Function update profile have bugs don’t find table.

Resolved khanhnc
(@khanhnc)

1 week ago

When using function update profile. it have bugs:

Warning: Undefined variable $table_name in /var/www/html/wp-content/plugins/wp-w3all-phpbb-integration/class.wp.w3all-phpbb.php on line 1809

WordPress database error: [You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ‘WHERE LOWER(user_email) = ‘subscriber_khanh@gmail.com” at line 3]
SELECT user_id, group_id FROM WHERE LOWER(user_email) = 'subscriber_khanh@gmail.com'Warning: Cannot modify header information – headers already sent by (output started at /var/www/html/wp-content/plugins/wp-w3all-phpbb-integration/class.wp.w3all-phpbb.php:1809) in /var/www/html/wp-includes/pluggable.php on line 1535 Warning: Cannot modify header information – headers already sent by (output started at /var/www/html/wp-content/plugins/wp-w3all-phpbb-integration/class.wp.w3all-phpbb.php:1809) in /var/www/html/wp-includes/pluggable.php on line 1538

Viewing 2 replies - 1 through 2 (of 2 total)

Plugin Author axew3
(@axewww)

1 week ago
Version 3.1.0 is coming in one hour at max, you are hitting just while i am doing!

I checked finally all the code, and beside the one you reported, it will immediately fix around 23 possible security bugs! Coming!

== Changelog ==

= 3.1.0 =
- Security: Implemented rigid database query parameterization via $wpdb->prepare() across all primary user lookups, authentication hooks, and cookie processing routines to eliminate potential SQL Injection (SQLi) attack vectors.
- Security: Neutralized Reflected Cross-Site Scripting (XSS) risks by wrapping dynamic system notifications and database connection error warnings ($dberror) in explicit esc_html() sanitization filters.
- Fix: Fully refactored the bulk-row user group assignment logic inside the w3all_phpbb_USER_groupSwitch loop to leverage safe, matrix-bound parameter arrays instead of unsafe string concatenations.
- Fix: Patched a legacy missing-comma SQL query syntax bug within multi-attribute database update chains that could trigger fatal processing failures under strict MySQL/MariaDB server configurations.
- Fix: Cleaned up shortcode attribute processing to prevent HTML/CSS layout manipulation or attribute breakout from user-defined style fields.
- Architectural Optimization: Session destruction routines inside the logout pipeline to use typed integer-and-string bindings, ensuring rigorous alignment with PHP 8.2+ and modern WordPress Core development guidelines.
Plugin Author axew3
(@axewww)

1 week ago
I will mark resolved this topic as the plugin will be released, i informed validators to release immediately the plugin even before because it is also a mayor security update. Released here at wp.org (you can download and install 3.1.0 manually) but dispatched to sites:

Version 3.1.0 will be released to sites in about 6 hours. WordPress.org currently delays plugin updates by 6 hours so moderators and security scanners can review changes before they reach users. If this update fixes a security issue that needs to ship sooner, contact plugins@wordpress.org.

== Changelog ==

= 3.1.0 =
- Fix: User profile update error caused by missing variable assignment.
- Security: Implemented rigid database query parameterization via $wpdb->prepare() across all primary user lookups, authentication hooks, and cookie processing routines to eliminate potential SQL Injection (SQLi) attack vectors.
- Security: Neutralized Reflected Cross-Site Scripting (XSS) risks by wrapping dynamic system notifications and database connection error warnings ($dberror) in explicit esc_html() sanitization filters.
- Fix: Fully refactored the bulk-row user group assignment logic inside the w3all_phpbb_USER_groupSwitch loop to leverage safe, matrix-bound parameter arrays instead of unsafe string concatenations.
- Fix: Patched a legacy missing-comma SQL query syntax bug within multi-attribute database update chains that could trigger fatal processing failures under strict MySQL/MariaDB server configurations.
- Fix: Cleaned up shortcode attribute processing to prevent HTML/CSS layout manipulation or attribute breakout from user-defined style fields.
- Architectural Optimization: Session destruction routines inside the logout pipeline to use typed integer-and-string bindings, ensuring rigorous alignment with PHP 8.2+ and modern WordPress Core development guidelines.
- Note: I tested the major options, but not on all the possible configurations and the latest updates might affect something (some more var missing ?). Please report any bugs.
You are moderating my posts, WoW!
- This reply was modified 1 week ago by axew3.

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

Tags