 +89,15 @@ function wpmem_insert_activate_link( $actions, $user_object ) {
84
  * @since 2.8.2
85
  *
86
  * @uses WP_Users_List_Table
 
 
87
  */
88
  function wpmem_users_page_load() {
 
 
 
 
 
89
 
90
  // If exporting all users, do it, then exit.
91
  if ( isset( $_REQUEST['export_all'] ) && $_REQUEST['export_all'] == __( 'Export All Users', 'wp-members' ) ) {
@@ -126,6 +138,7 @@ function wpmem_users_page_load() {
126
  // Update the users.
127
  $x = 0;
128
  foreach ( $users as $user ) {
 
129
  // Check to see if the user is already activated, if not, activate.
130
  if ( ! get_user_meta( $user, 'active', true ) ) {
131
  wpmem_a_activate_user( $user, $chk_pass );
@@ -300,7 +313,7 @@ function wpmem_users_views( $views ) {
300
  $arr[] = 'Not Active';
301
  }
302
  $arr[] = 'Not Exported';
303
- $show = ( isset( $_GET['show'] ) ) ? $_GET['show'] : false;
304
 
305
  for ( $row = 0; $row < count( $arr ); $row++ ) {
306
  $link = "users.php?action=show&amp;show=";
@@ -401,6 +414,9 @@ function wpmem_add_user_column_content( $value, $column_name, $user_id ) {
401
  return $user_info->$column_name;
402
  break;
403
 
 
 
 
404
  default:
405
  return get_user_meta( $user_id, $column_name, true );
406
  break;
30
  * - wpmem_set_user_status
31
  */
32
 
33
+ // Exit if accessed directly.
34
+ if ( ! defined( 'ABSPATH' ) ) {
35
+ exit();
36
+ }
37
+
38
  /**
39
  * Function to add activate/export to the bulk dropdown list.
40
  *
89
  * @since 2.8.2
90
  *
91
  * @uses WP_Users_List_Table
92
+ *
93
+ * @global object $wpmem
94
  */
95
  function wpmem_users_page_load() {
96
+
97
+ global $wpmem;
98
+ if ( current_user_can( 'list_users' ) ) {
99
+ $wpmem->admin->user_search = new WP_Members_Admin_User_Search();
100
+ }
101
 
102
  // If exporting all users, do it, then exit.
103
  if ( isset( $_REQUEST['export_all'] ) && $_REQUEST['export_all'] == __( 'Export All Users', 'wp-members' ) ) {
138
  // Update the users.
139
  $x = 0;
140
  foreach ( $users as $user ) {
141
+ $user = filter_var( $user, FILTER_VALIDATE_INT );
142
  // Check to see if the user is already activated, if not, activate.
143
  if ( ! get_user_meta( $user, 'active', true ) ) {
144
  wpmem_a_activate_user( $user, $chk_pass );
313
  $arr[] = 'Not Active';
314
  }
315
  $arr[] = 'Not Exported';
316
+ $show = ( isset( $_GET['show'] ) ) ? sanitize_text_field( $_GET['show'] ) : false;
317
 
318
  for ( $row = 0; $row < count( $arr ); $row++ ) {
319
  $link = "users.php?action=show&amp;show=";
414
  return $user_info->$column_name;
415
  break;
416
 
417
+ case 'user_id':
418
+ return $user_id;
419
+
420
  default:
421
  return get_user_meta( $user_id, $column_name, true );
422
  break;
css/generic-no-float.css CHANGED
@@ -242,7 +242,7 @@ see http://rocketgeek.com/tips-and-tricks/load-a-custom-stylesheet/
242
 
243
  #wpmem_reg .button_div, #wpmem_login .button_div {
244
  width:74%;
245
- height:55px;
246
  padding: 6px 0;
247
  text-align: right;
248
  }
242
 
243
  #wpmem_reg .button_div, #wpmem_login .button_div {
244
  width:74%;
245
+ /* height:55px; */
246
  padding: 6px 0;
247
  text-align: right;
248
  }
css/generic-rigid.css CHANGED
@@ -295,7 +295,7 @@ see http://rocketgeek.com/tips-and-tricks/load-a-custom-stylesheet/
295
  width:100%;
296
  float:right;
297
  text-align:right;
298
- height:55px;
299
  padding: 6px 0;
300
  }
301
 
295
  width:100%;
296
  float:right;
297
  text-align:right;
298
+ /*height:55px;*/
299
  padding: 6px 0;
300
  }
301
 
inc/api.php CHANGED
@@ -36,6 +36,11 @@
36
  * - wpmem_current_post_id
37
  */
38
 
 
 
 
 
 
39
  /**
40
  * Redirects a user to defined login page with return redirect.
41
  *
@@ -286,6 +291,7 @@ function wpmem_use_custom_dialog( $defaults, $tag, $dialogs ) {
286
  *
287
  * @since 3.1.1
288
  * @since 3.1.6 Include accepting an array of roles to check.
 
289
  *
290
  * @global object $current_user Current user object.
291
  * @global object $wpmem WP_Members object.
@@ -294,6 +300,9 @@ function wpmem_use_custom_dialog( $defaults, $tag, $dialogs ) {
294
  * @return boolean $has_role True if user has the role, otherwise false.
295
  */
296
  function wpmem_user_has_role( $role, $user_id = false ) {
 
 
 
297
  global $current_user, $wpmem;
298
  $has_role = false;
299
  if ( $user_id ) {
36
  * - wpmem_current_post_id
37
  */
38
 
39
+ // Exit if accessed directly.
40
+ if ( ! defined( 'ABSPATH' ) ) {
41
+ exit();
42
+ }
43
+
44
  /**
45
  * Redirects a user to defined login page with return redirect.
46
  *
291
  *
292
  * @since 3.1.1
293
  * @since 3.1.6 Include accepting an array of roles to check.
294
+ * @since 3.1.9 Return false if user is not logged in.
295
  *
296
  * @global object $current_user Current user object.
297
  * @global object $wpmem WP_Members object.
300
  * @return boolean $has_role True if user has the role, otherwise false.
301
  */
302
  function wpmem_user_has_role( $role, $user_id = false ) {
303
+ if ( ! is_user_logged_in() ) {
304
+ return false;
305
+ }
306
  global $current_user, $wpmem;
307
  $has_role = false;
308
  if ( $user_id ) {
inc/class-wp-members-api.php CHANGED
@@ -7,6 +7,11 @@
7
  * @since 3.1.1
8
  */
9
 
 
 
 
 
 
10
  class WP_Members_API {
11
 
12
  /**
7
  * @since 3.1.1
8
  */
9
 
10
+ // Exit if accessed directly.
11
+ if ( ! defined( 'ABSPATH' ) ) {
12
+ exit();
13
+ }
14
+
15
  class WP_Members_API {
16
 
17
  /**
inc/class-wp-members-forms.php CHANGED
@@ -7,6 +7,11 @@
7
  * @since 3.1.0
8
  */
9
 
 
 
 
 
 
10
  class WP_Members_Forms {
11
 
12
  /**
@@ -154,12 +159,16 @@ class WP_Members_Forms {
154
  $pieces = explode( '|', $option );
155
  $values = ( empty( $compare ) ) ? array() : ( is_array( $compare ) ? $compare : explode( $delimiter, $compare ) );
156
  $chk = ( isset( $pieces[2] ) && '' == $compare ) ? $pieces[1] : '';
157
- $str = $str . $this->create_form_field( array(
158
- 'name' => $name . '[]',
159
- 'type' => 'checkbox',
160
- 'value' => $pieces[1],
161
- 'compare' => ( in_array( $pieces[1], $values ) ) ? $pieces[1] : $chk,
162
- ) ) . "&nbsp;" . $pieces[0] . "<br />\n";
 
 
 
 
163
  }
164
  break;
165
 
@@ -170,7 +179,11 @@ class WP_Members_Forms {
170
  foreach ( $value as $option ) {
171
  $pieces = explode( '|', $option );
172
  $id = $name . '_' . $num;
173
- $str = $str . "<input type=\"radio\" name=\"$name\" id=\"$id\" value=\"$pieces[1]\"" . checked( $pieces[1], $compare, false ) . ( ( $required ) ? " required " : " " ) . "> " . __( $pieces[0], 'wp-members' ) . "<br />\n";
 
 
 
 
174
  $num++;
175
  }
176
  break;
@@ -678,7 +691,7 @@ class WP_Members_Forms {
678
  $args = wp_parse_args( $args, $defaults );
679
 
680
  // Username is editable if new reg, otherwise user profile is not.
681
- if ( $tag == 'edit' ) {
682
  // This is the User Profile edit - username is not editable.
683
  $val = $userdata->user_login;
684
  $label = '<label for="user_login" class="text">' . $wpmem->get_text( 'profile_username' ) . '</label>';
@@ -739,10 +752,10 @@ class WP_Members_Forms {
739
 
740
  // Skips user selected passwords for profile update.
741
  $pass_arr = array( 'password', 'confirm_password', 'password_confirm' );
742
- $do_row = ( $tag == 'edit' && in_array( $meta_key, $pass_arr ) ) ? false : true;
743
 
744
  // Skips tos, makes tos field hidden on user edit page, unless they haven't got a value for tos.
745
- if ( $meta_key == 'tos' && $tag == 'edit' && ( get_user_meta( $userdata->ID, 'tos', true ) ) ) {
746
  $do_row = false;
747
  $hidden_tos = wpmem_form_field( array(
748
  'name' => $meta_key,
@@ -784,7 +797,7 @@ class WP_Members_Forms {
784
  }
785
 
786
  // Gets the field value for both edit profile and submitted reg w/ error.
787
- if ( ( $tag == 'edit' ) && ( $wpmem_regchk != 'updaterr' ) ) { // @todo Should this use $wpmem->regchk? This is the last remaining use of $wpmem_regchk in this function.
788
 
789
  switch ( $meta_key ) {
790
  case( 'description' ):
@@ -819,7 +832,7 @@ class WP_Members_Forms {
819
  }
820
 
821
  // Does the tos field.
822
- if ( $meta_key == 'tos' ) {
823
 
824
  $val = ( isset( $_POST[ $meta_key ] ) ) ? $_POST[ $meta_key ] : '';
825
 
@@ -859,7 +872,7 @@ class WP_Members_Forms {
859
  } else {
860
 
861
  // For checkboxes.
862
- if ( $field['type'] == 'checkbox' ) {
863
  $valtochk = $val;
864
  $val = $field['checked_value'];
865
  // if it should it be checked by default (& only if form not submitted), then override above...
@@ -1032,11 +1045,11 @@ class WP_Members_Forms {
1032
 
1033
  // Create hidden fields.
1034
  $var = ( $tag == 'edit' ) ? 'update' : 'register';
1035
- $redirect_to = ( isset( $_REQUEST['redirect_to'] ) ) ? esc_url( $_REQUEST['redirect_to'] ) : ( ( $redirect_to ) ? $redirect_to : get_permalink() );
1036
- $hidden .= '<input name="a" type="hidden" value="' . $var . '" />' . $args['n'];
1037
- $hidden .= '<input name="wpmem_reg_page" type="hidden" value="' . get_permalink() . '" />' . $args['n'];
1038
  if ( $redirect_to != get_permalink() ) {
1039
- $hidden.= '<input name="redirect_to" type="hidden" value="' . $redirect_to . '" />' . $args['n'];
1040
  }
1041
  $hidden = ( isset( $hidden_tos ) ) ? $hidden . $hidden_tos . $args['n'] : $hidden;
1042
 
7
  * @since 3.1.0
8
  */
9
 
10
+ // Exit if accessed directly.
11
+ if ( ! defined( 'ABSPATH' ) ) {
12
+ exit();
13
+ }
14
+
15
  class WP_Members_Forms {
16
 
17
  /**
159
  $pieces = explode( '|', $option );
160
  $values = ( empty( $compare ) ) ? array() : ( is_array( $compare ) ? $compare : explode( $delimiter, $compare ) );
161
  $chk = ( isset( $pieces[2] ) && '' == $compare ) ? $pieces[1] : '';
162
+ if ( isset( $pieces[1] ) && '' != $pieces[1] ) {
163
+ $str = $str . $this->create_form_field( array(
164
+ 'name' => $name . '[]',
165
+ 'type' => 'checkbox',
166
+ 'value' => $pieces[1],
167
+ 'compare' => ( in_array( $pieces[1], $values ) ) ? $pieces[1] : $chk,
168
+ ) ) . "&nbsp;" . $pieces[0] . "<br />\n";
169
+ } else {
170
+ $str = $str . '<span class="div_multicheckbox_separator">' . $pieces[0] . "</span><br />\n";
171
+ }
172
  }
173
  break;
174
 
