WP User Avatar - Version 2.2.12

Version Description

  • Fixed issue where contributors and subscribers could see posts in the backend.
  • Fixed Persistent XSS via display name when avatar is displayed.
Download this release

Release Info

Developer Collizo4sky
Plugin Icon 128x128 WP User Avatar
Version 2.2.12
Comparing to
See all releases

Code changes from version 2.2.11 to 2.2.12

Files changed (5) hide show
  1. includes/class-wp-user-avatar-admin.php +4 -0
  2. includes/class-wp-user-avatar-functions.php +95 -74
  3. includes/wpua-functions.php +7 -4
  4. readme.txt +8 -3
  5. wp-user-avatar.php +2 -2
includes/class-wp-user-avatar-admin.php CHANGED
@@ -238,10 +238,14 @@ class WP_User_Avatar_Admin {
238
  'monsterid' => __('MonsterID (Generated)','wp-user-avatar'),
239
  'retro' => __('Retro (Generated)','wp-user-avatar')
240
  );
 
 
 
241
  // No Default Avatar, set to Mystery Man
242
  if(empty($avatar_default)) {
243
  $avatar_default = 'mystery';
244
  }
 
245
  // Take avatar_defaults and get examples for unknown@gravatar.com
246
  foreach($avatar_defaults as $default_key => $default_name) {
247
  $avatar = get_avatar('unknown@gravatar.com', 32, $default_key);
238
  'monsterid' => __('MonsterID (Generated)','wp-user-avatar'),
239
  'retro' => __('Retro (Generated)','wp-user-avatar')
240
  );
241
+
242
+ $avatar_defaults = apply_filters( 'avatar_defaults', $avatar_defaults );
243
+
244
  // No Default Avatar, set to Mystery Man
245
  if(empty($avatar_default)) {
246
  $avatar_default = 'mystery';
247
  }
248
+
249
  // Take avatar_defaults and get examples for unknown@gravatar.com
250
  foreach($avatar_defaults as $default_key => $default_name) {
251
  $avatar = get_avatar('unknown@gravatar.com', 32, $default_key);
includes/class-wp-user-avatar-functions.php CHANGED
@@ -15,7 +15,7 @@ class WP_User_Avatar_Functions {
15
  * @uses register_deactivation_hook()
16
  */
17
  public function __construct() {
18
- add_filter('get_avatar', array($this, 'wpua_get_avatar_filter'), 10, 5);
19
 
20
  add_filter( 'get_avatar_url', array($this,'wpua_get_avatar_url'), 10, 3 );
21
 
@@ -53,7 +53,7 @@ class WP_User_Avatar_Functions {
53
  // First checking custom avatar.
54
  if( has_wp_user_avatar( $user_id ) ) {
55
 
56
- $url = $this->get_wp_user_avatar_src( $user_id );
57
 
58
  } else if( $wpua_disable_gravatar ) {
59
 
@@ -225,7 +225,7 @@ class WP_User_Avatar_Functions {
225
  if($wpua_hash_gravatar == false){
226
  $wpua_hash_gravatar = [];
227
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
228
- add_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar));
229
  }
230
  else{
231
 
@@ -235,23 +235,17 @@ class WP_User_Avatar_Functions {
235
 
236
  unset($wpua_hash_gravatar[$hash]);
237
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
238
- update_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar));
239
  }
240
  else
241
  {
242
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
243
- update_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar));
244
 
245
  }
246
 
247
  }
248
 
249
- /*else{
250
- $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
251
- update_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar));
252
-
253
- }*/
254
-
255
  }
256
  //end
257
  }
@@ -404,34 +398,38 @@ class WP_User_Avatar_Functions {
404
  return $default_image_details;
405
 
406
  }
407
- /**
408
- * Replace get_avatar only in get_wp_user_avatar
409
- * @since 1.4
410
- * @param string $avatar
411
- * @param int|string $id_or_email
412
- * @param int|string $size
413
- * @param string $default
414
- * @param string $alt
415
- * @uses string $avatar_default
416
- * @uses string $mustache_admin
417
- * @uses string $mustache_avatar
418
- * @uses string $mustache_medium
419
- * @uses string $mustache_original
420
- * @uses string $mustache_thumbnail
421
- * @uses object $post
422
- * @uses int $wpua_avatar_default
423
- * @uses bool $wpua_disable_gravatar
424
- * @uses object $wpua_functions
425
- * @uses apply_filters()
426
- * @uses get_wp_user_avatar()
427
- * @uses has_wp_user_avatar()
428
- * @uses wpua_has_gravatar()
429
- * @uses wpua_attachment_is_image()
430
- * @uses wpua_get_attachment_image_src()
431
- * @uses get_option()
432
- * @return string $avatar
433
- */
434
- public function wpua_get_avatar_filter($avatar, $id_or_email="", $size="", $default="", $alt="") {
 
