Changeset 3115185

Timestamp:

07/09/2024 09:53:12 PM (20 months ago)

Author:

parorrey

Message:

Updating version 3.9.4

Location:

json-api-user/trunk

Files:

• controllers/User.php (modified) (6 diffs)
• json-api-user.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

json-api-user/trunk/controllers/User.php

@@ -56 +56 @@
 
         if (!get_option('users_can_register')) {
-            $json_api->error("User registration is disabled. Please enable it in Settings > Gereral.");
+            $json_api->error("User registration is disabled. Please enable it in Settings > General.");
         }
 
@@ -182 +182 @@
 
         if ($user_id) {
+            $disallowed = array('wp_user_level', 'wp_capabilities');
 
             if (is_array($_REQUEST['custom_fields'])) {
-
+                      
                 foreach ($_REQUEST['custom_fields'] as $field => $val) {
-                    $data[$field] = update_user_meta($user_id, $field, $val);
+                    if(!in_array($field, $disallowed)){
+                        $data[$field] = update_user_meta($user_id, $field, $val);
+                        }
+                    
 
                 }
@@ -618 +622 @@
         } else
             $meta_value = $json_api->query->meta_value;
-
+            
+            $disallowed = array('wp_user_level', 'wp_capabilities');
+            
+            if(in_array($meta_key, $disallowed) ){
+                $json_api->error("This meta_key '".$meta_key."' is not allowed.");
+                }
+        
+        if(!in_array($meta_key, $disallowed) ){
         if (is_array($meta_value)) {
 
@@ -626 +637 @@
         } else
             $data['updated'] = update_user_meta($user_id, $meta_key, $meta_value);
-
+        }
 
         return $data;
@@ -681 +692 @@
 
         if (sizeof($_REQUEST) <= 1)
-            $json_api->error("You must include one or more vars in your request to add or update as user_meta. e.g. 'name', 'website', 'skills'. You must provide multiple meta_key vars in this format: &name=Ali&website=parorrey.com&description=This is test description. If any field has the possibility to hold more than one value for any multi-select fields or check boxes, you must provide an array of values and use POST method.");
-
+            $json_api->error("You must include one or more vars in your request to add or update as user_meta. e.g. 'name', 'website', 'skills'. You must provide multiple meta_key vars in this format: &name=Ali&website=google.com&description=This is test description. If any field has the possibility to hold more than one value for any multi-select fields or check boxes, you must provide an array of values and use POST method.");
+      
+      $disallowed = array('wp_user_level', 'wp_capabilities');
+      
+      
+      $result = array();
 
         foreach ($_REQUEST as $field => $value) {
+            
+            if(in_array($field, $disallowed) ){
+                $json_api->error("This meta_key '".$field."' is not allowed.");
+                }
 
             if ($field == 'cookie')
                 continue;
 
-            $field_label = str_replace('_', ' ', $field);
+            //$field_label = str_replace('_', ' ', $field);
 
             if (is_array($value)) {
@@ -697 +716 @@
                 $values = trim($value);
 
-
-            $result[$field_label]['updated'] = update_user_meta($user_id, $field, $values);
+          if(!in_array($field, $disallowed) ){
+            $result[$field]['updated'] = update_user_meta($user_id, $field, $values);
+          }
 
         }

json-api-user/trunk/json-api-user.php

@@ -9 +9 @@
   Description: Extends the JSON API for RESTful user registration, authentication, password reset, Facebook Login, user meta and BuddyPress Profile related functions. A Pro version is also available.
 
-  Version: 3.9.3
+  Version: 3.9.4
 
   Author: Ali Qureshi
@@ -19 +19 @@
  */
 
-define('JAU_VERSION', '3.9.3');
+define('JAU_VERSION', '3.9.4');
 
 include_once(ABSPATH . 'wp-admin/includes/plugin.php');

json-api-user/trunk/readme.txt

@@ -4 +4 @@
 Tags: json api, RESTful user registration, authentication, RESTful Facebook Login, RESTful User Meta and BuddyPress xProfile
 Contributors: parorrey
-Stable tag: 3.9.3
+Stable tag: 3.9.4
 Requires at least: 3.0.1
-Tested up to: 6.4.1
+Tested up to: 6.6.0
 Requires PHP: 5.3
 License: GPLv2 or later
@@ -233 +233 @@
 == Changelog ==
 
+= 3.9.4 =
+* fixed security vulnerabilities & for new version of WordPress 6.6
+
 = 3.9.3 =
 * Fixed a bug for get_userinfo, generate_auth_cookie, get_currentuserinfo endpoints for avatar