RocketGeek

Home of WP-Members, The Original WordPress Membership Plugin

Home » Archives for Chad Butler

Chad Butler

WP-Members 3.4.9.2

· ·

This article is provided free. Find out how you can get full access to premium content, including how-to articles and support forums, as well as priority email support and member exclusive plugin extensions..

 

WP-Members 3.4.9.2 contains two patches that are included from the upcoming 3.5.0 release and two security patchs.

Security

  • Review shortcode object class for sanitizing all shortcode attributes and escaping all output: Due to a reported vulnerability in one of the plugin’s shortcodes, a complete security audit was performed on the entire shortcodes class in the plugin. The result of this review included making sure that every shortcode attribute is sanitized and that every shortcode output is escaped.
  • Review admin user profile class for sanitizing input and escaping output: Due to a reported vulnerability in one of the default data fields WP-Members collects during registration, a complete security audit was performed on where this data is collected and the admin user profile screen output. The result of this review included making sure that this data was sanitized on input and escaped on output.

It is recommended that all users update to version 3.4.9.2.

Patches

There were two 3.5.0 bug fix patches included in this update:

  • If memberships are enabled but no memberships are defined, that could cause an error when performing a user export. While it is simple enough to disable memberships if there are no defined memberships, the plugin was improved to check for this possibility before assembling export data, solving the problem even if the plugin is misconfigured.
  • If the plugin is set up for HTML email, the fields list in the admin notification is a single line because text line breaks are not the same as HTML line breaks. A patch is included to resolve this depending on the email format selected in the plugin’s options.

PSA: Fake CVE-2023-45124 Phishing Scam Tricks Users Into Installing Backdoor Plugin

· ·

This article is provided free. Find out how you can get full access to premium content, including how-to articles and support forums, as well as priority email support and member exclusive plugin extensions..

 

There is currently a phishing scam targeting WordPress users. It involves an email indicating that you have a vulnerability on your WordPress site and leads you to download a patch plugin for the vulnerability. The plugin, however, installs a backdoor exploit that hackers can use to gain access to your site.

Continue Reading →

Display an icon with email link in the User List

· ·

I chose the basic email icon that is in the WP dashicons, but there are a couple of dashicon alternatives. And certainly, you could modify this code snippet to use any type of image/icon, such as font awesome. I used the WP dashicons because they are already loaded.

Adding the icon itself (without the link) is nothing more than adding the following span tag to the user profile:

<span class="dashicons dashicons-email"></span>

Adding to the user list view can be done with the wpmem_ul_user_rows filter. There is a verbose example below.

add_filter( 'wpmem_ul_user_rows', function( $rows, $list_id ) {
    
    // User ID is a field in the $rows array, get it as $user_id.
    $user_id = $rows['ID'];
    
    // User email will be in the $rows array by its meta key (see WP-Members Fields tab).
    // HOWEVER, it will have a div wrapper, so we'll strip that out first. (I put them
    // in variables to reuse later when we rewrap the field before returnning).
    $user_email = $rows['user_email'];
    $wrapper_start = '<div class="user_email">';
    $wrapper_end = '</div>';
    $raw_email = str_replace( array( $wrapper_start, $wrapper_end ), array( '', '' ), $user_email );
    
    // Get the dashicon.
    $icon = '<span class="dashicons dashicons-email"></span>';
    
    // Linked icon with the email text.
    $email_w_icon = '<a href="mailto:' . $raw_email . '">' . $icon . '</a> ' . $raw_email;
    
    // Put the div tag back.
    $rows['user_email'] = $wrapper_start . $email_w_icon . $wrapper_end;

    // Return the filtered result.
    return $rows;
    
}, 10, 2 );

Ready to get started?

Join Today!