179
  foreach ( $value as $option ) {
180
  $pieces = explode( '|', $option );
181
  $id = $name . '_' . $num;
182
+ if ( isset( $pieces[1] ) && '' != $pieces[1] ) {
183
+ $str = $str . "<input type=\"radio\" name=\"$name\" id=\"$id\" value=\"$pieces[1]\"" . checked( $pieces[1], $compare, false ) . ( ( $required ) ? " required " : " " ) . "> " . __( $pieces[0], 'wp-members' ) . "<br />\n";
184
+ } else {
185
+ $str = $str . '<span class="div_radio_separator">' . __( $pieces[0], 'wp-members' ) . "</span><br />\n";
186
+ }
187
  $num++;
188
  }
189
  break;
691
  $args = wp_parse_args( $args, $defaults );
692
 
693
  // Username is editable if new reg, otherwise user profile is not.
694
+ if ( 'edit' == $tag ) {
695
  // This is the User Profile edit - username is not editable.
696
  $val = $userdata->user_login;
697
  $label = '<label for="user_login" class="text">' . $wpmem->get_text( 'profile_username' ) . '</label>';
752
 
753
  // Skips user selected passwords for profile update.
754
  $pass_arr = array( 'password', 'confirm_password', 'password_confirm' );
755
+ $do_row = ( 'edit' == $tag && in_array( $meta_key, $pass_arr ) ) ? false : true;
756
 
757
  // Skips tos, makes tos field hidden on user edit page, unless they haven't got a value for tos.
758
+ if ( 'tos' == $meta_key && 'edit' == $tag && ( get_user_meta( $userdata->ID, 'tos', true ) ) ) {
759
  $do_row = false;
760
  $hidden_tos = wpmem_form_field( array(
761
  'name' => $meta_key,
797
  }
798
 
799
  // Gets the field value for both edit profile and submitted reg w/ error.
800
+ if ( ( 'edit' == $tag ) && ( '' == $wpmem->regchk ) ) {
801
 
802
  switch ( $meta_key ) {
803
  case( 'description' ):
832
  }
833
 
834
  // Does the tos field.
835
+ if ( 'tos' == $meta_key ) {
836
 
837
  $val = ( isset( $_POST[ $meta_key ] ) ) ? $_POST[ $meta_key ] : '';
838
 
872
  } else {
873
 
874
  // For checkboxes.
875
+ if ( 'checkbox' == $field['type'] ) {
876
  $valtochk = $val;
877
  $val = $field['checked_value'];
878
  // if it should it be checked by default (& only if form not submitted), then override above...
1045
 
1046
  // Create hidden fields.
1047
  $var = ( $tag == 'edit' ) ? 'update' : 'register';
1048
+ $redirect_to = ( isset( $_REQUEST['redirect_to'] ) ) ? $_REQUEST['redirect_to'] : ( ( $redirect_to ) ? $redirect_to : get_permalink() );
1049
+ $hidden .= '<input name="a" type="hidden" value="' . esc_attr( $var ) . '" />' . $args['n'];
1050
+ $hidden .= '<input name="wpmem_reg_page" type="hidden" value="' . esc_url( get_permalink() ) . '" />' . $args['n'];
1051
  if ( $redirect_to != get_permalink() ) {
1052
+ $hidden.= '<input name="redirect_to" type="hidden" value="' . esc_url( $redirect_to ) . '" />' . $args['n'];
1053
  }
1054
  $hidden = ( isset( $hidden_tos ) ) ? $hidden . $hidden_tos . $args['n'] : $hidden;
1055
 
inc/class-wp-members-user-profile.php ADDED
@@ -0,0 +1,354 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <?php
2
+ /**
3
+ * The WP_Members Admin User Profile Class.
4
+ *
5
+ * @package WP-Members
6
+ * @subpackage WP_Members Admin User Profile Object Class
7
+ * @since 3.1.8
8
+ */
9
+
10
+ // Exit if accessed directly.
11
+ if ( ! defined( 'ABSPATH' ) ) {
12
+ exit();
13
+ }
14
+
15
+ class WP_Members_User_Profile {
16
+
17
+ /**
18
+ * Static function to display WP-Members fields on the admin/dashboard user profile.
19
+ *
20
+ * Function was created in 3.1.9 as a merge of wpmem_admin_fields()
21
+ * and wpmem_user_profile().
22
+ *
23
+ * @since 3.1.9
24
+ *
25
+ * @global object $current_screen
26
+ * @global string $user_ID
27
+ * @global object $wpmem
28
+ * @param object $user_obj
29
+ */
30
+ static function profile( $user_obj ) {
31
+
32
+ global $current_screen, $user_ID, $wpmem;
33
+ $user_id = ( 'profile' == $current_screen->id ) ? $user_ID : filter_var( $_REQUEST['user_id'], FILTER_SANITIZE_NUMBER_INT );
34
+ $display = ( 'profile' == $current_screen->base ) ? 'user' : 'admin'; ?>
35
+
36
+ <h3><?php
37
+ $heading = ( 'admin' == $display ) ? __( 'WP-Members Additional Fields', 'wp-members' ) : __( 'Additional Information', 'wp-members' );
38
+ /**
39
+ * Filter the heading for additional profile fields.
40
+ *
41
+ * @since 2.8.2 Admin Profile
42
+ * @since 2.9.1 Dashboard Profile
43
+ * @since 3.1.9 Merged admin/dashboard profile
44
+ *
45
+ * @param string The default additional fields heading.
46
+ */
47
+ echo apply_filters( 'wpmem_' . $display . '_profile_heading', $heading ); ?></h3>
48
+ <table class="form-table">
49
+ <?php
50
+ // Get fields.
51
+ $wpmem_fields = ( 'admin' == $display ) ? wpmem_fields( 'admin_profile' ) : wpmem_fields( 'dashboard_profile' );
52
+ // Get excluded meta.
53
+ $exclude = wpmem_get_excluded_meta( $display . '-profile' );
54
+
55
+ /**
56
+ * Fires at the beginning of generating the WP-Members fields in the user profile.
57
+ *
58
+ * @since 2.9.3 Created for admin profile.
59
+ * @since 3.1.9 Added to dashboard profile.
60
+ *
61
+ * @param int $user_id The user's ID.
62
+ * @param array $wpmem_fields The WP-Members fields.
63
+ */
64
+ do_action( 'wpmem_' . $display . '_before_profile', $user_id, $wpmem_fields );
65
+
66
+ // Assemble form rows array.
67
+ $rows = array();
68
+ foreach ( $wpmem_fields as $meta => $field ) {
69
+
70
+ $valtochk = ''; $values = '';
71
+
72
+ // Determine which fields to show in the additional fields area.
73
+ $show = ( ! $field['native'] && ! in_array( $meta, $exclude ) ) ? true : false;
74
+ $show = ( $field['label'] == 'TOS' && $field['register'] ) ? null : $show;
75
+
76
+ if ( $show ) {
77
+
78
+ $val = get_user_meta( $user_id, $meta, true );
79
+ $val = ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) ? $val : htmlspecialchars( $val );
80
+ if ( $field['type'] == 'checkbox' ) {
81
+ $valtochk = $val;
82
+ $val = $field['checked_value'];
83
+ }
84
+
85
+ if ( 'multicheckbox' == $field['type'] || 'select' == $field['type'] || 'multiselect' == $field['type'] || 'radio' == $field['type'] ) {
86
+ $values = $field['values'];
87
+ $valtochk = $val;
88
+ }
89
+
90
+ // Is this an image or a file?
91
+ if ( 'file' == $field['type'] || 'image' == $field['type'] ) {
92
+ $empty_file = '<span class="description">' . __( 'None' ) . '</span>';
93
+ if ( 'file' == $field['type'] ) {
94
+ $attachment_url = wp_get_attachment_url( $val );
95
+ $input = ( $attachment_url ) ? '<a href="' . $attachment_url . '">' . $attachment_url . '</a>' : $empty_file;
96
+ } else {
97
+ $attachment_url = wp_get_attachment_image( $val, 'medium' );
98
+ if ( 'admin' == $display ) {
99
+ $edit_url = admin_url( 'upload.php?item=' . $val );
100
+ $input = ( $attachment_url ) ? '<a href="' . $edit_url . '">' . $attachment_url . '</a>' : $empty_file;
101
+ } else {
102
+ $input = ( $attachment_url ) ? $attachment_url : $empty_file;
103
+ }
104
+ }
105
+ $input.= '<br />' . $wpmem->get_text( 'profile_upload' ) . '<br />';
106
+ $input.= wpmem_form_field( array(
107
+ 'name' => $meta,
108
+ 'type' => $field['type'],
109
+ 'value' => $val,
110
+ 'compare' => $valtochk,
111
+ ) );
112
+ } else {
113
+ if ( 'select' == $field['type'] || 'radio' == $field['type'] ) {
114
+ $input = wpmem_create_formfield( $meta, $field['type'], $values, $valtochk );
115
+ } elseif( 'multicheckbox' == $field['type'] || 'multiselect' == $field['type'] ) {
116
+ $input = $wpmem->forms->create_form_field( array( 'name'=>$meta, 'type'=>$field['type'], 'value'=>$values, 'compare'=>$valtochk, 'delimiter'=>$field['delimiter'] ) );
117
+ } else {
118
+ $field['type'] = ( 'hidden' == $field['type'] ) ? 'text' : $field['type'];
119
+ $input = wpmem_create_formfield( $meta, $field['type'], $val, $valtochk );
120
+ }
121
+ }
122
+
123
+ // Is the field required?
124
+ $req = ( $field['required'] ) ? ' <span class="description">' . __( '(required)' ) . '</span>' : '';
125
+ $label = '<label>' . __( $field['label'], 'wp-members' ) . $req . '</label>';
126
+
127
+ // Build the form rows for filtering.
128
+ $rows[ $meta ] = array(
129
+ 'meta' => $meta,
130
+ 'type' => $field['type'],
131
+ 'value' => $val,
132
+ 'values' => $values,
133
+ 'label_text' => __( $field['label'], 'wp-members' ),
134
+ 'row_before' => '',
135
+ 'label' => $label,
136
+ 'field_before' => '',
137
+ 'field' => $input,
138
+ 'field_after' => '',
139
+ 'row_after' => '',
140
+ );
141
+ }
142
+ }
143
+
144
+ /**
145
+ * Filter for rows
146
+ *
147
+ * @since 3.1.0
148
+ * @since 3.1.6 Deprecated $order.
149
+ *
150
+ * @param array $rows {
151
+ * An array of the profile rows.
152
+ *
153
+ * @type string $meta The meta key.
154
+ * @type string $type The field type.
155
+ * @type string $value Value if set.
156
+ * @type string $values Possible values (select, multiselect, multicheckbox, radio).
157
+ * @type string $label_text Raw label text (no HTML).
158
+ * @type string $row_before HTML before the row.
159
+ * @type string $label HTML label.
160
+ * @type string $field_before HTML before the field input tag.
161
+ * @type string $field HTML for field input.
162
+ * @type string $field_after HTML after the field.
163
+ * @type string $row_after HTML after the row.
164
+ * }
165
+ * @param string $tag adminprofile|userprofile
166
+ */
167
+ $rows = apply_filters( 'wpmem_register_form_rows_admin', $rows, $display . 'profile' );
168
+
169
+ // Handle form rows display from array.
170
+ foreach ( $rows as $row ) {
171
+ $show_field = '
172
+ <tr>
173
+ <th>' . $row['label'] . '</th>
174
+ <td>' . $row['field'] . '</td>
175
+ </tr>';
176
+
177
+ /**
178
+ * Filter the profile field.
179
+ *
180
+ * @since 2.8.2
181
+ * @since 3.1.1 Added $user_id and $row
182
+ *
183
+ * @param string $show_field The HTML string for the additional profile field.
184
+ * @param string $user_id
185
+ * @param array $row
186
+ */
187
+ echo apply_filters( 'wpmem_' . $display . '_profile_field', $show_field, $user_id, $row );
188
+ }
189
+
190
+ /**
191
+ * Fires after generating the WP-Members fields in the user profile.
192
+ *
193
+ * @since 2.9.3
194
+ *
195
+ * @param int $user_id The user's ID.
196
+ * @param array $wpmem_fields The WP-Members fields.
197
+ */
198
+ do_action( 'wpmem_' . $display . '_after_profile', $user_id, $wpmem_fields ); ?>
199
+
200
+ </table><?php
201
+
202
+ }
203
+
204
+ /**
205
+ * Static function to update admin/dashboard user profile.
206
+ *
207
+ * Function was created in 3.1.9 as a merge of wpmem_admin_update()
208
+ * and wpmem_profile_update().
209
+ *
210
+ * @since 3.1.9
211
+ *
212
+ * @global object $current_screen
213
+ * @global string $user_id
214
+ * @global object $wpmem
215
+ * @param string $user_id
216
+ * @return
217
+ */
218
+ static function update( $user_id ) {
219
+
220
+ global $current_screen, $user_id, $wpmem;
221
+ $display = ( 'profile' == $current_screen->base ) ? 'user' : 'admin';
222
+
223
+ if ( ! $user_id ) {
224
+ $user_id = filter_var( wpmem_get( 'user_id', -1, 'request' ), FILTER_SANITIZE_NUMBER_INT );
225
+ if ( 1 > $user_id ) {
226
+ // Still no user id? User cannot be updated.
227
+ return;
228
+ }
229
+ }
230
+
231
+ $wpmem_fields = ( 'admin' == $display ) ? wpmem_fields( 'admin_profile_update' ) : wpmem_fields( 'dashboard_profile_update' );
232
+
233
+ $exclude = wpmem_get_excluded_meta( $display . '-profile' );
234
+
235
+ /**
236
+ * Fires before the user profile is updated.
237
+ *
238
+ * @since 2.9.2 Added for admin profile update.
239
+ * @since 3.1.9 Added for user profile update.
240
+ *
241
+ * @param int $user_id The user ID.
242
+ * @param array $wpmem_fields Array of the custom fields.
243
+ */
244
+ do_action( 'wpmem_' . $display . '_pre_user_update', $user_id, $wpmem_fields );
245
+
246
+ $fields = array();
247
+ $chk_pass = false;
248
+ foreach ( $wpmem_fields as $meta => $field ) {
249
+ if ( ! $field['native']
250
+ && $field['type'] != 'password'
251
+ && $field['type'] != 'checkbox'
252
+ && $field['type'] != 'multiselect'
253
+ && $field['type'] != 'multicheckbox'
254
+ && $field['type'] != 'file'
255
+ && $field['type'] != 'image' ) {
256
+ ( isset( $_POST[ $meta ] ) && 'password' != $field['type'] ) ? $fields[ $meta ] = sanitize_text_field( $_POST[ $meta ] ) : false;
257
+
258
+ // For user profile (not admin).
259
+ $chk = false;
260
+ if ( 'admin' != $display ) {
261
+ // Check for required fields.
262
+ if ( ! $field['required'] ) {
263
+ $chk = 'ok';
264
+ }
265
+ if ( $field['required'] && $_POST[ $meta ] != '' ) {
266
+ $chk = 'ok';
267
+ }
268
+ }
269
+ } elseif ( $meta == 'password' && $field['register'] ) {
270
+ $chk_pass = true;
271
+ } elseif ( $field['type'] == 'checkbox' ) {
272
+ $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? sanitize_text_field( $_POST[ $meta ] ) : '';
273
+ } elseif ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
274
+ $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], wp_unslash( $_POST[ $meta ] ) ) : '';
275
+ }
276
+ }
277
+
278
+ /**
279
+ * Filter the submitted field values for backend profile update.
280
+ *
281
+ * @since 2.8.2 Added for Admin profile update.
282
+ * @since 3.1.9 Added for User profile update.
283
+ *
284
+ * @param array $fields An array of the posted form values.
285
+ * @param int $user_id The ID of the user being updated.
286
+ */
287
+ $fields = apply_filters( 'wpmem_' . $display . '_profile_update', $fields, $user_id );
288
+
289
+ // Get any excluded meta fields.
290
+ $exclude = wpmem_get_excluded_meta( 'admin-profile' );
291
+ foreach ( $fields as $key => $val ) {
292
+ if ( ! in_array( $key, $exclude ) ) {
293
+ if ( ( 'admin' != $display && 'ok' == $chk ) || 'admin' == $display ) {
294
+ update_user_meta( $user_id, $key, $val );
295
+ }
296
+ }
297
+ }
298
+
299
+ if ( ! empty( $_FILES ) ) {
300
+ $wpmem->user->upload_user_files( $user_id, $wpmem->fields );
301
+ }
302
+
303
+ if ( 'admin' == $display || current_user_can( 'edit_users' ) ) {
304
+ if ( $wpmem->mod_reg == 1 ) {
305
+
306
+ $wpmem_activate_user = ( isset( $_POST['activate_user'] ) == '' ) ? -1 : filter_var( $_POST['activate_user'], FILTER_SANITIZE_NUMBER_INT );
307
+
308
+ if ( $wpmem_activate_user == 1 ) {
309
+ wpmem_a_activate_user( $user_id, $chk_pass );
310
+ } elseif ( $wpmem_activate_user == 0 ) {
311
+ wpmem_a_deactivate_user( $user_id );
312
+ }
313
+ }
314
+
315
+ if ( defined( 'WPMEM_EXP_MODULE' ) && $wpmem->use_exp == 1 ) {
316
+ if ( function_exists( 'wpmem_a_extenduser' ) ) {
317
+ wpmem_a_extend_user( $user_id );
318
+ }
319
+ }
320
+ }
321
+
322
+ /**
323
+ * Fires after the user profile is updated.
324
+ *
325
+ * @since 2.9.2
326
+ *
327
+ * @param int $user_id The user ID.
328
+ */
329
+ do_action( 'wpmem_' . $display . '_after_user_update', $user_id );
330
+
331
+ return;
332
+ }
333
+
334
+
335
+ /**
336
+ * Sets user profile update to multipart form data.
337
+ *
338
+ * If the fields array has a file or image field, this will echo the
339
+ * necessary "multipart/form-data" enctype for the form tag.
340
+ *
341
+ * @since 3.1.8 (as wpmem_profile_multipart()).
342
+ * @since 3.1.9 Moved to User Profile object.
343
+ */
344
+ public static function add_multipart() {
345
+ $has_file = false;
346
+ foreach ( wpmem_fields() as $field ) {
347
+ if ( $field['type'] == 'file' || $field['type'] == 'image' ) {
348
+ $has_file = true;
349
+ break;
350
+ }
351
+ }
352
+ echo ( $has_file ) ? " enctype=\"multipart/form-data\"" : '';
353
+ }
354
+ }
inc/class-wp-members-user.php CHANGED
@@ -10,6 +10,11 @@
10
  * @since 3.0.0
11
  */
12
 
