Changeset 3121690

Timestamp:

07/18/2024 06:53:08 PM (19 months ago)

Author:

parorrey

Message:

Updating version 3.9.7

Location:

json-api-user/trunk

Files:

• controllers/User.php (modified) (6 diffs)
• json-api-user.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

json-api-user/trunk/controllers/User.php

@@ -52 +52 @@
     {
 
-        global $json_api;
+        global $json_api, $wpdb;
 
 
@@ -182 +182 @@
 
         if ($user_id) {
-            $disallowed = array('wp_user_level', 'wp_capabilities');
+            $disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities");
 
             if (is_array($_REQUEST['custom_fields'])) {
@@ -605 +605 @@
     {
 
-        global $json_api;
+        global $json_api, $wpdb;
 
         if (!$json_api->query->cookie) {
@@ -627 +627 @@
             $meta_value = $json_api->query->meta_value;
             
-            $disallowed = array('wp_user_level', 'wp_capabilities');
-            
+        $disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities");
+    
             if(in_array($meta_key, $disallowed) ){
                 $json_api->error("This meta_key '".$meta_key."' is not allowed.");
@@ -686 +686 @@
     {
 
-        global $json_api;
+        global $json_api, $wpdb;
 
         if (!$json_api->query->cookie) {
@@ -702 +702 @@
             $json_api->error("You must include one or more vars in your request to add or update as user_meta. e.g. 'name', 'website', 'skills'. You must provide multiple meta_key vars in this format: &name=Ali&website=google.com&description=This is test description. If any field has the possibility to hold more than one value for any multi-select fields or check boxes, you must provide an array of values and use POST method.");
       
-      $disallowed = array('wp_user_level', 'wp_capabilities');
-      
+    $disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities");
+  
       
       $result = array();

json-api-user/trunk/json-api-user.php

@@ -9 +9 @@
   Description: Extends the JSON API for RESTful user registration, authentication, password reset, Facebook Login, user meta and BuddyPress Profile related functions. A Pro version is also available.
 
-  Version: 3.9.6
+  Version: 3.9.7
 
   Author: Ali Qureshi
@@ -19 +19 @@
  */
 
-define('JAU_VERSION', '3.9.6');
+define('JAU_VERSION', '3.9.7');
 
 include_once(ABSPATH . 'wp-admin/includes/plugin.php');

json-api-user/trunk/readme.txt

@@ -4 +4 @@
 Tags: json api, RESTful user registration, authentication, RESTful Facebook Login, RESTful User Meta and BuddyPress xProfile
 Contributors: parorrey
-Stable tag: 3.9.6
+Stable tag: 3.9.7
 Requires at least: 3.0.1
 Tested up to: 6.6.0
@@ -233 +233 @@
 == Changelog ==
 
+= 3.9.7 =
+* fixed security vulnerabilities
+
 = 3.9.6 =
 * fixed security vulnerabilities & for new version of WordPress 6.6