 
 
 
435
 
436
  global $avatar_default, $mustache_admin, $mustache_avatar, $mustache_medium, $mustache_original, $mustache_thumbnail, $post, $wpua_avatar_default, $wpua_disable_gravatar, $wpua_functions;
437
  // User has WPUA
@@ -443,17 +441,26 @@ class WP_User_Avatar_Functions {
443
  $alt = esc_attr($alt);
444
  $size = esc_attr($size);
445
 
 
 
 
 
 
 
 
 
 
446
  $avatar = str_replace('gravatar_default','',$avatar);
447
  if(is_object($id_or_email)) {
448
  if(!empty($id_or_email->comment_author_email)) {
449
- $avatar = get_wp_user_avatar($id_or_email, $size, $default, $alt);
450
  } else {
451
 
452
- $avatar = get_wp_user_avatar('unknown@gravatar.com', $size, $default, $alt);
453
  }
454
  } else {
455
  if(has_wp_user_avatar($id_or_email)) {
456
- $avatar = get_wp_user_avatar($id_or_email, $size, $default, $alt);
457
  // User has Gravatar and Gravatar is not disabled
458
  } elseif((bool) $wpua_disable_gravatar != 1 && $wpua_functions->wpua_has_gravatar($id_or_email)) {
459
  // find our src
@@ -466,13 +473,19 @@ class WP_User_Avatar_Functions {
466
  }
467
 
468
  //$avatar = $avatar;
469
- $avatar = '<img src="'.$wpua_final_avatar_image_src.'"'.$default_image_details['dimensions'].' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.' photo avatar-default" />';
 
 
 
470
 
471
  // User doesn't have WPUA or Gravatar and Default Avatar is wp_user_avatar, show custom Default Avatar
472
  } elseif($avatar_default == 'wp_user_avatar') {
473
 
474
  $default_image_details = $this->wpua_default_image($size);
475
- $avatar = '<img src="'.$default_image_details['src'].'"'.$default_image_details['dimensions'].' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.' photo avatar-default" />';
 
 
 
476
 
477
  return $avatar;
478
 
@@ -557,34 +570,37 @@ class WP_User_Avatar_Functions {
557
  }
558
 
559
 
560
- /**
561
- * Find WPUA, show get_avatar if empty
562
- * @since 1.0
563
- * @param int|string $id_or_email
564
- * @param int|string $size
565
- * @param string $align
566
- * @param string $alt
567
- * @uses array $_wp_additional_image_sizes
568
- * @uses array $all_sizes
569
- * @uses string $avatar_default
570
- * @uses int $blog_id
571
- * @uses object $post
572
- * @uses object $wpdb
573
- * @uses int $wpua_avatar_default
574
- * @uses object $wpua_functions
575
- * @uses apply_filters()
576
- * @uses get_the_author_meta()
577
- * @uses get_blog_prefix()
578
- * @uses get_user_by()
579
- * @uses get_query_var()
580
- * @uses is_author()
581
- * @uses wpua_attachment_is_image()
582
- * @uses wpua_get_attachment_image_src()
583
- * @uses get_option()
584
- * @uses get_avatar()
585
- * @return string $avatar
586
- */
587
- public function get_wp_user_avatar($id_or_email="", $size='96', $align="", $alt="") {
 
 
 
588
  global $all_sizes, $avatar_default, $blog_id, $post, $wpdb, $wpua_avatar_default, $wpua_functions, $_wp_additional_image_sizes;
589
  $email='unknown@gravatar.com';
590
  // Checks if comment
@@ -631,6 +647,8 @@ class WP_User_Avatar_Functions {
631
 
632
  $alt = esc_attr($alt);
633
  $size = esc_attr($size);
 
 
634
 
635
  // Checks if user has WPUA
636
  $wpua_meta = get_the_author_meta($wpdb->get_blog_prefix($blog_id).'user_avatar', $email);
@@ -645,7 +663,10 @@ class WP_User_Avatar_Functions {
645
  // Add dimensions to img only if numeric size was specified
646
  $dimensions = is_numeric($size) ? ' width="'.$wpua_image[1].'" height="'.$wpua_image[2].'"' : "";
647
  // Construct the img tag
648
- $avatar = '<img src="'.$wpua_image[0].'"'.$dimensions.' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.$alignclass.' photo" />';
 