 
 
 
 
 
13
  class WP_Members_User {
14
 
15
  /**
@@ -65,7 +70,7 @@ class WP_Members_User {
65
  $redirect_to = wpmem_get( 'redirect_to', false );
66
  $redirect_to = ( $redirect_to ) ? esc_url_raw( trim( $redirect_to ) ) : esc_url_raw( wpmem_current_url() );
67
  /** This filter defined in wp-login.php */
68
- $redirect_to = apply_filters( 'login_redirect', $redirect_to, wpmem_current_url(), $user );
69
  /**
70
  * Filter the redirect url.
71
  *
@@ -251,6 +256,10 @@ class WP_Members_User {
251
  }
252
  // Update user password.
253
  wp_set_password( $args['pass1'], $user_ID );
 
 
 
 
254
  /**
255
  * Fires after password change.
256
  *
10
  * @since 3.0.0
11
  */
12
 
13
+ // Exit if accessed directly.
14
+ if ( ! defined( 'ABSPATH' ) ) {
15
+ exit();
16
+ }
17
+
18
  class WP_Members_User {
19
 
20
  /**
70
  $redirect_to = wpmem_get( 'redirect_to', false );
71
  $redirect_to = ( $redirect_to ) ? esc_url_raw( trim( $redirect_to ) ) : esc_url_raw( wpmem_current_url() );
72
  /** This filter defined in wp-login.php */
73
+ $redirect_to = apply_filters( 'login_redirect', $redirect_to, '', $user );
74
  /**
75
  * Filter the redirect url.
76
  *
256
  }
257
  // Update user password.
258
  wp_set_password( $args['pass1'], $user_ID );
259
+ // Maintain login state.
260
+ $user = get_user_by( 'id', $user_ID );
261
+ wp_set_current_user( $user_ID, $user->user_login );
262
+ wp_set_auth_cookie( $user_ID );
263
  /**
264
  * Fires after password change.
265
  *
inc/class-wp-members-widget.php CHANGED
@@ -4,6 +4,12 @@
4
  *
5
  * @since 2.7
6
  */
 
 
 
 
 
 
7
  class widget_wpmemwidget extends WP_Widget {
8
 
9
  /**
4
  *
5
  * @since 2.7
6
  */
7
+
8
+ // Exit if accessed directly.
9
+ if ( ! defined( 'ABSPATH' ) ) {
10
+ exit();
11
+ }
12
+
13
  class widget_wpmemwidget extends WP_Widget {
14
 
15
  /**
inc/class-wp-members.php CHANGED
@@ -11,6 +11,11 @@
11
  * @since 3.0.0
12
  */
13
 
 
 
 
 
 
14
  class WP_Members {
15
 
16
  /**
@@ -121,6 +126,24 @@ class WP_Members {
121
  */
122
  public $warnings;
123
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
124
  /**
125
  * Current plugin action container.
126
  *
@@ -242,6 +265,11 @@ class WP_Members {
242
 
243
  // Load contants.
244
  $this->load_constants();
 
 
 
 
 
245
  }
246
 
247
  /**
@@ -357,11 +385,18 @@ class WP_Members {
357
  *
358
  * @param string $folder The drop-in file folder.
359
  */
360
- $folder = apply_filters( 'wpmem_dropin_folder', WP_PLUGIN_DIR . '/wp-members-dropins/' );
361
 
362
  // Load any drop-ins.
363
- foreach ( glob( $folder . '*.php' ) as $filename ) {
364
- include_once( $filename );
 
 
 
 
 
 
 
365
  }
366
 
367
  /**
@@ -394,6 +429,8 @@ class WP_Members {
394
  ( ! defined( 'WPMEM_REGURL' ) ) ? define( 'WPMEM_REGURL', $this->user_pages['register'] ) : '';
395
  ( ! defined( 'WPMEM_LOGURL' ) ) ? define( 'WPMEM_LOGURL', $this->user_pages['login'] ) : '';
396
 
 
 
397
  define( 'WPMEM_CSSURL', $this->cssurl );
398
  }
399
 
@@ -431,7 +468,7 @@ class WP_Members {
431
  require_once( WPMEM_PATH . 'inc/sidebar.php' );
432
  require_once( WPMEM_PATH . 'inc/shortcodes.php' );
433
  require_once( WPMEM_PATH . 'inc/email.php' );
434
- require_once( WPMEM_PATH . 'inc/users.php' );
435
  require_once( WPMEM_PATH . 'inc/deprecated.php' );
436
  }
437
 
@@ -475,7 +512,7 @@ class WP_Members {
475
  function get_action() {
476
 
477
  // Get the action being done (if any).
478
- $this->action = wpmem_get( 'a', '', 'request' ); //( isset( $_REQUEST['a'] ) ) ? trim( $_REQUEST['a'] ) : '';
479
 
480
  // For backward compatibility with processes that check $wpmem_a.
481
  global $wpmem_a;
@@ -814,12 +851,17 @@ class WP_Members {
814
  case 'multiselect':
815
  case 'multicheckbox':
816
  case 'radio':
 
 
 
 
 
817
  $this->fields[ $meta_key ]['values'] = $val[7];
818
  $this->fields[ $meta_key ]['delimiter'] = ( isset( $val[8] ) ) ? $val[8] : '|';
819
  $this->fields[ $meta_key ]['options'] = array();
820
  foreach ( $val[7] as $value ) {
821
- $pieces = explode( $this->fields[ $meta_key ]['delimiter'], trim( $value ) );
822
- if ( $pieces[1] != '' ) {
823
  $this->fields[ $meta_key ]['options'][ $pieces[1] ] = $pieces[0];
824
  }
825
  }
11
  * @since 3.0.0
12
  */
13
 
14
+ // Exit if accessed directly.
15
+ if ( ! defined( 'ABSPATH' ) ) {
16
+ exit();
17
+ }
18
+
19
  class WP_Members {
20
 
21
  /**
126
  */
127
  public $warnings;
128
 
129
+ /**
130
+ * Enable drop-ins setting.
131
+ *
132
+ * @since 3.1.9
133
+ * @access public
134
+ * @var string
135
+ */
136
+ public $dropins = 0;
137
+
138
+ /**
139
+ * Container for enabled dropins.
140
+ *
141
+ * @since 3.1.9
142
+ * @access public
143
+ * @var array
144
+ */
145
+ public $dropins_enabled = array();
146
+
147
  /**
148
  * Current plugin action container.
149
  *
265
 
266
  // Load contants.
267
  $this->load_constants();
268
+
269
+ // Load dropins.
270
+ if ( $this->dropins ) {
271
+ $this->load_dropins();
272
+ }
273
  }
274
 
