Changeset 3418471

Timestamp:

12/12/2025 06:11:45 PM (4 months ago)

Author:

cbutlerjr

Message:

3.5.4.4 beta release

Location:

wp-members/tags/3.5.4.4

Files:

• includes/class-wp-members-user-profile.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• wp-members.php (modified) (2 diffs)

wp-members/tags/3.5.4.4/includes/class-wp-members-user-profile.php

@@ -386 +386 @@
                 $fields[ $meta ] = wpmem_get_sanitized( $meta, '' ); // ( isset( $_POST[ $meta ] ) ) ? sanitize_text_field( $_POST[ $meta ] ) : '';
             } elseif ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
-                $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], wp_unslash( $_POST[ $meta ] ) ) : '';
+                $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], wpmem_sanitize_array( $_POST[ $meta ] ) ) : '';
             } elseif ( $field['type'] == 'textarea' ) {
                 $fields[ $meta ] = wpmem_get_sanitized( $meta, '', 'post', 'textarea' ); // ( isset( $_POST[ $meta ] ) ) ? sanitize_textarea_field( $_POST[ $meta ] ) : '';

wp-members/tags/3.5.4.4/readme.txt

@@ -3 +3 @@
 Tags: membership, registration, login, authentication, restriction
 Requires at least: 4.0
-Tested up to: 6.8
+Tested up to: 6.9
 Stable tag: 3.5.4.3
 License: GPLv3
@@ -131 +131 @@
 
 == Changelog ==
+
+= 3.5.4.4 =
+
+* This is a security patch. See release announcement for more detail.
 
 = 3.5.4.3 =

wp-members/tags/3.5.4.4/wp-members.php

@@ -4 +4 @@
 Plugin URI:  https://rocketgeek.com
 Description: WP access restriction and user registration.  For more information on plugin features, refer to <a href="https://rocketgeek.com/plugins/wp-members/docs/">the online Users Guide</a>. A <a href="https://rocketgeek.com/plugins/wp-members/quick-start-guide/">Quick Start Guide</a> is also available. WP-Members(tm) is a trademark of butlerblog.com.
-Version:     3.5.4.3
+Version:     3.5.4.4
 Author:      Chad Butler
 Author URI:  https://butlerblog.com/
@@ -59 +59 @@
 
 // Initialize constants.
-define( 'WPMEM_VERSION',    '3.5.4.3' );
+define( 'WPMEM_VERSION',    '3.5.4.4' );
 define( 'WPMEM_DB_VERSION', '2.4.2' );
 define( 'WPMEM_PATH', plugin_dir_path( __FILE__ ) ); // @todo Fairly certain this is obsolete.