 
 
649
  } else {
650
  // Check for custom image sizes
651
  if(in_array($size, $all_sizes)) {
@@ -659,7 +680,7 @@ class WP_User_Avatar_Functions {
659
  $get_size = $size;
660
  }
661
  // User with no WPUA uses get_avatar
662
- $avatar = get_avatar($email, $get_size, $default="", $alt="");
663
  // Remove width and height for non-numeric sizes
664
  if(in_array($size, array('original', 'large', 'medium', 'thumbnail'))) {
665
  $avatar = preg_replace('/(width|height)=\"\d*\"\s/', "", $avatar);
15
  * @uses register_deactivation_hook()
16
  */
17
  public function __construct() {
18
+ add_filter('get_avatar', array($this, 'wpua_get_avatar_filter'), 10, 6);
19
 
20
  add_filter( 'get_avatar_url', array($this,'wpua_get_avatar_url'), 10, 3 );
21
 
53
  // First checking custom avatar.
54
  if( has_wp_user_avatar( $user_id ) ) {
55
 
56
+ $url = $this->get_wp_user_avatar_src( $user_id, isset($args['size']) ? $args['size'] : '' );
57
 
58
  } else if( $wpua_disable_gravatar ) {
59
 
225
  if($wpua_hash_gravatar == false){
226
  $wpua_hash_gravatar = [];
227
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
228
+ add_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar), '', false);
229
  }
230
  else{
231
 
235
 
236
  unset($wpua_hash_gravatar[$hash]);
237
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
238
+ update_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar), false);
239
  }
240
  else
241
  {
242
  $wpua_hash_gravatar[$hash][date('m-d-Y')] = (bool)$has_gravatar;
243
+ update_option('wpua_hash_gravatar',serialize($wpua_hash_gravatar), false);
244
 
245
  }
246
 
247
  }
248
 
 
 
 
 
 
 
249
  }
250
  //end
251
  }
398
  return $default_image_details;
399
 
400
  }
401
+
402
+ /**
403
+ * Replace get_avatar only in get_wp_user_avatar
404
+ *
405
+ * @param string $avatar
406
+ * @param int|string $id_or_email
407
+ * @param int|string $size
408
+ * @param string $default
409
+ * @param string $alt
410
+ * @param array $args
411
+ *
412
+ * @return string $avatar
413
+ * @since 1.4
414
+ * @uses string $avatar_default
415
+ * @uses string $mustache_admin
416
+ * @uses string $mustache_avatar
417
+ * @uses string $mustache_medium
418
+ * @uses string $mustache_original
419
+ * @uses string $mustache_thumbnail
420
+ * @uses object $post
421
+ * @uses int $wpua_avatar_default
422
+ * @uses bool $wpua_disable_gravatar
423
+ * @uses object $wpua_functions
424
+ * @uses apply_filters()
425
+ * @uses get_wp_user_avatar()
426
+ * @uses has_wp_user_avatar()
427
+ * @uses wpua_has_gravatar()
428
+ * @uses wpua_attachment_is_image()
429
+ * @uses wpua_get_attachment_image_src()
430
+ * @uses get_option()
431
+ */
432
+ public function wpua_get_avatar_filter($avatar, $id_or_email="", $size="", $default="", $alt="", $args = []) {
433
 
434
  global $avatar_default, $mustache_admin, $mustache_avatar, $mustache_medium, $mustache_original, $mustache_thumbnail, $post, $wpua_avatar_default, $wpua_disable_gravatar, $wpua_functions;
435
  // User has WPUA
441
  $alt = esc_attr($alt);
442
  $size = esc_attr($size);
443
 
444
+ $class = [];
445
+ if ( isset($args['class']) ) {
446
+ if ( is_array( $args['class'] ) ) {
447
+ $class = array_merge( $class, $args['class'] );
448
+ } else {
449
+ $class[] = $args['class'];
450
+ }
451
+ }
452
+
453
  $avatar = str_replace('gravatar_default','',$avatar);
454
  if(is_object($id_or_email)) {
455
  if(!empty($id_or_email->comment_author_email)) {
456
+ $avatar = get_wp_user_avatar($id_or_email, $size, $default, $alt, $class);
457
  } else {
458
 