275
  /**
385
  *
386
  * @param string $folder The drop-in file folder.
387
  */
388
+ $folder = apply_filters( 'wpmem_dropin_folder', WPMEM_DROPIN_DIR );
389
 
390
  // Load any drop-ins.
391
+ $settings = get_option( 'wpmembers_dropins' );
392
+ $this->dropins_enabled = ( $settings ) ? $settings : array();
393
+ if ( ! empty( $this->dropins_enabled ) ) {
394
+ foreach ( $this->dropins_enabled as $filename ) {
395
+ $dropin = $folder . $filename;
396
+ if ( file_exists( $dropin ) ) {
397
+ include_once( $dropin );
398
+ }
399
+ }
400
  }
401
 
402
  /**
429
  ( ! defined( 'WPMEM_REGURL' ) ) ? define( 'WPMEM_REGURL', $this->user_pages['register'] ) : '';
430
  ( ! defined( 'WPMEM_LOGURL' ) ) ? define( 'WPMEM_LOGURL', $this->user_pages['login'] ) : '';
431
 
432
+ ( ! defined( 'WPMEM_DROPIN_DIR' ) ) ? define( 'WPMEM_DROPIN_DIR', WP_PLUGIN_DIR . '/wp-members-dropins/' ) : '';
433
+
434
  define( 'WPMEM_CSSURL', $this->cssurl );
435
  }
436
 
468
  require_once( WPMEM_PATH . 'inc/sidebar.php' );
469
  require_once( WPMEM_PATH . 'inc/shortcodes.php' );
470
  require_once( WPMEM_PATH . 'inc/email.php' );
471
+ //require_once( WPMEM_PATH . 'inc/users.php' ); @deprecated 3.1.9
472
  require_once( WPMEM_PATH . 'inc/deprecated.php' );
473
  }
474
 
512
  function get_action() {
513
 
514
  // Get the action being done (if any).
515
+ $this->action = sanitize_text_field( wpmem_get( 'a', '', 'request' ) );
516
 
517
  // For backward compatibility with processes that check $wpmem_a.
518
  global $wpmem_a;
851
  case 'multiselect':
852
  case 'multicheckbox':
853
  case 'radio':
854
+ // Correct a malformed value (if last value is empty due to a trailing comma).
855
+ if ( '' == end( $val[7] ) ) {
856
+ array_pop( $val[7] );
857
+ $this->fields[ $meta_key ][7] = $val[7];
858
+ }
859
  $this->fields[ $meta_key ]['values'] = $val[7];
860
  $this->fields[ $meta_key ]['delimiter'] = ( isset( $val[8] ) ) ? $val[8] : '|';
861
  $this->fields[ $meta_key ]['options'] = array();
862
  foreach ( $val[7] as $value ) {
863
+ $pieces = explode( '|', trim( $value ) );
864
+ if ( isset( $pieces[1] ) && $pieces[1] != '' ) {
865
  $this->fields[ $meta_key ]['options'][ $pieces[1] ] = $pieces[0];
866
  }
867
  }
inc/core.php CHANGED
@@ -15,6 +15,10 @@
15
  * @copyright 2006-2017
16
  */
17
 
 
 
 
 
18
 
19
  /**
20
  * The Main Action Function.
15
  * @copyright 2006-2017
16
  */
17
 
18
+ // Exit if accessed directly.
19
+ if ( ! defined( 'ABSPATH' ) ) {
20
+ exit();
21
+ }
22
 
23
  /**
24
  * The Main Action Function.
inc/deprecated.php CHANGED
@@ -16,6 +16,10 @@
16
  * @copyright 2006-2017
17
  */
18
 
 
 
 
 
19
 
20
  if ( ! function_exists( 'wpmem_block' ) ):
21
  /**
@@ -341,4 +345,491 @@ function wpmem_do_sc_pages( $atts, $content, $tag ) {
341
 
342
  return $content;
343
  } // End wpmem_do_sc_pages.
344
- endif;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
16
  * @copyright 2006-2017
17
  */
18
 
19
+ // Exit if accessed directly.
20
+ if ( ! defined( 'ABSPATH' ) ) {
21
+ exit();
22
+ }
23
 
