About: Suhaib Siddiqi

Thanks Bruce,
I am not using MOP vars. I am doing a simple thing, a user register for 24 hours, pay registration fee. After that upload the image to the member area, and fills in description form. I am not a professional programmer. Therefore, I would like to keep it simple, i.e. if it works and serves my purpose then I am happy with it :-)

Jason,

Thanks. I believe, I may have found a simpler solution. Only registered users can fill the form, but the uploaded images are visible to visitors. Registration page take them to payment page. I moved the existing features protected by s2Members to level2, and this new one to level one. On the development, concept seems to work.

Well, those are blocking whole page from visitors to see, I wanted them to take to membership payment page when they click “Create Competitor” button after uploading the image and filling in the form field.
Following is the code in their php file, which is triggered after pressing create competitor button.

$ret .= '    <p class="wp-user-submit-submit"><input type="submit" value="'. __("Create Competitor", "showdownusersubmit").'" /> </p>';

One time charge.

I did a little search on this issue. This issue was discussed on your free plugin public forum in 2011 Q1. Anyone can execute http://www.example.com/wp-content/plugins/s2member/s2member-o.php?ws_plugin__s2member_js_w_globals=1&qcABC=1&ver=120703-120703-1784216801
It shows data in the browser, even though not sensitive, but public, and logout users should not be able to see it in browser by executing remote query. It gives hackers an option to look for exploitable look holes, and it also displays the email address, which spammers collect to spam. This should be fixed.

Cristian
Thanks.

Hi Raam

Yess that did work.

Cristian

Here is the screen capture of EOT panel

Looking forward to your suggestions.

Thanks

• This reply was modified 4 years, 4 months ago by  Suhaib Siddiqi.

Thanks Cristian. Your hack is fool proof to protect URI. It is very much appreciated.

Hi Jason

My WP Permalinks do include trailing slash, and my URI Restrictions look like this:

/members/?pid=5&pagetitle=save_searches
/members/?pid=6&pagetitle=privacy_settings
/members/?pid=6&pagetitle=skype_settings
/members/?pid=13&pagetitle=viewed_me
/members/?pid=13&pagetitle=i_viewed
/members/?pid=13&pagetitle=trending
/members/?pid=13&pagetitle=interest_cloud
/members/?pid=1&pagetitle=view_winks
/members/?pid=1&pagetitle=view_friends
/members/?pid=1&pagetitle=my_favourites
/members/?pid=1&pagetitle=my_matches
/members/?pid=1&pagetitle=alerts
/members/?pid=1&pagetitle=blocked

It does not work. I am using Month and Name option from WP Permalink, which looks like http://www.mydomain.com/2012/08/sample-post/

However, the hack protects URI

<?php
add_action ('wp_loaded', 'ccap_uri_restriction', 1);
function ccap_uri_restriction() {
	if (strpos($_SERVER['REQUEST_URI'], '/members/') !== false && current_user_can('access_s2member_level0') === false) {
		wp_redirect(S2MEMBER_MEMBERSHIP_OPTIONS_PAGE_URL);
		exit;
	}
	if (strpos($_SERVER['REQUEST_URI'], '/members/?pid=14&pagetitle=my_email&message_template=inbox') !== false && current_user_can('access_s2member_level1') === false) {
		wp_redirect(S2MEMBER_MEMBERSHIP_OPTIONS_PAGE_URL);
		exit;
	}

}
?>

I do not understand why URI Restriction from Dashboard will not protect /members/?pid=14&pagetitle=my_email&message_template=inbox, but hack will do it.

• This reply was modified 4 years, 5 months ago by  Suhaib Siddiqi.

URI Restrictions from

Dashboard -› s2Member® -› Restriction Options -› URI Access Restrictions

are not working. However, if I edit the code of plugin in question and do following

<?php if (current_user_can("access_s2member_level1")){ ?>

<a href="<? echo add_query_arg (array('pid' =>1,'pagetitle'=>'mypage'), $root_link);?>" title="<?=language_code('DSP_MENU_MY_PAGE')?>"><?=language_code('DSP_MENU_MY_PAGE')?></a></div>

<?php }  ?>

It does work. But, it messes up CSS layout. This is not a good a solution because it will require editing a lot of php files.

I do not understand why

Dashboard -› s2Member® -› Restriction Options -› URI Access Restrictions

does not restrict URI.
I ruled out the plugins conflicts, by deactivating all the plugins except s2Member and the one of which I am trying to restrict URI.

• This reply was modified 4 years, 5 months ago by  Suhaib Siddiqi.
• This reply was modified 4 years, 5 months ago by  Suhaib Siddiqi.
• This reply was modified 4 years, 5 months ago by  Suhaib Siddiqi.