459
+ $avatar = get_wp_user_avatar('unknown@gravatar.com', $size, $default, $alt, $class);
460
  }
461
  } else {
462
  if(has_wp_user_avatar($id_or_email)) {
463
+ $avatar = get_wp_user_avatar($id_or_email, $size, $default, $alt, $class);
464
  // User has Gravatar and Gravatar is not disabled
465
  } elseif((bool) $wpua_disable_gravatar != 1 && $wpua_functions->wpua_has_gravatar($id_or_email)) {
466
  // find our src
473
  }
474
 
475
  //$avatar = $avatar;
476
+ $avatar = sprintf(
477
+ '<img src="'.$wpua_final_avatar_image_src.'"'.$default_image_details['dimensions'].' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.' photo avatar-default%s" />',
478
+ esc_attr( implode( ' ', $class ) )
479
+ );
480
 
481
  // User doesn't have WPUA or Gravatar and Default Avatar is wp_user_avatar, show custom Default Avatar
482
  } elseif($avatar_default == 'wp_user_avatar') {
483
 
484
  $default_image_details = $this->wpua_default_image($size);
485
+ $avatar = sprintf(
486
+ '<img src="'.$default_image_details['src'].'"'.$default_image_details['dimensions'].' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.' photo avatar-default%s" />',
487
+ esc_attr( implode( ' ', $class ) )
488
+ );
489
 
490
  return $avatar;
491
 
570
  }
571
 
572
 
573
+ /**
574
+ * Find WPUA, show get_avatar if empty
575
+ *
576
+ * @param int|string $id_or_email
577
+ * @param int|string $size
578
+ * @param string $align
579
+ * @param string $alt
580
+ * @param array $class
581
+ *
582
+ * @return string $avatar
583
+ * @since 1.0
584
+ * @uses array $_wp_additional_image_sizes
585
+ * @uses array $all_sizes
586
+ * @uses string $avatar_default
587
+ * @uses int $blog_id
588
+ * @uses object $post
589
+ * @uses object $wpdb
590
+ * @uses int $wpua_avatar_default
591
+ * @uses object $wpua_functions
592
+ * @uses apply_filters()
593
+ * @uses get_the_author_meta()
594
+ * @uses get_blog_prefix()
595
+ * @uses get_user_by()
596
+ * @uses get_query_var()
597
+ * @uses is_author()
598
+ * @uses wpua_attachment_is_image()
599
+ * @uses wpua_get_attachment_image_src()
600
+ * @uses get_option()
601
+ * @uses get_avatar()
602
+ */
603
+ public function get_wp_user_avatar($id_or_email="", $size='96', $align="", $alt="", $class=[]) {
604
  global $all_sizes, $avatar_default, $blog_id, $post, $wpdb, $wpua_avatar_default, $wpua_functions, $_wp_additional_image_sizes;
605
  $email='unknown@gravatar.com';
606
  // Checks if comment
647
 
648
  $alt = esc_attr($alt);
649
  $size = esc_attr($size);
650
+ $class = esc_attr( implode( ' ', $class ));
651
+
652
 
653
  // Checks if user has WPUA
654
  $wpua_meta = get_the_author_meta($wpdb->get_blog_prefix($blog_id).'user_avatar', $email);
663
  // Add dimensions to img only if numeric size was specified
664
  $dimensions = is_numeric($size) ? ' width="'.$wpua_image[1].'" height="'.$wpua_image[2].'"' : "";
665
  // Construct the img tag
666
+ $avatar = sprintf(
667
+ '<img src="'.$wpua_image[0].'"'.$dimensions.' alt="'.$alt.'" class="avatar avatar-'.$size.' wp-user-avatar wp-user-avatar-'.$size.$alignclass.' photo%s" />',
668
+ !empty($class) ? ' ' . $class : ''
669
+ );
670
  } else {
671
  // Check for custom image sizes
672
  if(in_array($size, $all_sizes)) {
680
  $get_size = $size;
681
  }
682
  // User with no WPUA uses get_avatar
683
+ $avatar = get_avatar($email, $get_size, $default="", $alt="", ['class' => $class]);
684
  // Remove width and height for non-numeric sizes
685
  if(in_array($size, array('original', 'large', 'medium', 'thumbnail'))) {
686
  $avatar = preg_replace('/(width|height)=\"\d*\"\s/', "", $avatar);
includes/wpua-functions.php CHANGED
@@ -23,17 +23,20 @@ function has_wp_user_avatar($id_or_email="", $has_wpua="", $user="", $user_id=""
23
 
24
  /**
25
  * Find WPUA, show get_avatar if empty
26
- * @since 1.8
27
  * @param int|string $id_or_email
28
  * @param int|string $size
29
  * @param string $align
30
  * @param string $alt
31
- * @uses object $wpua_functions
 