24
  if ( ! function_exists( 'wpmem_block' ) ):
25
  /**
345
 
346
  return $content;
347
  } // End wpmem_do_sc_pages.
348
+ endif;
349
+
350
+ /**
351
+ * Add WP-Members fields to the WP user profile screen.
352
+ *
353
+ * @since 2.1
354
+ *
355
+ * @global array $current_screen The WordPress screen object
356
+ * @global int $user_ID The user ID
357
+ */
358
+ function wpmem_admin_fields() {
359
+
360
+ global $current_screen, $user_ID, $wpmem;
361
+ $user_id = ( $current_screen->id == 'profile' ) ? $user_ID : $_REQUEST['user_id']; ?>
362
+
363
+ <h3><?php
364
+ /**
365
+ * Filter the heading for additional profile fields.
366
+ *
367
+ * @since 2.8.2
368
+ *
369
+ * @param string The default additional fields heading.
370
+ */
371
+ echo apply_filters( 'wpmem_admin_profile_heading', __( 'WP-Members Additional Fields', 'wp-members' ) ); ?></h3>
372
+ <table class="form-table">
373
+ <?php
374
+ // Get fields.
375
+ $wpmem_fields = wpmem_fields( 'admin_profile' );
376
+ // Get excluded meta.
377
+ $exclude = wpmem_get_excluded_meta( 'admin-profile' );
378
+
379
+ /**
380
+ * Fires at the beginning of generating the WP-Members fields in the user profile.
381
+ *
382
+ * @since 2.9.3
383
+ *
384
+ * @param int $user_id The user's ID.
385
+ * @param array $wpmem_fields The WP-Members fields.
386
+ */
387
+ do_action( 'wpmem_admin_before_profile', $user_id, $wpmem_fields );
388
+
389
+ // Assemble form rows array.
390
+ $rows = array();
391
+ foreach ( $wpmem_fields as $meta => $field ) {
392
+
393
+ $valtochk = ''; $values = '';
394
+
395
+ // Determine which fields to show in the additional fields area.
396
+ $show = ( ! $field['native'] && ! in_array( $meta, $exclude ) ) ? true : false;
397
+ $show = ( $field['label'] == 'TOS' && $field['register'] ) ? null : $show;
398
+
399
+ if ( $show ) {
400
+
401
+ $val = get_user_meta( $user_id, $meta, true );
402
+ $val = ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) ? $val : htmlspecialchars( $val );
403
+ if ( $field['type'] == 'checkbox' ) {
404
+ $valtochk = $val;
405
+ $val = $field['checked_value'];
406
+ }
407
+
408
+ if ( 'multicheckbox' == $field['type'] || 'select' == $field['type'] || 'multiselect' == $field['type'] || 'radio' == $field['type'] ) {
409
+ $values = $field['values'];
410
+ $valtochk = $val;
411
+ }
412
+
413
+ // Is this an image or a file?
414
+ if ( 'file' == $field['type'] || 'image' == $field['type'] ) {
415
+ $attachment_url = wp_get_attachment_url( $val );
416
+ $empty_file = '<span class="description">' . __( 'None' ) . '</span>';
417
+ if ( 'file' == $field['type'] ) {
418
+ $input = ( $attachment_url ) ? '<a href="' . $attachment_url . '">' . $attachment_url . '</a>' : $empty_file;
419
+ } else {
420
+ $input = ( $attachment_url ) ? '<img src="' . $attachment_url . '">' : $empty_file;
421
+ }
422
+ $input.= '<br />' . $wpmem->get_text( 'profile_upload' ) . '<br />';
423
+ $input.= wpmem_form_field( array(
424
+ 'name' => $meta,
425
+ 'type' => $field['type'],
426
+ 'value' => $val,
427
+ 'compare' => $valtochk,
428
+ ) );
429
+ } else {
430
+ if ( 'select' == $field['type'] || 'radio' == $field['type'] ) {
431
+ $input = wpmem_create_formfield( $meta, $field['type'], $values, $valtochk );
432
+ } elseif( 'multicheckbox' == $field['type'] || 'multiselect' == $field['type'] ) {
433
+ $input = $wpmem->forms->create_form_field( array( 'name'=>$meta, 'type'=>$field['type'], 'value'=>$values, 'compare'=>$valtochk, 'delimiter'=>$field['delimiter'] ) );
434
+ } else {
435
+ $field['type'] = ( 'hidden' == $field['type'] ) ? 'text' : $field['type'];
436
+ $input = wpmem_create_formfield( $meta, $field['type'], $val, $valtochk );
437
+ }
438
+ }
439
+
440
+ // Is the field required?
441
+ $req = ( $field['required'] ) ? ' <span class="description">' . __( '(required)' ) . '</span>' : '';
442
+ $label = '<label>' . __( $field['label'], 'wp-members' ) . $req . '</label>';
443
+
444
+ // Build the form rows for filtering.
445
+ $rows[ $meta ] = array(
446
+ 'meta' => $meta,
447
+ 'type' => $field['type'],
448
+ 'value' => $val,
449
+ 'values' => $values,
450
+ 'label_text' => __( $field['label'], 'wp-members' ),
451
+ 'row_before' => '',
452
+ 'label' => $label,
453
+ 'field_before' => '',
454
+ 'field' => $input,
455
+ 'field_after' => '',
456
+ 'row_after' => '',
457
+ );
458
+ }
459
+ }
460
+
461
+ /**
462
+ * Filter for rows
463
+ *
464
+ * @since 3.1.0
465
+ * @since 3.1.6 Deprecated $order.
466
+ *
467
+ * @param array $rows {
468
+ * An array of the profile rows.
469
+ *
470
+ * @type string $meta The meta key.
471
+ * @type string $type The field type.
472
+ * @type string $value Value if set.
473
+ * @type string $values Possible values (select, multiselect, multicheckbox, radio).
474
+ * @type string $label_text Raw label text (no HTML).
475
+ * @type string $row_before HTML before the row.
476
+ * @type string $label HTML label.
477
+ * @type string $field_before HTML before the field input tag.
478
+ * @type string $field HTML for field input.
479
+ * @type string $field_after HTML after the field.
480
+ * @type string $row_after HTML after the row.
481
+ * }
482
+ * @param string $toggle
483
+ */
484
+ $rows = apply_filters( 'wpmem_register_form_rows_admin', $rows, 'adminprofile' );
485
+
486
+ // Handle form rows display from array.
487
+ foreach ( $rows as $row ) {
488
+ $show_field = '
489
+ <tr>
490
+ <th>' . $row['label'] . '</th>
491
+ <td>' . $row['field'] . '</td>
492
+ </tr>';
493
+
494
+ /**
495
+ * Filter the profile field.
496
+ *
497
+ * @since 2.8.2
498
+ * @since 3.1.1 Added $user_id and $row
499
+ *
500
+ * @param string $show_field The HTML string for the additional profile field.
501
+ * @param string $user_id
502
+ * @param array $row
503
+ */
504
+ echo apply_filters( 'wpmem_admin_profile_field', $show_field, $user_id, $row );
505
+ }
506
+
507
+ /**
508
+ * Fires after generating the WP-Members fields in the user profile.
509
+ *
510
+ * @since 2.9.3
511
+ *
512
+ * @param int $user_id The user's ID.
513
+ * @param array $wpmem_fields The WP-Members fields.
514
+ */
515
+ do_action( 'wpmem_admin_after_profile', $user_id, $wpmem_fields ); ?>
516
+
517
+ </table><?php
518
+ }
519
+
520
+
521
+ /**
522
+ * Updates WP-Members fields from the WP user profile screen.
523
+ *
524
+ * @since 2.1
525
+ *
526
+ * @global object $wpmem
527
+ */
528
+ function wpmem_admin_update() {
529
+
530
+ $user_id = wpmem_get( 'user_id', false, 'request' ); //$_REQUEST['user_id'];
531
+
532
+ if ( ! $user_id ) {
533
+ // With no user id, no user can be updated.
534
+ return;
535
+ }
536
+
537
+ global $wpmem;
538
+ $wpmem_fields = wpmem_fields( 'admin_profile_update' );
539
+
540
+ /**
541
+ * Fires before the user profile is updated.
542
+ *
543
+ * @since 2.9.2
544
+ *
545
+ * @param int $user_id The user ID.
546
+ * @param array $wpmem_fields Array of the custom fields.
547
+ */
548
+ do_action( 'wpmem_admin_pre_user_update', $user_id, $wpmem_fields );
549
+
550
+ $fields = array();
551
+ $chk_pass = false;
552
+ foreach ( $wpmem_fields as $meta => $field ) {
553
+ if ( ! $field['native']
554
+ && $field['type'] != 'password'
555
+ && $field['type'] != 'checkbox'
556
+ && $field['type'] != 'multiselect'
557
+ && $field['type'] != 'multicheckbox'
558
+ && $field['type'] != 'file'
559
+ && $field['type'] != 'image' ) {
560
+ ( isset( $_POST[ $meta ] ) ) ? $fields[ $meta ] = $_POST[ $meta ] : false;
561
+ } elseif ( $meta == 'password' && $field['register'] ) {
562
+ $chk_pass = true;
563
+ } elseif ( $field['type'] == 'checkbox' ) {
564
+ $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? $_POST[ $meta ] : '';
565
+ } elseif ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
566
+ $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], $_POST[ $meta ] ) : '';
567
+ }
568
+ }
569
+
570
+ /**
571
+ * Filter the submitted field values for backend profile update.
572
+ *
573
+ * @since 2.8.2
574
+ *
575
+ * @param array $fields An array of the posted form values.
576
+ * @param int $user_id The ID of the user being updated.
577
+ */
578
+ $fields = apply_filters( 'wpmem_admin_profile_update', $fields, $user_id );
579
+
580
+ // Get any excluded meta fields.
581
+ $exclude = wpmem_get_excluded_meta( 'admin-profile' );
582
+ foreach ( $fields as $key => $val ) {
583
+ if ( ! in_array( $key, $exclude ) ) {
584
+ update_user_meta( $user_id, $key, $val );
585
+ }
586
+ }
587
+
588
+ if ( ! empty( $_FILES ) ) {
589
+ $wpmem->user->upload_user_files( $user_id, $wpmem->fields );
590
+ }
591
+
592
+ if ( $wpmem->mod_reg == 1 ) {
593
+
594
+ $wpmem_activate_user = ( isset( $_POST['activate_user'] ) == '' ) ? -1 : $_POST['activate_user'];
595
+
596
+ if ( $wpmem_activate_user == 1 ) {
597
+ wpmem_a_activate_user( $user_id, $chk_pass );
598
+ } elseif ( $wpmem_activate_user == 0 ) {
599
+ wpmem_a_deactivate_user( $user_id );
600
+ }
601
+ }
602
+
603
+ if ( defined( 'WPMEM_EXP_MODULE' ) && $wpmem->use_exp == 1 ) {
604
+ if ( function_exists( 'wpmem_a_extenduser' ) ) {
605
+ wpmem_a_extend_user( $user_id );
606
+ }
607
+ }
608
+
609
+ /**
610
+ * Fires after the user profile is updated.
611
+ *
612
+ * @since 2.9.2
613
+ *
614
+ * @param int $user_id The user ID.
615
+ */
616
+ do_action( 'wpmem_admin_after_user_update', $user_id );
617
+
618
+ return;
619
+ }
620
+
621
+ if ( ! function_exists( 'wpmem_user_profile' ) ):
622
+ /**
623
+ * add WP-Members fields to the WP user profile screen.
624
+ *
625
+ * @since 2.6.5
626
+ *
627
+ * @global int $user_id
628
+ */
629
+ function wpmem_user_profile() {
630
+
631
+ global $wpmem, $user_id, $current_screen;
632
+ /**
633
+ * Filter the heading for the user profile additional fields.
634
+ *
635
+ * @since 2.9.1
636
+ *
637
+ * @param string The default heading.
638
+ */?>
639
+ <h3><?php echo apply_filters( 'wpmem_user_profile_heading', __( 'Additional Information', 'wp-members' ) ); ?></h3>
640
+ <table class="form-table">
641
+ <?php
642
+ // Get fields.
643
+ $wpmem_fields = wpmem_fields( 'dashboard_profile' );
644
+ // Get excluded meta.
645
+ $exclude = wpmem_get_excluded_meta( 'user-profile' );
646
+
647
+ $rows = array();
648
+ foreach ( $wpmem_fields as $meta => $field ) {
649
+
650
+ $valtochk = ''; $values = '';
651
+
652
+ // Do we exclude the row?
653
+ $chk_pass = ( in_array( $meta, $exclude ) ) ? false : true;
654
+
655
+ if ( $field['register'] && ! $field['native'] && $chk_pass ) {
656
+
657
+ $val = get_user_meta( $user_id, $meta, true );
658
+
659
+ if ( $field['type'] == 'checkbox' ) {
660
+ $valtochk = $val;
661
+ $val = $field['checked_value'];
662
+ }
663
+
664
+ if ( 'multicheckbox' == $field['type'] || 'select' == $field['type'] || 'multiselect' == $field['type'] || 'radio' == $field['type'] ) {
665
+ $values = $field['values'];
666
+ $valtochk = $val;
667
+ }
668
+
669
+ // Is this an image or a file?
670
+ if ( 'file' == $field['type'] || 'image' == $field['type'] ) {
671
+ $attachment_url = wp_get_attachment_url( $val );
672
+ $empty_file = '<span class="description">' . __( 'None' ) . '</span>';
673
+ if ( 'file' == $field['type'] ) {
674
+ $input = ( $attachment_url ) ? '<a href="' . $attachment_url . '">' . $attachment_url . '</a>' : $empty_file;
675
+ } else {
676
+ $input = ( $attachment_url ) ? '<img src="' . $attachment_url . '">' : $empty_file;
677
+ }
678
+ $input.= '<br />' . $wpmem->get_text( 'profile_upload' ) . '<br />';
679
+ $input.= wpmem_form_field( array(
680
+ 'name' => $meta,
681
+ 'type' => $field['type'],
682
+ 'value' => $val,
683
+ 'compare' => $valtochk,
684
+ ) );
685
+ } else {
686
+ if ( $meta == 'tos' && $val == 'agree' ) {
687
+ $input = wpmem_create_formfield( $meta, 'hidden', $val );
688
+ } elseif ( 'multicheckbox' == $field['type'] || 'select' == $field['type'] || 'multiselect' == $field['type'] || 'radio' == $field['type'] ) {
689
+ $input = wpmem_create_formfield( $meta, $field['type'], $values, $valtochk );
690
+ } else {
691
+ $input = wpmem_create_formfield( $meta, $field['type'], $val, $valtochk );
692
+ }
693
+ }
694
+
695
+ // If there are any required fields.
696
+ $req = ( $field['required'] ) ? ' <span class="description">' . __( '(required)' ) . '</span>' : '';
697
+ $label = '<label>' . __( $field['label'], 'wp-members' ) . $req . '</label>';
698
+
699
+ // Build the form rows for filtering.
700
+ $rows[ $meta ] = array(
701
+ 'type' => $field['type'],
702
+ 'value' => $val,
703
+ 'values' => $values,
704
+ 'label_text' => __( $field['label'], 'wp-members' ),
705
+ 'row_before' => '',
706
+ 'label' => $label,
707
+ 'field_before' => '',
708
+ 'field' => $input,
709
+ 'field_after' => '',
710
+ 'row_after' => '',
711
+ );
712
+ }
713
+ }
714
+
715
+ /**
716
+ * Filter for rows
717
+ *
718
+ * @since 3.1.0
719
+ * @since 3.1.6 Deprecated $order and $meta.
720
+ *
721
+ * @param array $rows {
722
+ * An array of the profile rows.
723
+ *
724
+ * @type string $type The field type.
725
+ * @type string $value Value if set.
726
+ * @type string $values Possible values (select, multiselect, multicheckbox, radio).
727
+ * @type string $label_text Raw label text (no HTML).
728
+ * @type string $row_before HTML before the row.
729
+ * @type string $label HTML label.
730
+ * @type string $field_before HTML before the field input tag.
731
+ * @type string $field HTML for field input.
732
+ * @type string $field_after HTML after the field.
733
+ * @type string $row_after HTML after the row.
734
+ * }
735
+ * @param string $toggle
736
+ */
737
+ $rows = apply_filters( 'wpmem_register_form_rows_profile', $rows, 'userprofile' );
738
+
739
+ foreach ( $rows as $row ) {
740
+
741
+ $show_field = '
742
+ <tr>
743
+ <th>' . $row['label'] . '</th>
744
+ <td>' . $row['field'] . '</td>
745
+ </tr>';
746
+
747
+ /**
748
+ * Filter the field for user profile additional fields.
749
+ *
750
+ * @since 2.9.1
751
+ * @since 3.1.1 Added $user_id and $row.
752
+ *
753
+ * @param string $show_field The HTML string of the additional field.
754
+ * @param int $user_id
755
+ * @param array $rows
756
+ */
757
+ echo apply_filters( 'wpmem_user_profile_field', $show_field, $user_id, $row );
758
+
759
+ } ?>
760
+ </table><?php
761
+ }
762
+ endif;
763
+
764
+
765
+ /**
766
+ * updates WP-Members fields from the WP user profile screen.
767
+ *
768
+ * @since 2.6.5
769
+ *
770
+ * @global int $user_id
771
+ */
772
+ function wpmem_profile_update() {
773
+
774
+ global $wpmem, $user_id;
775
+ // Get the fields.
776
+ $wpmem_fields = wpmem_fields( 'dashboard_profile_update' );
777
+ // Get any excluded meta fields.
778
+ $exclude = wpmem_get_excluded_meta( 'user-profile' );
779
+ foreach ( $wpmem_fields as $meta => $field ) {
780
+ // If this is not an excluded meta field.
781
+ if ( ! in_array( $meta, $exclude ) ) {
782
+ // If the field is user editable.
783
+ if ( $field['register']
784
+ && $field['type'] != 'password'
785
+ && $field['type'] != 'file'
786
+ && $field['type'] != 'image'
787
+ && ! $field['native'] ) {
788
+
789
+ // Check for required fields.
790
+ $chk = '';
791
+ if ( ! $field['required'] ) {
792
+ $chk = 'ok';
793
+ }
794
+ if ( $field['required'] && $_POST[ $meta ] != '' ) {
795
+ $chk = 'ok';
796
+ }
797
+
798
+ // Check for field value.
799
+ if ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
800
+ $field_val = ( isset( $_POST[ $meta ] ) ) ? implode( '|', $_POST[ $meta ] ) : '';
801
+ } else {
802
+ $field_val = ( isset( $_POST[ $meta ] ) ) ? $_POST[ $meta ] : '';
803
+ }
804
+
805
+ if ( $chk == 'ok' ) {
806
+ update_user_meta( $user_id, $meta, $field_val );
807
+ }
808
+ }
809
+ }
810
+ }
811
+
812
+ if ( ! empty( $_FILES ) ) {
813
+ $wpmem->user->upload_user_files( $user_id, $wpmem_fields );
814
+ }
815
+ }
816
+
817
+ /**
818
+ * Sets user profile update to multipart form data.
819
+ *
820
+ * If the fields array has a file or image field, this will echo the
821
+ * necessary "multipart/form-data" enctype for the form tag.
822
+ *
823
+ * @since 3.1.8
824
+ */
825
+ function wpmem_user_profile_multipart() {
826
+ global $wpmem;
827
+ $has_file = false;
828
+ foreach ( wpmem_fields() as $field ) {
829
+ if ( $field['type'] == 'file' || $field['type'] == 'image' ) {
830
+ $has_file = true;
831
+ break;
832
+ }
833
+ }
834
+ echo ( $has_file ) ? " enctype=\"multipart/form-data\"" : '';
835
+ }
inc/dialogs.php CHANGED
@@ -23,6 +23,10 @@
23
  * - wpmem_inc_forgotusername
24
  */
25
 
 
 
 
 
26
 
27
  if ( ! function_exists( 'wpmem_inc_loginfailed' ) ):
28
  /**
@@ -493,7 +497,9 @@ function wpmem_page_user_edit( $wpmem_regchk, $content ) {
493
  */
494
  $heading = apply_filters( 'wpmem_user_edit_heading', $wpmem->get_text( 'profile_heading' ) );
495
 
496
- if ( $wpmem_a == "update") { $content.= wpmem_inc_regmessage( $wpmem_regchk, $wpmem_themsg ); }
 
 
497
  $content = $content . wpmem_inc_registration( 'edit', $heading );
498
 
499
  return $content;
23
  * - wpmem_inc_forgotusername
24
  */
25
 
26
+ // Exit if accessed directly.
27
+ if ( ! defined( 'ABSPATH' ) ) {
28
+ exit();
29
+ }
30
 
31
  if ( ! function_exists( 'wpmem_inc_loginfailed' ) ):
32
  /**
497
  */
498
  $heading = apply_filters( 'wpmem_user_edit_heading', $wpmem->get_text( 'profile_heading' ) );
499
 
500
+ if ( $wpmem_a == "update") {
501
+ $content.= wpmem_inc_regmessage( $wpmem_regchk, $wpmem_themsg );
502
+ }
503
  $content = $content . wpmem_inc_registration( 'edit', $heading );
504
 
