| @@ -10,8 +10,10 @@ | ||
| 10 | 10 | use FluentForm\App\Helpers\Helper; |
| 11 | 11 | |
| 12 | 12 | class ShortCodeParser |
| 13 | 13 | { |
| 14 | + const USER_SECRET_PROPERTIES = ['user_pass', 'user_activation_key', 'session_tokens', 'data']; | |
| 15 | + | |
| 14 | 16 | protected static $form = null; |
| 15 | 17 | |
| 16 | 18 | protected static $entry = null; |
| 17 | 19 | |
| @@ -314,8 +316,11 @@ | ||
| 314 | 316 | 'ID', 'id', 'display_name', 'first_name', 'last_name', 'user_email', |
| 315 | 317 | 'user_login', 'user_nicename', 'nickname', 'user_url', 'description', 'roles', |
| 316 | 318 | 'user_registered', // non-sensitive wp_users column; keep {user.user_registered} working |
| 317 | 319 | ]; |
| 320 | + if (static::isDeniedUserProperty($key)) { | |
| 321 | + return ''; | |
| 322 | + } | |
| 318 | 323 | if (in_array($key, $allowed, true)) { |
| 319 | 324 | return $user->{$key}; |
| 320 | 325 | } |
| 321 | 326 | |
| @@ -340,9 +345,9 @@ | ||
| 340 | 345 | |
| 341 | 346 | if (false !== strpos($key, 'author.')) { |
| 342 | 347 | $authorProperty = substr($key, strlen('author.')); |
| 343 | 348 | $authorId = static::$store['post']->post_author; |
| 344 | - if ($authorId) { | |
| 349 | + if ($authorId && !static::isDeniedUserProperty($authorProperty)) { | |
| 345 | 350 | $data = get_the_author_meta($authorProperty, $authorId); |
| 346 | 351 | if (!is_array($data)) { |
| 347 | 352 | return $data; |
| 348 | 353 | } |
| @@ -367,9 +372,28 @@ | ||
| 367 | 372 | return ''; |
| 368 | 373 | } |
| 369 | 374 | } |
| 370 | 375 | |
| 376 | + if ('post_password' === $key) { | |
| 377 | + return ''; | |
| 378 | + } | |
| 379 | + | |
| 371 | 380 | return static::$store['post']->{$key}; |
| 381 | + } | |
| 382 | + | |
| 383 | + // Shared by {user.*} and {embed_post.author.*} in both parsers. get_the_author_meta() and | |
| 384 | + // WP_User fall through to any user meta, where plugins keep 2FA secrets and tokens under | |
| 385 | + // protected (underscore) keys, so the secret columns alone are not enough to deny. | |
| 386 | + public static function isDeniedUserProperty($property) | |
| 387 | + { | |
| 388 | + // Same aliases get_the_author_meta() accepts: 'pass' means user_pass | |
| 389 | + if (in_array($property, ['login', 'pass', 'nicename', 'email', 'url', 'registered', 'activation_key', 'status'], true)) { | |
| 390 | + $property = 'user_' . $property; | |
| 391 | + } | |
| 392 | + | |
| 393 | + $denied = (array) apply_filters('fluentform/smartcode_user_denied_properties', self::USER_SECRET_PROPERTIES); | |
| 394 | + | |
| 395 | + return in_array($property, $denied, true) || is_protected_meta($property, 'user'); | |
| 372 | 396 | } |
| 373 | 397 | |
| 374 | 398 | protected static function getWPData($key) |
| 375 | 399 | { |