32
  * @return object get_wp_user_avatar()
 
 
33
  */
34
- function get_wp_user_avatar($id_or_email="", $size="", $align="", $alt="") {
35
  global $wpua_functions;
36
- return $wpua_functions->get_wp_user_avatar($id_or_email, $size, $align, $alt);
37
  }
38
 
39
  /**
23
 
24
  /**
25
  * Find WPUA, show get_avatar if empty
26
+ *
27
  * @param int|string $id_or_email
28
  * @param int|string $size
29
  * @param string $align
30
  * @param string $alt
31
+ * @param array $class
32
+ *
33
  * @return object get_wp_user_avatar()
34
+ * @since 1.8
35
+ * @uses object $wpua_functions
36
  */
37
+ function get_wp_user_avatar($id_or_email="", $size="", $align="", $alt="",$class=[]) {
38
  global $wpua_functions;
39
+ return $wpua_functions->get_wp_user_avatar($id_or_email, $size, $align, $alt, $class);
40
  }
41
 
42
  /**
readme.txt CHANGED
@@ -3,8 +3,8 @@
3
  Contributors: properfraction, collizo4sky
4
  Tags: user profile, avatar, gravatar, author image, author photo, author avatar, bbPress, profile avatar, profile image, user avatar, user image, user photo, widget
5
  Requires at least: 4.0
6
- Tested up to: 5.6
7
- Stable tag: 2.2.11
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -370,10 +370,15 @@ This would output:
370
 
371
  == Changelog ==
372
 
373
- = 2.2.11 =
374
  * Fixed issue where contributors and subscribers could see posts in the backend.
375
  * Fixed Persistent XSS via display name when avatar is displayed.
376
 
 
 
 
 
 
377
  = 2.2.10 =
378
  * Fixed: Warning: Missing argument 2 for WP_User_Avatar.
379
  * Re-added support for hook implementation eg on wp frontend.
3
  Contributors: properfraction, collizo4sky
4
  Tags: user profile, avatar, gravatar, author image, author photo, author avatar, bbPress, profile avatar, profile image, user avatar, user image, user photo, widget
5
  Requires at least: 4.0
6
+ Tested up to: 5.7
7
+ Stable tag: 2.2.12
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
370
 
371
  == Changelog ==
372
 
373
+ = 2.2.12 =
374
  * Fixed issue where contributors and subscribers could see posts in the backend.
375
  * Fixed Persistent XSS via display name when avatar is displayed.
376
 
377
+ = 2.2.11 =
378
+ * Added classes passed to get_avatar function to avatar display
379
+ * Added avatar_defaults filter.
380
+ * Fix wpua_get_avatar_url not passing args further down.
381
+
382
  = 2.2.10 =
383
  * Fixed: Warning: Missing argument 2 for WP_User_Avatar.
384
  * Re-added support for hook implementation eg on wp frontend.
wp-user-avatar.php CHANGED
@@ -5,7 +5,7 @@ Plugin URI: http://wordpress.org/plugins/wp-user-avatar/
5
  Description: Use any image from your WordPress Media Library as a custom user avatar. Add your own Default Avatar.
6
  Author: ProfilePress
7
  Author URI: https://profilepress.net/
8
- Version: 2.2.11
9
  Text Domain: wp-user-avatar
10
  Domain Path: /lang/
11
  */
@@ -33,7 +33,7 @@ class WP_User_Avatar_Setup {
33
  * @since 1.9.2
34
  */
35
  private function _define_constants() {
36
- define('WPUA_VERSION', '2.2.11');
37
  define('WPUA_FOLDER', basename(dirname(__FILE__)));
38
  define('WPUA_DIR', plugin_dir_path(__FILE__));
39
  define('WPUA_INC', WPUA_DIR.'includes'.'/');
5
  Description: Use any image from your WordPress Media Library as a custom user avatar. Add your own Default Avatar.
6
  Author: ProfilePress
7
  Author URI: https://profilepress.net/
8
+ Version: 2.2.12
9
  Text Domain: wp-user-avatar
10
  Domain Path: /lang/
11
  */
33
  * @since 1.9.2
34
  */
35
  private function _define_constants() {
36
+ define('WPUA_VERSION', '2.2.12');
37
  define('WPUA_FOLDER', basename(dirname(__FILE__)));
38
  define('WPUA_DIR', plugin_dir_path(__FILE__));
39
  define('WPUA_INC', WPUA_DIR.'includes'.'/');