| @@ -1472,9 +1472,10 @@ | ||
| 1472 | 1472 | 'forgot_modal' => uwp_get_option("design_style", 'bootstrap') == 'bootstrap' && uwp_get_option("forgot_modal", 1) ? 1 : '', |
| 1473 | 1473 | 'uwp_pass_strength' => uwp_get_option("register_min_password_strength", 0), |
| 1474 | 1474 | 'uwp_strong_pass_msg' => !empty($pass_msg) ? $pass_msg : __("Please enter valid strong password.", "userswp"), |
| 1475 | 1475 | 'default_banner' => uwp_get_default_banner_uri(), |
| 1476 | - 'basicNonce' => esc_attr(wp_create_nonce('uwp_basic_nonce')) | |
| 1476 | + 'basicNonce' => esc_attr(wp_create_nonce('uwp_basic_nonce')), | |
| 1477 | + 'wordfence_2fa_active' => ( class_exists( '\WordfenceLS\Controller_Users' ) && class_exists( '\WordfenceLS\Controller_TOTP' ) ) ? 1 : '' | |
| 1477 | 1478 | ); |
| 1478 | 1479 | |
| 1479 | 1480 | return apply_filters('uwp_localize_data', $uwp_localize_data); |
| 1480 | 1481 | } |
| @@ -1870,13 +1871,17 @@ | ||
| 1870 | 1871 | $key = wp_generate_password(20, false); |
| 1871 | 1872 | |
| 1872 | 1873 | do_action('uwp_activation_key', $user_data->user_login, $key); |
| 1873 | 1874 | |
| 1874 | - if (empty($wp_hasher)) { | |
| 1875 | - require_once ABSPATH . 'wp-includes/class-phpass.php'; | |
| 1876 | - $wp_hasher = new PasswordHash(8, true); | |
| 1875 | + if ( function_exists( 'wp_fast_hash' ) ) { | |
| 1876 | + $hashed = wp_fast_hash( $key ); | |
| 1877 | + } else { | |
| 1878 | + if ( empty( $wp_hasher ) ) { | |
| 1879 | + require_once ABSPATH . 'wp-includes/class-phpass.php'; | |
| 1880 | + $wp_hasher = new PasswordHash( 8, true ); | |
| 1881 | + } | |
| 1882 | + $hashed = $wp_hasher->HashPassword( $key ); | |
| 1877 | 1883 | } |
| 1878 | - $hashed = $wp_hasher->HashPassword($key); | |
| 1879 | 1884 | $wpdb->update($wpdb->users, array('user_activation_key' => time() . ":" . $hashed), array('user_login' => $user_data->user_login)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching |
| 1880 | 1885 | update_user_meta($user_id, 'uwp_mod', 'email_unconfirmed'); |
| 1881 | 1886 | |
| 1882 | 1887 | $activation_args = array( |
| @@ -2098,15 +2103,23 @@ | ||
| 2098 | 2103 | $relative_url = $upload_baseurl . '/' . $match_url; |
| 2099 | 2104 | } |
| 2100 | 2105 | } |
| 2101 | 2106 | } else { |
| 2107 | + if ( substr_count( $match_url, $match_upload_baseurl ) > 1 || substr_count( $match_url, $match_content_url ) > 1 ) { | |
| 2108 | + return ''; | |
| 2109 | + } | |
| 2110 | + | |
| 2102 | 2111 | if ( strpos( $match_url, $match_upload_baseurl ) === 0 ) { // url contains uploads baseurl |
| 2103 | - $relative_url = str_replace( $match_upload_baseurl, '', $match_url ); | |
| 2112 | + $relative_url = substr( $match_url, strlen( $match_upload_baseurl ) ); | |
| 2104 | 2113 | } elseif ( strpos( $match_url, $match_content_url ) === 0 ) { // url contains content url |
| 2105 | - $relative_url = str_replace( $match_content_url, '', $match_url ); | |
| 2114 | + $relative_url = substr( $match_url, strlen( $match_content_url ) ); | |
| 2106 | 2115 | } |
| 2107 | 2116 | |
| 2108 | 2117 | $relative_url = trim( $relative_url, '/\\' ); |
| 2118 | + | |
| 2119 | + if ( false !== strpos( $relative_url, '..' ) ) { | |
| 2120 | + return ''; | |
| 2121 | + } | |
| 2109 | 2122 | } |
| 2110 | 2123 | |
| 2111 | 2124 | return apply_filters( 'uwp_get_file_relative_url', $relative_url, $url, $full_path ); |
| 2112 | 2125 | } |