505
  return $content;
inc/email.php CHANGED
@@ -21,6 +21,10 @@
21
  * - wpmem_mail_from_name
22
  */
23
 
 
 
 
 
24
 
25
  if ( ! function_exists( 'wpmem_inc_regemail' ) ):
26
  /**
21
  * - wpmem_mail_from_name
22
  */
23
 
24
+ // Exit if accessed directly.
25
+ if ( ! defined( 'ABSPATH' ) ) {
26
+ exit();
27
+ }
28
 
29
  if ( ! function_exists( 'wpmem_inc_regemail' ) ):
30
  /**
inc/forms.php CHANGED
@@ -25,6 +25,10 @@
25
  * - wpmem_build_rs_captcha
26
  */
27
 
 
 
 
 
28
 
29
  if ( ! function_exists( 'wpmem_inc_login' ) ):
30
  /**
25
  * - wpmem_build_rs_captcha
26
  */
27
 
28
+ // Exit if accessed directly.
29
+ if ( ! defined( 'ABSPATH' ) ) {
30
+ exit();
31
+ }
32
 
33
  if ( ! function_exists( 'wpmem_inc_login' ) ):
34
  /**
inc/register.php CHANGED
@@ -19,6 +19,10 @@
19
  * - wpmem_get_captcha_err
20
  */
21
 
 
 
 
 
22
 
23
  if ( ! function_exists( 'wpmem_registration' ) ):
24
  /**
@@ -185,16 +189,16 @@ function wpmem_registration( $tag ) {
185
  $wpmem->user->post_data['user_registered'] = current_time( 'mysql', 1 );
186
  $wpmem->user->post_data['user_role'] = get_option( 'default_role' );
187
  $wpmem->user->post_data['wpmem_reg_ip'] = $_SERVER['REMOTE_ADDR'];
188
- $wpmem->user->post_data['wpmem_reg_url'] = wpmem_get( 'wpmem_reg_page', wpmem_get( 'redirect_to', false, 'request' ), 'request' );
189
 
190
  /*
191
  * These native fields are not installed by default, but if they
192
  * are added, use the $_POST value - otherwise, default to username.
193
  * Value can be filtered with wpmem_register_data.
194
  */
195
- $wpmem->user->post_data['user_nicename'] = wpmem_get( 'user_nicename', $wpmem->user->post_data['username'] );
196
- $wpmem->user->post_data['display_name'] = wpmem_get( 'display_name', $wpmem->user->post_data['username'] );
197
- $wpmem->user->post_data['nickname'] = wpmem_get( 'nickname', $wpmem->user->post_data['username'] );
198
  /**
199
  * Filter registration data after validation before data insertion.
200
  *
@@ -271,15 +275,17 @@ function wpmem_registration( $tag ) {
271
  * see if it's different, then check if it is a valid address and it exists.
272
  */
273
  global $current_user; wp_get_current_user();
274
- if ( $wpmem->user->post_data['user_email'] != $current_user->user_email ) {
275
- if ( email_exists( $wpmem->user->post_data['user_email'] ) ) {
276
- return "email";
277
- exit();
278
- }
279
- if ( in_array( 'user_email', $wpmem->fields ) && ! is_email( $wpmem->user->post_data['user_email']) ) {
280
- $wpmem_themsg = $wpmem->get_text( 'reg_valid_email' );
281
- return "updaterr";
282
- exit();
 
 
283
  }
284
  }
285
 
@@ -330,7 +336,7 @@ function wpmem_registration( $tag ) {
330
  'aim',
331
  'yim'
332
  );
333
- $native_update = array( 'ID' => $user_ID );
334
 
335
  foreach ( $wpmem->fields as $meta_key => $field ) {
336
  // If the field is not excluded, update accordingly.
@@ -352,7 +358,7 @@ function wpmem_registration( $tag ) {
352
  // Everything else goes into wp_usermeta.
353
  default:
354
  if ( $field['register'] ) {
355
- update_user_meta( $user_ID, $meta_key, $wpmem->user->post_data[ $meta_key ] );
356
  }
357
  break;
358
  }
@@ -449,52 +455,18 @@ function wpmem_register_handle_captcha() {
449
 
450
  // Get the captcha settings (api keys).
451
  $wpmem_captcha = get_option( 'wpmembers_captcha' );
452
-
 
 
 
 
 
453
  // If captcha is on, check the captcha.
454
  if ( $wpmem->captcha == 1 && $wpmem_captcha['recaptcha'] ) {
455
-
456
- // If there is no api key, the captcha never displayed to the end user.
457
- if ( $wpmem_captcha['recaptcha']['public'] && $wpmem_captcha['recaptcha']['private'] ) {
458
- if ( ! $_POST["recaptcha_response_field"] ) { // validate for empty captcha field
459
- $wpmem_themsg = $wpmem->get_text( 'reg_empty_captcha' );
460
- return "empty";
461
- }
462
- }
463
-
464
- // Check to see if the recaptcha library has already been loaded by another plugin.
465
- if ( ! function_exists( '_recaptcha_qsencode' ) ) {
466
- require_once( WPMEM_PATH . 'lib/recaptchalib.php' );
467
- }
468
-
469
- $publickey = $wpmem_captcha['recaptcha']['public'];
470
- $privatekey = $wpmem_captcha['recaptcha']['private'];
471
-
472
- // The response from reCAPTCHA.
473
- $resp = null;
474
- // The error code from reCAPTCHA, if any.
475
- $error = null;
476
-
477
- if ( $_POST["recaptcha_response_field"] ) {
478
-
479
- $resp = recaptcha_check_answer (
480
- $privatekey,
481
- $_SERVER["REMOTE_ADDR"],
482
- $_POST["recaptcha_challenge_field"],
483
- $_POST["recaptcha_response_field"]
484
- );
485
-
486
- if ( ! $resp->is_valid ) {
487
-
488
- // Set the error code so that we can display it.
489
- global $wpmem_captcha_err;
490
- $wpmem_captcha_err = $resp->error;
491
- $wpmem_captcha_err = wpmem_get_captcha_err( $wpmem_captcha_err );
492
-
493
- return "captcha";
494
-
495
- }
496
- } // End check recaptcha.
497
- } elseif ( $wpmem->captcha == 2 ) {
498
  if ( defined( 'REALLYSIMPLECAPTCHA_VERSION' ) ) {
499
  // Validate Really Simple Captcha.
500
  $wpmem_captcha = new ReallySimpleCaptcha();
19
  * - wpmem_get_captcha_err
20
  */
21
 
22
+ // Exit if accessed directly.
23
+ if ( ! defined( 'ABSPATH' ) ) {
24
+ exit();
25
+ }
26
 
27
  if ( ! function_exists( 'wpmem_registration' ) ):
28
  /**
189
  $wpmem->user->post_data['user_registered'] = current_time( 'mysql', 1 );
190
  $wpmem->user->post_data['user_role'] = get_option( 'default_role' );
191
  $wpmem->user->post_data['wpmem_reg_ip'] = $_SERVER['REMOTE_ADDR'];
192
+ $wpmem->user->post_data['wpmem_reg_url'] = esc_url_raw( wpmem_get( 'wpmem_reg_page', wpmem_get( 'redirect_to', false, 'request' ), 'request' ) );
193
 
194
  /*
195
  * These native fields are not installed by default, but if they
196
  * are added, use the $_POST value - otherwise, default to username.
197
  * Value can be filtered with wpmem_register_data.
198
  */
199
+ $wpmem->user->post_data['user_nicename'] = sanitize_text_field( wpmem_get( 'user_nicename', $wpmem->user->post_data['username'] ) );
200
+ $wpmem->user->post_data['display_name'] = sanitize_text_field( wpmem_get( 'display_name', $wpmem->user->post_data['username'] ) );
201
+ $wpmem->user->post_data['nickname'] = sanitize_text_field( wpmem_get( 'nickname', $wpmem->user->post_data['username'] ) );
202
  /**
203
  * Filter registration data after validation before data insertion.
204
  *
275
  * see if it's different, then check if it is a valid address and it exists.
276
  */
277
  global $current_user; wp_get_current_user();
278
+ if ( isset( $wpmem->user->post_data['user_email'] ) ) {
279
+ if ( $wpmem->user->post_data['user_email'] != $current_user->user_email ) {
280
+ if ( email_exists( $wpmem->user->post_data['user_email'] ) ) {
281
+ return "email";
282
+ exit();
283
+ }
284
+ if ( in_array( 'user_email', $wpmem->fields ) && ! is_email( $wpmem->user->post_data['user_email']) ) {
285
+ $wpmem_themsg = $wpmem->get_text( 'reg_valid_email' );
286
+ return "updaterr";
287
+ exit();
288
+ }
289
  }
290
  }
291
 
336
  'aim',
337
  'yim'
338
  );
339
+ $native_update = array( 'ID' => $wpmem->user->post_data['ID'] );
340
 
341
  foreach ( $wpmem->fields as $meta_key => $field ) {
342
  // If the field is not excluded, update accordingly.
358
  // Everything else goes into wp_usermeta.
359
  default:
360
  if ( $field['register'] ) {
361
+ update_user_meta( $wpmem->user->post_data['ID'], $meta_key, $wpmem->user->post_data[ $meta_key ] );
362
  }
363
  break;
364
  }
455
 
456
  // Get the captcha settings (api keys).
457
  $wpmem_captcha = get_option( 'wpmembers_captcha' );
458
+
459
+ /*
460
+ * @todo reCAPTCHA v1 is deprecated by Google. It is also no longer allowed
461
+ * to be set for new installs of WP-Members. It is NOT compatible with
462
+ * PHP 7.1 and is therefore fully obsolete.
463
+ */
464
  // If captcha is on, check the captcha.
465
  if ( $wpmem->captcha == 1 && $wpmem_captcha['recaptcha'] ) {
466
+ $wpmem->captcha = 3;
467
+ }
468
+
469
+ if ( $wpmem->captcha == 2 ) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
470
  if ( defined( 'REALLYSIMPLECAPTCHA_VERSION' ) ) {
471
  // Validate Really Simple Captcha.
472
  $wpmem_captcha = new ReallySimpleCaptcha();
inc/shortcodes.php CHANGED
@@ -26,6 +26,11 @@
26
  * - wpmem_sc_tos
27
  */
28
 
 
 
 
 
 
29
  /**
30
  * Function for forms called by shortcode.
31
  *
@@ -467,7 +472,7 @@ function wpmem_sc_fields( $atts, $content = null, $tag ) {
467
 
468
  // What user?
469
  if ( isset( $atts['id'] ) ) {
470
- $the_ID = ( $atts['id'] == 'get' ) ? wpmem_get( 'uid', '', 'get' ) : $atts['id'];
471
  } else {
472
  $the_ID = get_current_user_id();
473
  }
@@ -527,6 +532,17 @@ function wpmem_sc_fields( $atts, $content = null, $tag ) {
527
  $result = ( isset( $atts['display'] ) && 'raw' == $atts['display'] ) ? $user_info->{$field} : nl2br( $user_info->{$field} );
528
  }
529
 
 
 
 
 
 
 
 
 
 
 
 
530
  // Remove underscores from value if requested (default: on).
531
  if ( isset( $atts['underscores'] ) && 'off' == $atts['underscores'] && $user_info ) {
532
  $result = str_replace( '_', ' ', $result );
26
  * - wpmem_sc_tos
27
  */
28
 
29
+ // Exit if accessed directly.
30
+ if ( ! defined( 'ABSPATH' ) ) {
31
+ exit();
32
+ }
33
+
34
  /**
35
  * Function for forms called by shortcode.
36
  *
472
 
473
  // What user?
474
  if ( isset( $atts['id'] ) ) {
475
+ $the_ID = ( $atts['id'] == 'get' ) ? filter_var( wpmem_get( 'uid', '', 'get' ), FILTER_SANITIZE_NUMBER_INT ) : $atts['id']; // Ultimately, the_ID will be checked to determine if it is numeric by WP_User::get_data_by().
476
  } else {
477
  $the_ID = get_current_user_id();
478
  }
532
  $result = ( isset( $atts['display'] ) && 'raw' == $atts['display'] ) ? $user_info->{$field} : nl2br( $user_info->{$field} );
533
  }
534
 
535
+ // Handle date fields.
536
+ if ( isset( $field_type ) && 'date' == $field_type ) {
537
+ if ( isset( $atts['format'] ) ) {
538
+ // Formats date: http://php.net/manual/en/function.date.php
539
+ $result = date( $atts['format'], strtotime( $user_info->{$field} ) );
540
+ } else {
541
+ // Formats date to whatever the WP setting is.
542
+ $result = date_i18n( get_option( 'date_format' ), strtotime( $user_info->{$field} ) );
543
+ }
544
+ }
545
+
546
  // Remove underscores from value if requested (default: on).
547
  if ( isset( $atts['underscores'] ) && 'off' == $atts['underscores'] && $user_info ) {
548
  $result = str_replace( '_', ' ', $result );
inc/sidebar.php CHANGED
@@ -19,6 +19,10 @@
19
  * - widget_wpmemwidget
20
  */
21
 
