توضیحات
Bulk import and export WordPress users and WooCommerce customers from CSV, including roles, passwords and any custom meta.
تغییرات این نسخه
2.4.6
Security fix: custom profile field values (Tools > Show fields in profile) are now sanitized with sanitize_text_field() before being stored as user meta in save_extra_user_profile_fields(), closing a stored XSS vector where a low-privileged user (e.g. Subscriber) could stash an HTML/JS payload in a custom column (reported by Luca Laytynher (LyT))
Security fix: the CSV export “Some values have been altered” results notice now escapes the user id, column key and value with esc_html() before being rendered, preventing a stored XSS payload from executing in the administrator’s browser via export.js‘s .html() insertion (reported by Luca Laytynher (LyT))
2.4.5
Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import no longer falls back to a raw file_get_contents() call for values that are neither a numeric attachment ID nor an http(s) URL, closing an arbitrary local file read / PHP stream wrapper vector (e.g. file:///etc/passwd, php://filter) (reported by Binesh Madharapu)
Security fix: the bp_avatar remote URL fetch now disables automatic redirect following and re-validates every redirect hop against the same SSRF blocklist used for the initial URL, preventing an attacker-hosted URL from bypassing the gate via a 3xx redirect to an internal or cloud metadata address (reported by Binesh Madharapu)
2.4.4
Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import now also rejects link-local (169.254.0.0/16), carrier-grade NAT (100.64.0.0/10, 198.18.0.0/15) and other
Security fix: custom profile field values (Tools > Show fields in profile) are now sanitized with sanitize_text_field() before being stored as user meta in save_extra_user_profile_fields(), closing a stored XSS vector where a low-privileged user (e.g. Subscriber) could stash an HTML/JS payload in a custom column (reported by Luca Laytynher (LyT))
Security fix: the CSV export “Some values have been altered” results notice now escapes the user id, column key and value with esc_html() before being rendered, preventing a stored XSS payload from executing in the administrator’s browser via export.js‘s .html() insertion (reported by Luca Laytynher (LyT))
2.4.5
Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import no longer falls back to a raw file_get_contents() call for values that are neither a numeric attachment ID nor an http(s) URL, closing an arbitrary local file read / PHP stream wrapper vector (e.g. file:///etc/passwd, php://filter) (reported by Binesh Madharapu)
Security fix: the bp_avatar remote URL fetch now disables automatic redirect following and re-validates every redirect hop against the same SSRF blocklist used for the initial URL, preventing an attacker-hosted URL from bypassing the gate via a 3xx redirect to an internal or cloud metadata address (reported by Binesh Madharapu)
2.4.4
Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import now also rejects link-local (169.254.0.0/16), carrier-grade NAT (100.64.0.0/10, 198.18.0.0/15) and other