← All changes | src/includes/classes/sc-gets-in.inc.php +24 -9 260805 → 260917 View file →

		@@ -72,12 +72,12 @@
72	72	$valid_user_options = array_flip(array('s2member_custom', 's2member_subscr_id', 's2member_subscr_gateway', 's2member_registration_ip', 's2member_login_counter', 's2member_last_payment_time', 's2member_access_label', 's2member_ccaps'));
73	73	// Current user only
74	74	$attr['user_id_backup'] = (int)$attr['user_id'];
75	75	$attr['user_id'] = 0;
76		- //260322 Whitelist user_fields allowed user_id="" via General Options.
77		- $sc_s2get_userid_whitelist = trim((string)$GLOBALS['WS_PLUGIN__']['s2member']['o']['sc_s2get_userid_whitelist']);
78		- $sc_s2get_userid_whitelist = ($sc_s2get_userid_whitelist !== '') ? preg_split('/\s*,\s*/', strtolower($sc_s2get_userid_whitelist), -1, PREG_SPLIT_NO_EMPTY) : array();
79		- $sc_s2get_userid_whitelist = array_flip($sc_s2get_userid_whitelist);
	76	+ //260812 Load the shared user-fields whitelist for cross-user shortcode access.
	77	+ $shortcode_user_fields_whitelist = trim((string)$GLOBALS['WS_PLUGIN__']['s2member']['o']['sc_user_fields_whitelist']);
	78	+ $shortcode_user_fields_whitelist = ($shortcode_user_fields_whitelist !== '') ? preg_split('/\s*,\s*/', strtolower($shortcode_user_fields_whitelist), -1, PREG_SPLIT_NO_EMPTY) : array();
	79	+ $shortcode_user_fields_whitelist = array_flip($shortcode_user_fields_whitelist);
80	80
81	81	foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v;
82	82	do_action('ws_plugin__s2member_before_sc_get_details_after_shortcode_atts', get_defined_vars());
83	83	unset($__refs, $__v); // Allow variables to be modified by reference.
		@@ -84,13 +84,28 @@
84	84
85	85	if($attr['constant'] && defined($attr['constant']) && isset($valid_constants[$attr['constant']]))
86	86	{
87	87	$get = constant($attr['constant']);
	88	+
	89	+ //260913.1656 Only format explicitly known timestamp constants, and reject non-string formats before passing them to date().
	90	+ if(is_string($attr['date_format']) && $attr['date_format'] && is_int($get) && $get > 0 && in_array($attr['constant'], array('S2MEMBER_CURRENT_USER_REGISTRATION_TIME', 'S2MEMBER_CURRENT_USER_PAID_REGISTRATION_TIME'), true))
	91	+ {
	92	+ if($attr['date_format'] === 'timestamp')
	93	+ $get = (string)$get; // No change.
	94	+
	95	+ else if($attr['date_format'] === 'default')
	96	+ $get = date(get_option('date_format'), $get);
	97	+
	98	+ else $get = date($attr['date_format'], $get);
	99	+ }
88	100	}
89	101	else if($attr['user_field'] && isset($valid_user_fields[$attr['user_field']]))
90	102	{
91	103	$user_field_args = array('size' => $attr['size']);
92		- $user_field_user_id = (isset($sc_s2get_userid_whitelist[strtolower($attr['user_field'])]) && $attr['user_id_backup'] > 0) ? $attr['user_id_backup'] : 0;
	104	+ //260813 Record blocked cross-user fields for the shared administrator warning.
	105	+ if($attr['user_id_backup'] > 0 && $attr['user_id_backup'] !== get_current_user_id() && !isset($shortcode_user_fields_whitelist[strtolower($attr['user_field'])]))
	106	+ c_ws_plugin__s2member_admin_notices::shortcode_user_field_unapproved($attr['user_field'], ($shortcode) ? $shortcode : 's2Get', get_the_ID());
	107	+ $user_field_user_id = (isset($shortcode_user_fields_whitelist[strtolower($attr['user_field'])]) && $attr['user_id_backup'] > 0) ? $attr['user_id_backup'] : 0;
93	108	$get = c_ws_plugin__s2member_utils_users::get_user_field($attr['user_field'], $user_field_user_id, $user_field_args);
94	109
95	110	if(preg_match('/time$/i', $attr['user_field']) && $attr['date_format'])
96	111	if((is_numeric($get) && strlen($get) === 10) || ($get = strtotime($get))) // Timestamp?
		@@ -98,11 +113,11 @@
98	113	if($attr['date_format'] === 'timestamp')
99	114	$get = (string)$get; // No change.
100	115
101	116	else if($attr['date_format'] === 'default')
102		- $get = date(get_option('date_format'), (integer)$get);
	117	+ $get = date(get_option('date_format'), (int)$get);
103	118
104		- else $get = date($attr['date_format'], (integer)$get);
	119	+ else $get = date($attr['date_format'], (int)$get);
105	120	}
106	121	}
107	122	else if($attr['user_option'] && isset($valid_user_options[$attr['user_option']]))
108	123	{
		@@ -114,11 +129,11 @@
114	129	if($attr['date_format'] === 'timestamp')
115	130	$get = (string)$get; // No change.
116	131
117	132	else if($attr['date_format'] === 'default')
118		- $get = date(get_option('date_format'), (integer)$get);
	133	+ $get = date(get_option('date_format'), (int)$get);
119	134
120		- else $get = date($attr['date_format'], (integer)$get);
	135	+ else $get = date($attr['date_format'], (int)$get);
121	136	}
122	137	}
123	138	if(isset($get) && (is_array($get) || is_object($get)))
124	139	{