 
 
 
 
22
 
23
  if ( ! function_exists( 'wpmem_inc_status' ) ):
24
  /**
19
  * - widget_wpmemwidget
20
  */
21
 
22
+ // Exit if accessed directly.
23
+ if ( ! defined( 'ABSPATH' ) ) {
24
+ exit();
25
+ }
26
 
27
  if ( ! function_exists( 'wpmem_inc_status' ) ):
28
  /**
inc/utilities.php CHANGED
@@ -26,6 +26,10 @@
26
  * - wpmem_write_log
27
  */
28
 
 
 
 
 
29
 
30
  if ( ! function_exists( 'wpmem_create_formfield' ) ):
31
  /**
26
  * - wpmem_write_log
27
  */
28
 
29
+ // Exit if accessed directly.
30
+ if ( ! defined( 'ABSPATH' ) ) {
31
+ exit();
32
+ }
33
 
34
  if ( ! function_exists( 'wpmem_create_formfield' ) ):
35
  /**
inc/wp-registration.php CHANGED
@@ -20,6 +20,10 @@
20
  * - wpmem_do_wp_newuser_form
21
  */
22
 
 
 
 
 
23
 
24
  /**
25
  * Appends WP-Members registration fields to wp-login.php registration form.
20
  * - wpmem_do_wp_newuser_form
21
  */
22
 
23
+ // Exit if accessed directly.
24
+ if ( ! defined( 'ABSPATH' ) ) {
25
+ exit();
26
+ }
27
 
28
  /**
29
  * Appends WP-Members registration fields to wp-login.php registration form.
lib/comments_template.php DELETED
@@ -1,7 +0,0 @@
1
- <?php
2
- /**
3
- * Dummy comments template file.
4
- * This replaces the theme's comment template when comments are protected.
5
- *
6
- * @since 2.9.9
7
- */
 
 
 
 
 
 
 
lib/index.php DELETED
@@ -1 +0,0 @@
1
- <?php // Nothing to see here!
 
lib/recaptchalib.php DELETED
@@ -1,277 +0,0 @@
1
- <?php
2
- /*
3
- * This is a PHP library that handles calling reCAPTCHA.
4
- * - Documentation and latest version
5
- * http://recaptcha.net/plugins/php/
6
- * - Get a reCAPTCHA API Key
7
- * https://www.google.com/recaptcha/admin/create
8
- * - Discussion group
9
- * http://groups.google.com/group/recaptcha
10
- *
11
- * Copyright (c) 2007 reCAPTCHA -- http://recaptcha.net
12
- * AUTHORS:
13
- * Mike Crawford
14
- * Ben Maurer
15
- *
16
- * Permission is hereby granted, free of charge, to any person obtaining a copy
17
- * of this software and associated documentation files (the "Software"), to deal
18
- * in the Software without restriction, including without limitation the rights
19
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
20
- * copies of the Software, and to permit persons to whom the Software is
21
- * furnished to do so, subject to the following conditions:
22
- *
23
- * The above copyright notice and this permission notice shall be included in
24
- * all copies or substantial portions of the Software.
25
- *
26
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
27
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
28
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
29
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
30
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
31
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
32
- * THE SOFTWARE.
33
- */
34
-
35
- /**
36
- * The reCAPTCHA server URL's
37
- */
38
- define("RECAPTCHA_API_SERVER", "http://www.google.com/recaptcha/api");
39
- define("RECAPTCHA_API_SECURE_SERVER", "https://www.google.com/recaptcha/api");
40
- define("RECAPTCHA_VERIFY_SERVER", "www.google.com");
41
-
42
- /**
43
- * Encodes the given data into a query string format
44
- * @param $data - array of string elements to be encoded
45
- * @return string - encoded request
46
- */
47
- function _recaptcha_qsencode ($data) {
48
- $req = "";
49
- foreach ( $data as $key => $value )
50
- $req .= $key . '=' . urlencode( stripslashes($value) ) . '&';
51
-
52
- // Cut the last '&'
53
- $req=substr($req,0,strlen($req)-1);
54
- return $req;
55
- }
56
-
57
-
58
-
59
- /**
60
- * Submits an HTTP POST to a reCAPTCHA server
61
- * @param string $host
62
- * @param string $path
63
- * @param array $data
64
- * @param int port
65
- * @return array response
66
- */
67
- function _recaptcha_http_post($host, $path, $data, $port = 80) {
68
-
69
- $req = _recaptcha_qsencode ($data);
70
-
71
- $http_request = "POST $path HTTP/1.0\r\n";
72
- $http_request .= "Host: $host\r\n";
73
- $http_request .= "Content-Type: application/x-www-form-urlencoded;\r\n";
74
- $http_request .= "Content-Length: " . strlen($req) . "\r\n";
75
- $http_request .= "User-Agent: reCAPTCHA/PHP\r\n";
76
- $http_request .= "\r\n";
77
- $http_request .= $req;
78
-
79
- $response = '';
80
- if( false == ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
81
- die ('Could not open socket');
82
- }
83
-
84
- fwrite($fs, $http_request);
85
-
86
- while ( !feof($fs) )
87
- $response .= fgets($fs, 1160); // One TCP-IP packet
88
- fclose($fs);
89
- $response = explode("\r\n\r\n", $response, 2);
90
-
91
- return $response;
92
- }
93
-
94
-
95
-
96
- /**
97
- * Gets the challenge HTML (javascript and non-javascript version).
98
- * This is called from the browser, and the resulting reCAPTCHA HTML widget
99
- * is embedded within the HTML form it was called from.
100
- * @param string $pubkey A public key for reCAPTCHA
101
- * @param string $error The error given by reCAPTCHA (optional, default is null)
102
- * @param boolean $use_ssl Should the request be made over ssl? (optional, default is false)
103
-
104
- * @return string - The HTML to be embedded in the user's form.
105
- */
106
- function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false)
107
- {
108
- if ($pubkey == null || $pubkey == '') {
109
- die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
110
- }
111
-
112
- if ($use_ssl) {
113
- $server = RECAPTCHA_API_SECURE_SERVER;
114
- } else {
115
- $server = RECAPTCHA_API_SERVER;
116
- }
117
-
118
- $errorpart = "";
119
- if ($error) {
120
- $errorpart = "&amp;error=" . $error;
121
- }
122
- return '<script type="text/javascript" src="'. $server . '/challenge?k=' . $pubkey . $errorpart . '"></script>
123
-
124
- <noscript>
125
- <iframe src="'. $server . '/noscript?k=' . $pubkey . $errorpart . '" height="300" width="500" frameborder="0"></iframe><br/>
126
- <textarea name="recaptcha_challenge_field" rows="3" cols="40"></textarea>
127
- <input type="hidden" name="recaptcha_response_field" value="manual_challenge"/>
128
- </noscript>';
129
- }
130
-
131
-
132
-
133
-
134
- /**
135
- * A WPMEM_ReCaptchaResponse is returned from recaptcha_check_answer()
136
- */
137
- class WPMEM_ReCaptchaResponse {
138
- var $is_valid;
139
- var $error;
140
- }
141
-
142
-
143
- /**
144
- * Calls an HTTP POST function to verify if the user's guess was correct
145
- * @param string $privkey
146
- * @param string $remoteip
147
- * @param string $challenge
148
- * @param string $response
149
- * @param array $extra_params an array of extra variables to post to the server
150
- * @return WPMEM_ReCaptchaResponse
151
- */
152
- function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $extra_params = array())
153
- {
154
- if ($privkey == null || $privkey == '') {
155
- die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
156
- }
157
-
158
- if ($remoteip == null || $remoteip == '') {
159
- die ("For security reasons, you must pass the remote ip to reCAPTCHA");
160
- }
161
-
162
-
163
-
164
- //discard spam submissions
165
- if ($challenge == null || strlen($challenge) == 0 || $response == null || strlen($response) == 0) {
166
- $recaptcha_response = new WPMEM_ReCaptchaResponse();
167
- $recaptcha_response->is_valid = false;
168
- $recaptcha_response->error = 'incorrect-captcha-sol';
169
- return $recaptcha_response;
170
- }
171
-
172
- $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify",
173
- array (
174
- 'privatekey' => $privkey,
175
- 'remoteip' => $remoteip,
176
- 'challenge' => $challenge,
177
- 'response' => $response
178
- ) + $extra_params
179
- );
180
-
181
- $answers = explode ("\n", $response [1]);
182
- $recaptcha_response = new WPMEM_ReCaptchaResponse();
183
-
184
- if (trim ($answers [0]) == 'true') {
185
- $recaptcha_response->is_valid = true;
186
- }
187
- else {
188
- $recaptcha_response->is_valid = false;
189
- $recaptcha_response->error = $answers [1];
190
- }
191
- return $recaptcha_response;
192
-
193
- }
194
-
195
- /**
196
- * gets a URL where the user can sign up for reCAPTCHA. If your application
197
- * has a configuration page where you enter a key, you should provide a link
198
- * using this function.
199
- * @param string $domain The domain where the page is hosted
200
- * @param string $appname The name of your application
201
- */
202
- function recaptcha_get_signup_url ($domain = null, $appname = null) {
203
- return "https://www.google.com/recaptcha/admin/create?" . _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname));
204
- }
205
-
206
- function _recaptcha_aes_pad($val) {
207
- $block_size = 16;
208
- $numpad = $block_size - (strlen ($val) % $block_size);
209
- return str_pad($val, strlen ($val) + $numpad, chr($numpad));
210
- }
211
-
212
- /* Mailhide related code */
213
-
214
- function _recaptcha_aes_encrypt($val,$ky) {
215
- if (! function_exists ("mcrypt_encrypt")) {
216
- die ("To use reCAPTCHA Mailhide, you need to have the mcrypt php module installed.");
217
- }
218
- $mode=MCRYPT_MODE_CBC;
219
- $enc=MCRYPT_RIJNDAEL_128;
220
- $val=_recaptcha_aes_pad($val);
221
- return mcrypt_encrypt($enc, $ky, $val, $mode, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
222
- }
223
-
224
-
225
- function _recaptcha_mailhide_urlbase64 ($x) {
226
- return strtr(base64_encode ($x), '+/', '-_');
227
- }
228
-
229
- /* gets the reCAPTCHA Mailhide url for a given email, public key and private key */
230
- function recaptcha_mailhide_url($pubkey, $privkey, $email) {
231
- if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
232
- die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
233
- "you can do so at <a href='http://www.google.com/recaptcha/mailhide/apikey'>http://www.google.com/recaptcha/mailhide/apikey</a>");
234
- }
235
-
236
-
237
- $ky = pack('H*', $privkey);
238
- $cryptmail = _recaptcha_aes_encrypt ($email, $ky);
239
-
240
- return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
241
- }
242
-
243
- /**
244
- * gets the parts of the email to expose to the user.
245
- * eg, given johndoe@example,com return ["john", "example.com"].
246
- * the email is then displayed as john...@example.com
247
- */
248
- function _recaptcha_mailhide_email_parts ($email) {
249
- $arr = preg_split("/@/", $email );
250
-
251
- if (strlen ($arr[0]) <= 4) {
252
- $arr[0] = substr ($arr[0], 0, 1);
253
- } else if (strlen ($arr[0]) <= 6) {
254
- $arr[0] = substr ($arr[0], 0, 3);
255
- } else {
256
- $arr[0] = substr ($arr[0], 0, 4);
257
- }
258
- return $arr;
259
- }
260
-
261
- /**
262
- * Gets html to display an email address given a public an private key.
263
- * to get a key, go to:
264
- *
265
- * http://www.google.com/recaptcha/mailhide/apikey
266
- */
267
- function recaptcha_mailhide_html($pubkey, $privkey, $email) {
268
- $emailparts = _recaptcha_mailhide_email_parts ($email);
269
- $url = recaptcha_mailhide_url ($pubkey, $privkey, $email);
270
-
271
- return htmlentities($emailparts[0]) . "<a href='" . htmlentities ($url) .
272
- "' onclick=\"window.open('" . htmlentities ($url) . "', '', 'toolbar=0,scrollbars=0,location=0,statusbar=0,menubar=0,resizable=0,width=500,height=300'); return false;\" title=\"Reveal this e-mail address\">...</a>@" . htmlentities ($emailparts [1]);
273
-
274
- }
275
-
276
-
277
- ?>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
readme.txt CHANGED
@@ -1,12 +1,12 @@
1
- === WP-Members: Membership Framework ===
2
  Contributors: cbutlerjr
3
  Tags: access, authentication, content, login, member, membership, password, protect, register, registration, restriction, subscriber
4
  Requires at least: 3.6
5
- Tested up to: 4.7
6
- Stable tag: 3.1.8.1
7
  License: GPLv2
8
 
