WordPress.org
Get WordPress

Plugin Directory

Changeset 3285238


Ignore:
Timestamp:
04/30/2025 09:06:29 PM (11 months ago)
Author:
mediaticus
Message:

Deploy version 1.6.7

Location:
subaccounts-for-woocommerce/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • subaccounts-for-woocommerce/trunk/public/my-account.php

    r3272812 r3285238  
    24412441   
    24422442    // Make sure we don't interfere My Account -> Addresses forms.
    2443     if ( is_wc_endpoint_url( 'subaccounts' ) ) {
    2444 
     2443    if ( ! is_wc_endpoint_url( 'subaccounts' ) )
     2444        return;
     2445
     2446    // Retrieve (Ajax) user_id of customer which is currently being edited My Account -> Subaccounts -> Manage Subaccounts.
     2447    if ( isset( $_POST['sfwc_frontend_edit_subaccount_user_id'] ) ) {
     2448        $user_id = absint( sanitize_text_field( $_POST['sfwc_frontend_edit_subaccount_user_id'] ) );
     2449    } else {
     2450        return;
     2451    }
     2452   
     2453    // Before proceeding check if nonce is in place and verfy it. Leave this after checking: isset( $_POST['sfwc_frontend_edit_subaccount_user_id'] )
     2454    if ( ! isset( $_POST['sfwc_nonce_frontend_edit_subaccount_form'] ) || isset( $_POST['sfwc_nonce_frontend_edit_subaccount_form'] ) && ! wp_verify_nonce( $_POST['sfwc_nonce_frontend_edit_subaccount_form'], 'sfwc_nonce_frontend_edit_subaccount_action' ) ) {
     2455        wc_add_notice( esc_html__( 'Nonce could not be verified.', 'subaccounts-for-woocommerce' ), 'error');
     2456        return;
     2457    }
     2458   
     2459   
     2460    $parent_id = get_current_user_id();
     2461   
     2462    $sfwc_options = (array) get_option('sfwc_options');
     2463   
     2464    $sfwc_option_selected_roles = ( isset( $sfwc_options['sfwc_option_selected_roles'] ) ) ? $sfwc_options['sfwc_option_selected_roles'] : array('customer', 'subscriber');
     2465   
     2466    $parent_account_level_type = get_user_meta( $parent_id, 'sfwc_account_level_type', true );
     2467   
     2468    $subaccount_account_level_type = get_user_meta( $user_id, 'sfwc_account_level_type', true );
     2469   
     2470   
     2471       
     2472    if ( is_user_logged_in() && sfwc_is_current_user_role_valid() && sfwc_is_current_user_role_enabled() && ( $parent_account_level_type == 'supervisor' || $parent_account_level_type == 'manager' ) ) {
     2473       
     2474       
    24452475        /**
    2446          *
     2476         * Validation.
    24472477         *
    24482478         */
    2449          
    2450         // Retrieve (Ajax) user_id of customer which is currently being edited My Account -> Subaccounts -> Manage Subaccounts.
    2451         if ( isset( $_POST['sfwc_frontend_edit_subaccount_user_id'] ) ) {
    2452             $user_id = absint( sanitize_text_field( $_POST['sfwc_frontend_edit_subaccount_user_id'] ) );
    2453         } else {
     2479       
     2480        // Get children (array) of currently logged in user.                                                                       
     2481        $children_ids = get_user_meta( $parent_id, 'sfwc_children', true );
     2482
     2483        /**
     2484         * Remove no longer existing users from the $children_ids array
     2485         * in case a user has been deleted (but still present within 'sfwc_children' meta of an ex parent account).
     2486         */
     2487        $existing_children_ids = array();
     2488       
     2489        if ( ! empty ( $children_ids ) ) {
     2490           
     2491            if ( $parent_account_level_type == 'supervisor' ) {
     2492           
     2493                foreach ( $children_ids as $single_id ) {
     2494                   
     2495                    // Check if user still exists.
     2496                    $user_exists = get_userdata( $single_id );
     2497                    if ( $user_exists !== false ) {
     2498                       
     2499                        // Check if user role is valid and enabled from plugin settings.
     2500                        if ( sfwc_is_user_role_valid( $single_id ) && sfwc_is_user_role_enabled( $single_id ) && get_user_meta( $single_id, 'sfwc_account_level_type', true ) == 'manager' ) {
     2501                               
     2502                            $existing_children_ids[] = $single_id;
     2503                           
     2504                            // In case currently logged in user is a Supervisor we get also subaccounts of the Manager.                                                                     
     2505                            $children_ids_deep = get_user_meta( $single_id, 'sfwc_children', true );
     2506                           
     2507                            if ( ! empty ( $children_ids_deep ) ) {
     2508           
     2509                                foreach ( $children_ids_deep as $single_id_deep ) {
     2510                                   
     2511                                    // Check if user still exists.
     2512                                    $user_exists = get_userdata( $single_id_deep );
     2513                                    if ( $user_exists !== false ) {
     2514                                       
     2515                                        // Check if user role is valid and enabled from plugin settings.
     2516                                        if ( sfwc_is_user_role_valid( $single_id_deep ) && sfwc_is_user_role_enabled( $single_id_deep ) &&
     2517                                             get_user_meta( $single_id_deep, 'sfwc_account_level_type', true ) !== 'supervisor' &&
     2518                                             get_user_meta( $single_id_deep, 'sfwc_account_level_type', true ) !== 'manager' )
     2519                                        {
     2520                                            $existing_children_ids[] = $single_id_deep;
     2521                                        }
     2522                                    }
     2523                                }
     2524                            }
     2525                        }
     2526                    }
     2527                }
     2528            } elseif ( $parent_account_level_type == 'manager' ) {
     2529               
     2530                foreach ( $children_ids as $single_id ) {
     2531                   
     2532                    // Check if user still exists.
     2533                    $user_exists = get_userdata( $single_id );
     2534                    if ( $user_exists !== false ) {
     2535                       
     2536                        // Check if user role is valid and enabled from plugin settings.
     2537                        if ( sfwc_is_user_role_valid( $single_id ) && sfwc_is_user_role_enabled( $single_id ) &&
     2538                             get_user_meta( $single_id, 'sfwc_account_level_type', true ) !== 'supervisor' &&
     2539                             get_user_meta( $single_id, 'sfwc_account_level_type', true ) !== 'manager' )
     2540                        {
     2541                            $existing_children_ids[] = $single_id;
     2542                        }
     2543                    }
     2544                }
     2545            }
     2546        }
     2547       
     2548
     2549       
     2550
     2551        /**
     2552         * Validation
     2553         *
     2554         * - Verify that the ID of the user being edited belongs to a subaccount of the currently logged-in parent account;
     2555         * - Verify the account level type of the subaccount.
     2556         */
     2557        if (
     2558            ! in_array( $user_id, $existing_children_ids ) ||
     2559            ( $parent_account_level_type == 'supervisor' && $subaccount_account_level_type == 'supervisor' ) ||
     2560            ( $parent_account_level_type == 'manager' && ( $subaccount_account_level_type == 'supervisor' || $subaccount_account_level_type == 'manager' ) )
     2561        ) {         
     2562            wc_add_notice( esc_html__( 'You are not allowed to edit this user.', 'subaccounts-for-woocommerce' ), 'error');
    24542563            return;
    24552564        }
    24562565       
    2457         // Before proceeding check if nonce is in place and verfy it.
    2458         // Leave this after checking: isset( $_POST['sfwc_frontend_edit_subaccount_user_id'] )
    2459         if ( ! isset( $_POST['sfwc_nonce_frontend_edit_subaccount_form'] ) || isset( $_POST['sfwc_nonce_frontend_edit_subaccount_form'] ) && ! wp_verify_nonce( $_POST['sfwc_nonce_frontend_edit_subaccount_form'], 'sfwc_nonce_frontend_edit_subaccount_action' ) ) {
    2460             wc_add_notice( esc_html__( 'Nonce could not be verified.', 'subaccounts-for-woocommerce' ), 'error');
    2461             return;
    2462         }
     2566       
    24632567       
    24642568       

