Changeset 3434480

Timestamp:

01/07/2026 03:45:09 PM (6 weeks ago)

Author:

codeadapted

Message:

Release version 1.1.2

Location:

multisite-author-bio/trunk

Files:

• classes/mab-frontend.php (modified) (2 diffs)
• classes/mab-user-setup.php (modified) (4 diffs)
• multisite-author-bio.php (modified) (2 diffs)
• readme.txt (modified) (3 diffs)

multisite-author-bio/trunk/classes/mab-frontend.php

@@ -11 +11 @@
     public function __construct() {
 
-        // Hook into the author bio filter
-        add_filter( 'get_the_author_user_description', array( $this, 'mab_author_description_filter' ) );
+        // Hook into the author bio filter with priority 10 and 2 accepted arguments
+        add_filter( 'get_the_author_user_description', array( $this, 'mab_author_description_filter' ), 10, 2 );
 
     }
@@ -19 +19 @@
      * Override standard user bio if translation exists for the current site.
      * 
-     * @param   string $bio The standard user bio.
+     * @param   string $bio     The standard user bio.
+     * @param   int    $user_id The user ID (passed by the filter).
      * @return  string Either the standard user bio or the translated one for the multisite.
      */
-    public function mab_author_description_filter( $bio ) {
+    public function mab_author_description_filter( $bio, $user_id = 0 ) {
 
         // Get current site's host
         $site_slug = $this->mab_get_current_site_slug();
 
-        // Get the post's author ID
-        $user_id = get_post_field( 'post_author', get_the_ID() );
+        // Get user ID from filter parameter, fallback to post author if not provided
+        if ( empty( $user_id ) ) {
+            $user_id = get_post_field( 'post_author', get_the_ID() );
+        }
+
+        // If we still don't have a user ID, return original bio
+        if ( empty( $user_id ) ) {
+            return $bio;
+        }
 
         // Get the user's bio variation for the current site

multisite-author-bio/trunk/classes/mab-user-setup.php

@@ -81 +81 @@
         $user_id = isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0;
 
+        // Authorization check - ensure current user can edit the target user
+        if ( ! current_user_can( 'edit_user', $user_id ) ) {
+            wp_send_json_error( array( 'message' => __( 'You do not have permission to access this user\'s data.', 'multisite-author-bio' ) ) );
+            return;
+        }
+
         // Retrieve user meta for the selected site
         $bio_variation = get_user_meta( $user_id, 'mab_profile_bio_' . $site_name, true );
@@ -111 +117 @@
         foreach ( $sites as $site ) {
             if ( $site->blog_id != $main_site_id ) {
-                $site_slug = explode( '.', $site->siteurl )[0];
-                $site_slug = str_replace( array( 'http://', 'https://' ), '', $site_slug );
+                $site_slug = $this->mab_get_site_slug_from_url( $site->siteurl );
                 if ( $site_slug ) {
-                    $options .= '<option value="' . esc_html( $site_slug ) . '"' . selected( $current_site_id, $site->blog_id, false ) . '>' . strtoupper( esc_html( $site_slug ) ) . '</option>';
+                    $options .= '<option value="' . esc_attr( $site_slug ) . '"' . selected( $current_site_id, $site->blog_id, false ) . '>' . strtoupper( esc_html( $site_slug ) ) . '</option>';
                 }
             }
@@ -121 +126 @@
         // Return
         return ! empty( $options ) ? $options : false;
+
+    }
+
+    /**
+     * Extract the site slug from a site URL.
+     * Handles both subdomain and subdirectory multisite configurations.
+     *
+     * @param   string $site_url The site URL to parse.
+     * @return  string The sanitized site slug.
+     */
+    private function mab_get_site_slug_from_url( $site_url ) {
+
+        $parsed_url = wp_parse_url( $site_url );
+        
+        $domain = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
+        $path = isset( $parsed_url['path'] ) ? trim( $parsed_url['path'], '/' ) : '';
+
+        if ( ! empty( $path ) ) {
+            // For path-based multisites (e.g., example.com/es)
+            $slug = sanitize_title( $path );
+        } else {
+            // For domain-based multisites (e.g., es.example.com)
+            $parts = explode( '.', $domain );
+            $slug = ( count( $parts ) > 2 ) ? sanitize_title( $parts[0] ) : sanitize_title( $parts[0] );
+        }
+
+        return $slug;
 
     }
@@ -179 +211 @@
     public function mab_save_custom_user_profile_fields( $user_id ) {
         
-        // Ensure only administrators can update this field
-        if ( ! current_user_can( 'manage_network_options' ) ) {
+        // Ensure the current user can edit this user's profile
+        if ( ! current_user_can( 'edit_user', $user_id ) ) {
             return false;
         }

multisite-author-bio/trunk/multisite-author-bio.php

@@ -3 +3 @@
 * Plugin Name:  Multisite Author Bio
 * Description:  Allows you to add unique user biographical information for each Multisite instance.
-* Version:      1.1.0
+* Version:      1.1.1
 * Author:       CodeAdapted
 * Author URI:   https://codeadapted.com
@@ -30 +30 @@
 
         /** @var string The plugin version number. */
-        var $version = '1.1.0';
+        var $version = '1.1.1';
 
         /** @var string Shortcuts. */

multisite-author-bio/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 5.0
 Tested up to: 6.8.1
-Stable tag: 1.1.1
+Stable tag: 1.1.2
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -12 +12 @@
 == Description ==
 
-Multisite Author Bio simplifies managing unique user biographical information across multiple sites in a WordPress Multisite network. This plugin allows administrators to update author bios from a single user edit page, streamlining the process of managing bio variations across different sites without having to switch between site dashboards.
+Multisite Author Bio simplifies managing unique user biographical information across multiple sites in a WordPress Multisite network. This plugin allows administrators and editors to update author bios from a single user edit page, streamlining the process of managing bio variations across different sites without having to switch between site dashboards.
 
 = Features =
@@ -71 +71 @@
 == Changelog ==
 
+= 1.1.2 =
+* Security: Added authorization checks to AJAX endpoint to verify user permissions.
+* Fixed capability check to use edit_user instead of manage_network_options, allowing Editors and Admins to manage bio variations.
+* Fixed frontend bio filter to properly receive user ID from filter parameter, improving reliability in author archives, widgets, and REST API contexts.
+* Fixed site slug generation in admin to be consistent with frontend for subdirectory multisite installations.
+
 = 1.1.1 =
 * Apply view.php patch