9
- WP-Members&trade; is a free membership management framework for WordPress&reg; that restricts content to registered users.
10
 
11
  == Description ==
12
 
@@ -112,8 +112,8 @@ Premium priority support is available at the plugin's site [RocketGeek.com](http
112
 
113
  == Upgrade Notice ==
114
 
115
- WP-Members 3.1.8 is a major update. There are no database changes (rollback is possible). See changelog for important details. Minimum WP version is 3.6.
116
- WP-Members 3.1.8.1 corrects a minor issue for text area fields. See changelog.
117
 
118
  == Screenshots ==
119
 
@@ -136,12 +136,37 @@ WP-Members 3.1.8.1 corrects a minor issue for text area fields. See changelog.
136
 
137
  == Changelog ==
138
 
139
- = 3.1.8.1 =
140
 
141
- * Corrects an issue with user profile display/update of textarea fields that are not the WP default bio field.
142
- * Added display=raw attribute handling to textarea fields to allow display without converting line breaks to HTML br tags.
143
- * Fixes issue with User Profile form heading not using the get_text() value.
144
- * Improves logic for displaying register link in login form if login page is not set.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
145
 
146
  = 3.1.8 =
147
 
@@ -161,6 +186,10 @@ WP-Members 3.1.8.1 corrects a minor issue for text area fields. See changelog.
161
  * Fields Tab: improved field add/edit screen: return link at bottom of page, display current field upon successful form submission, success message include return link.
162
  * Fields Tab: added support for HTML5 field types: number, date.
163
  * Fields Tab: added support for HTML5 field attributes: placeholder, pattern (regex), title, min, max.
 
 
 
 
164
 
165
  = 3.1.7 =
166
 
1
+ === WP-Members Membership Plugin ===
2
  Contributors: cbutlerjr
3
  Tags: access, authentication, content, login, member, membership, password, protect, register, registration, restriction, subscriber
4
  Requires at least: 3.6
5
+ Tested up to: 4.9
6
+ Stable tag: 3.1.9.3
7
  License: GPLv2
8
 
9
+ WP-Members membership plugin turns your WordPress site into a membership site. Restrict premium content, require registration with custom fields, and more.
10
 
11
  == Description ==
12
 
112
 
113
  == Upgrade Notice ==
114
 
115
+ WP-Members 3.1.9 is a major update. There are no database changes (rollback is possible). See changelog for important details. Minimum WP version is 3.6.
116
+ WP-Members 3.1.9.3 is a bug fix and security update. All users running 3.1.9 or higher should update.
117
 
118
  == Screenshots ==
119
 
136
 
137
  == Changelog ==
138
 
139
+ = 3.1.9.3 =
140
 
141
+ * Security update for 3.1.9.
142
+ * Fix for multiple checkbox and multiple select field types if "comma" was selected as the delimiter (previously, this would break the field settings array option assembly).
143
+ * Improvements on field manager add/edit field screen.
144
+ * Improvements to multiple checkbox and radio groups: better handling of non-value selections and span wrapper for group separators.
145
+
146
+ = 3.1.9.2 =
147
+
148
+ * Fix for Users > All Users user search if no search meta have been selected in Fields tab.
149
+ * Added User ID as an optional column to add to Users > All Users.
150
+
151
+ = 3.1.9.1 =
152
+
153
+ * Added missing (new) files.
154
+
155
+ = 3.1.9 =
156
+
157
+ * Improved user search in Users > All Users.
158
+ * Fully deprecated obsolete reCAPTCHA v1. If v1 is selected as a setting, it will be automatically changed to v2. (v1 users check your API keys for compatibility.)
159
+ * Removed obsolete comments_template.php.
160
+ * Set image field to display "medium" image in dashboard/admin user profile. Admin profile image display links to media editor.
161
+ * Added default format to date field shortcode to date format set in WP settings.
162
+ * Added format attribute to date field shortcode for custom date formatting.
163
+ * Deprecated wpmem_user_profile(), wpmem_profile_update(), wpmem_user_profile_multipart(), wpmem_admin_fields(), wpmem_admin_update().
164
+ * Rebuild of dashboard profile functions incorporated into new user profile object class.
165
+ * Fields tab bulk action now checks for both page and tab (rather than just tab) to prevent namespace collisions.
166
+ * Removed $requested_redirect_to argument from login_redirect filter hook.
167
+ * Removed height property of button_div for generic stylesheets.
168
+ * Fixed user edit shortcode to display updated user data without page refresh.
169
+ * Fixed password change so that login state is maintained after password update.
170
 
171
  = 3.1.8 =
172
 
186
  * Fields Tab: improved field add/edit screen: return link at bottom of page, display current field upon successful form submission, success message include return link.
187
  * Fields Tab: added support for HTML5 field types: number, date.
188
  * Fields Tab: added support for HTML5 field attributes: placeholder, pattern (regex), title, min, max.
189
+ * Corrects an issue with user profile display/update of textarea fields that are not the WP default bio field.
190
+ * Added display=raw attribute handling to textarea fields to allow display without converting line breaks to HTML br tags.
191
+ * Fixes issue with User Profile form heading not using the get_text() value.
192
+ * Improves logic for displaying register link in login form if login page is not set.
193
 
194
  = 3.1.7 =
195
 
uninstall.php CHANGED
@@ -14,6 +14,11 @@
14
  * @copyright 2006-2017
15
  */
16
 
 
 
 
 
 
17
  // If uninstall is not called from WordPress, kill the uninstall.
18
  if( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
19
  die( 'invalid uninstall' );
@@ -54,6 +59,8 @@ function wpmem_uninstall_options() {
54
  delete_option( 'wpmembers_tos' );
55
  delete_option( 'wpmembers_export' );
56
  delete_option( 'wpmembers_utfields' );
 
 
57
 
58
  delete_option( 'wpmembers_email_newreg' );
59
  delete_option( 'wpmembers_email_newmod' );
@@ -75,6 +82,10 @@ function wpmem_uninstall_options() {
75
  delete_option( 'wpmembers_style' );
76
  delete_option( 'wpmembers_autoex' );
77
  delete_option( 'wpmembers_attrib' );
 
 
 
 
78
  }
79
 
80
  // End of file.
14
  * @copyright 2006-2017
15
  */
16
 
17
+ // Exit if accessed directly.
18
+ if ( ! defined( 'ABSPATH' ) ) {
19
+ exit();
20
+ }
21
+
22
  // If uninstall is not called from WordPress, kill the uninstall.
23
  if( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
24
  die( 'invalid uninstall' );
59
  delete_option( 'wpmembers_tos' );
60
  delete_option( 'wpmembers_export' );
61
  delete_option( 'wpmembers_utfields' );
62
+ delete_option( 'wpmembers_usfields' );
63
+ delete_option( 'wpmembers_dropins' );
64
 
65
  delete_option( 'wpmembers_email_newreg' );
66
  delete_option( 'wpmembers_email_newmod' );
82
  delete_option( 'wpmembers_style' );
83
  delete_option( 'wpmembers_autoex' );
84
  delete_option( 'wpmembers_attrib' );
85
+
86
+ // Drop user meta key search table.
87
+ global $wpdb;
88
+ $wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}wpmembers_user_search_keys" );
89
  }
90
 
91
  // End of file.
wp-members-install.php CHANGED
@@ -22,7 +22,11 @@
22
  * - wpmem_upgrade_captcha
23
  */
24
 
25
-
 
 
 
 
26
  /**
27
  * Installs or upgrades the plugin.
28
  *
@@ -84,6 +88,11 @@ function wpmem_upgrade_settings() {
84
 
85
  // If install is 3.0 or higher.
86
  if ( $is_three ) {
 
 
 
 
 
87
 
88
  // If old auto excerpt settings exists, update it.
89
  if ( isset( $wpmem_settings['autoex']['auto_ex'] ) ) {
@@ -151,7 +160,7 @@ function wpmem_upgrade_settings() {
151
  ),
152
  'notify' => $wpmem_settings[4],
153
  'mod_reg' => $wpmem_settings[5],
154
- 'captcha' => $wpmem_settings[6],
155
  'use_exp' => $wpmem_settings[9],
156
  'use_trial' => $wpmem_settings[10],
157
  'warnings' => $wpmem_settings[11],
22
  * - wpmem_upgrade_captcha
23
  */
24
 
25
+ // Exit if accessed directly.
26
+ if ( ! defined( 'ABSPATH' ) ) {
27
+ exit();
28
+ }
29
+
30
  /**
31
  * Installs or upgrades the plugin.
32
  *
88
 
89
  // If install is 3.0 or higher.
90
  if ( $is_three ) {
91
+
92
+ // reCAPTCHA v1 is obsolete.
93
+ if ( isset( $wpmem_settings['captcha'] ) && 1 == $wpmem_settings['captcha'] ) {
94
+ $wpmem_settings['captcha'] = 3;
95
+ }
96
 
97
  // If old auto excerpt settings exists, update it.
98
  if ( isset( $wpmem_settings['autoex']['auto_ex'] ) ) {
160
  ),
161
  'notify' => $wpmem_settings[4],
162
  'mod_reg' => $wpmem_settings[5],
163
+ 'captcha' => ( 1 == $wpmem_settings[6] ) ? 3 : $wpmem_settings[6], // reCAPTCHA v1 is obsolete, move to v2.
164
  'use_exp' => $wpmem_settings[9],
165
  'use_trial' => $wpmem_settings[10],
166
  'warnings' => $wpmem_settings[11],
wp-members.php CHANGED
@@ -1,9 +1,9 @@
1
  <?php
2
  /*
3
  Plugin Name: WP-Members
4
- Plugin URI: http://rocketgeek.com
5
  Description: WP access restriction and user registration. For more information on plugin features, refer to <a href="http://rocketgeek.com/plugins/wp-members/users-guide/">the online Users Guide</a>. A <a href="http://rocketgeek.com/plugins/wp-members/quick-start-guide/">Quick Start Guide</a> is also available. WP-Members(tm) is a trademark of butlerblog.com.
6
- Version: 3.1.8.1
7
  Author: Chad Butler
8
  Author URI: http://butlerblog.com/
9
  Text Domain: wp-members
@@ -51,7 +51,7 @@ License: GPLv2
51
  derivative work you are developing complies with the license, copyright,
52
  trademark, or if you do not understand the difference between
53
  open source and public domain, contact the original author at:
54
- http://rocketgeek.com/contact/.
55
 
56
 
57
  INSTALLATION PROCEDURE:
@@ -60,9 +60,13 @@ License: GPLv2
60
  visit http://rocketgeek.com
61
  */
62
 
 
 
 
 
63
 
64
  // Initialize constants.
65
- define( 'WPMEM_VERSION', '3.1.8.1' );
66
  define( 'WPMEM_DEBUG', false );
67
  define( 'WPMEM_DIR', plugin_dir_url ( __FILE__ ) );
68
  define( 'WPMEM_PATH', plugin_dir_path( __FILE__ ) );
1
  <?php
2
  /*
3
  Plugin Name: WP-Members
4
+ Plugin URI: https://rocketgeek.com
5
  Description: WP access restriction and user registration. For more information on plugin features, refer to <a href="http://rocketgeek.com/plugins/wp-members/users-guide/">the online Users Guide</a>. A <a href="http://rocketgeek.com/plugins/wp-members/quick-start-guide/">Quick Start Guide</a> is also available. WP-Members(tm) is a trademark of butlerblog.com.
6
+ Version: 3.1.9.3
7
  Author: Chad Butler
8
  Author URI: http://butlerblog.com/
9
  Text Domain: wp-members
51
  derivative work you are developing complies with the license, copyright,
52
  trademark, or if you do not understand the difference between
53
  open source and public domain, contact the original author at:
54
+ https://rocketgeek.com/contact/.
55
 
56
 
57
  INSTALLATION PROCEDURE:
60
  visit http://rocketgeek.com
61
  */
62
 
63
+ // Exit if accessed directly.
64
+ if ( ! defined( 'ABSPATH' ) ) {
65
+ exit();
66
+ }
67
 
68
  // Initialize constants.
69
+ define( 'WPMEM_VERSION', '3.1.9.3' );
70
  define( 'WPMEM_DEBUG', false );
71
  define( 'WPMEM_DIR', plugin_dir_url ( __FILE__ ) );
72
  define( 'WPMEM_PATH', plugin_dir_path( __FILE__ ) );