  • subaccounts-for-woocommerce/trunk/readme.txt

    r3273751 r3285238  
    44Tested up to: 6.8
    55Requires PHP: 5.7
    6 Stable tag: 1.6.6
     6Stable tag: 1.6.7
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    158158== Changelog ==
    159159
     160= 1.6.7 =
     161*Release Date April 30, 2025*
     162
     163* **Improvement** – Fix Broken Authentication vulnerability.
     164
    160165= 1.6.6 =
    161166*Release Date April 15, 2025*
    … …  
    166171* **Fix** – Fix undefined `filter_account_type` on Edit Subaccount page in frontend.
    167172* **Tweak** – Display `Account`, `Contact Us` and `Add-ons` submenu items as plugin tabs in the backend.
    168 * **Tweak** – Provide both an HTML `class` and a unique HTML `id` for each navigation tab present in the `Subaccount` page on frontend.
     173* **Tweak** – Provide both a HTML `class` and a unique HTML `id` for each navigation tab present in the `Subaccount` page on frontend.
    169174* **Tweak** – Provide HTML classes for each table column on the frontend `Manage Subaccounts` table.
    170175* **Tweak** – Changed the HTML markup of the fields in the "Account Details" section of the `Edit Subaccount` frontend form.

  • subaccounts-for-woocommerce/trunk/subaccounts-for-woocommerce.php

    r3273751 r3285238  
    44 * Plugin URI: https://subaccounts.pro/
    55 * Description: Subaccounts for WooCommerce allows the creation of subaccounts for your WooCommerce customers and subscribers.
    6  * Version: 1.6.6
     6 * Version: 1.6.7
    77 * Requires Plugins: woocommerce
    88 * Author: Mediaticus
    … …  
    1515 * Tested up to: 6.8
    1616 *
    17  * WC tested up to: 9.8.1
     17 * WC tested up to: 9.8.3
    1818 * Requires PHP: 5.7
    1919 *
    … …  
    9898
    9999if ( ! defined( 'SFWC_CURRENT_VERSION' ) ) {
    100     define( 'SFWC_CURRENT_VERSION', '1.6.6' ); // MAJOR.MINOR.PATCH
     100    define( 'SFWC_CURRENT_VERSION', '1.6.7' ); // MAJOR.MINOR.PATCH
    101101}
    102102
Note: See TracChangeset for help on using the changeset viewer.