== Changelog == = 2.10.5 June 25, 2025 = * Enhancements: - Added: Filter hook [`um_password_reset_form_primary_btn_classes`](https://ultimatemember.github.io/ultimatemember/hooks/um_password_reset_form_primary_btn_classes.html) for primary button classes in UM Password Reset form. - Added: Filter hook [`um_login_form_primary_btn_classes`](https://ultimatemember.github.io/ultimatemember/hooks/um_login_form_primary_btn_classes.html) for primary button classes in UM Login form. - Added: Filter hook [`um_register_form_primary_btn_classes`](https://ultimatemember.github.io/ultimatemember/hooks/um_register_form_primary_btn_classes.html) for primary button classes in UM Registration form. - Tweak: Refactored Site Health data, added hooks for 3rd-party integration. - Tweak: Avoid using `um_user( 'password_reset_link' )` and make it directly with `UM()->password()->reset_url( $user_id )` for getting a proper reset URL. - Tweak: Avoid using `um_user( 'account_activation_link' )` and make it directly with `UM()->permalinks()->activate_url( $user_id )` for getting a proper activation URL. * Bugfixes: - Fixed: Stripped shortcodes in the user data during the Account, Registration and Profile forms submission. (Thanks to [MissVeronica](https://github.com/MissVeronica)) - Fixed: Email placeholders values. - Fixed: Refactor deactivation logic to un-schedule Action Scheduler actions. - Fixed: Action Scheduler library errors. Updated to the recent 3.9.2 version. - Fixed: Secondary email field validation. - Fixed: Action Scheduler batch actions with users who have Undefined status. - Fixed: Restrictions for 3rd-party Gutenberg Blocks. - Fixed: Date/time picker filter-types range query on Member Directories. - Fixed: Renamed "Macedonia, the former Yugoslav Republic of" to the official "North Macedonia". * Deprecated: - Fully deprecated `account_activation_link_tags_patterns( $placeholders )` function. It's not used previously. Used email function arguments instead. - Fully deprecated `account_activation_link_tags_replaces( $replace_placeholders )` function. It's not used previously. Used email function arguments instead. - Fully deprecated `UM()->profile()->add_placeholder()` function. Used email function arguments instead. - Fully deprecated `UM()->profile()->add_replace_placeholder()` function. Used email function arguments instead. - Fully deprecated `UM()->user()->add_activation_placeholder()` function. Used email function arguments instead. - Fully deprecated `UM()->user()->add_activation_replace_placeholder()` function. Used email function arguments instead. - Deprecated `UM()->user()->maybe_generate_password_reset_key( $userdata )` function. Use `UM()->common()->users()->maybe_generate_password_reset_key( $userdata )` instead. - Deprecated `UM()->user()->set_last_login()` function. Use `UM()->common()->users()->set_last_login( $user_id )` instead. * Templates required update: - password-reset.php * Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade * = 2.10.4 May 15, 2025 = * Bugfixes: - Fixed: Security issue CVE ID: CVE-2025-47691. Used "sniccowp/php-scoper-wordpress-excludes" for getting the recent WordPress functions list and added them to the dynamic blacklist based on the WordPress version. - Fixed: The Action Scheduler action `um_set_default_account_status`. Case when some users were approved manually or deleted, and we need to reset the admin notice. Added `error_log()` to the wrong conditions. - Fixed: Reset Password request from not a predefined password reset page. It's possible to submit reset password form sitewide using block or shortcode. - Fixed: Setting 'Allow users to change email' for the Account page. It works now for any role instead of only the roles with 'Can edit other member accounts?' capability enabled. = 2.10.3 April 24, 2025 = * Enhancements: - Added: The `Ignore the "User Role > Registration Options"` setting. It provides an ability to auto-approve users if they were created via wp-admin > Users screen. - Tweak: Avoid email notifications to Administrator about user registration via wp-admin > Users screen. - Tweak: Updated the Action Scheduler implementation to improve flexibility and clarity. Refactor Action Scheduler for not only email handling. * Bugfixes: - Fixed: Member Directory styles when it's rendered on the Gutenberg builder page. - Fixed: Member Directory filtering query when the custom users metatable is used. - Fixed: PHP Warning that occurs when using the `getimagesize` function with an image from an external source. - Fixed: Reset Password email notification's the {password_reset_link}` placeholder. - Fixed: Changed "Turkey" to the current official term "Türkiye". * Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade * = 2.10.2 April 02, 2025 = * Enhancements: - Added: `UM()->common()-filesystem()::maybe_init_wp_filesystem();` method. - Added: `UM()->common()-filesystem()::remove_dir();` method. * Bugfixes: - Fixed: Security issue CVE ID: CVE-2025-1702. Reviewed general search scripts and suggested another solution that uses only `$wpdb->prepare()`. = 2.10.1 March 03, 2025 = * Bugfixes: - Fixed: Security issue CVE ID: CVE-2025-1702. - Fixed: Activation link redirects to Reset Password after registration without password field and required email activation. - Fixed: Honeypot scripts/styles for themes without pre-rendered shortcodes. Enqueue honeypot scripts/styles everytime. - Fixed: Profile photo metadata when Gravatar image is used. * Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade * = 2.10.0 February 18, 2025 = * Enhancements: - Added: User Profile `form-id` attribute and updated code for Profile/Cover photos actions dropdowns. - Added: Honeypot scripts/styles via `wp_add_inline_script()`, `wp_add_inline_style()` changed from direct adding in header and footer. - Updated: We've made improvements to requests for extension updates to boost stability. - Updated: PHP requirement - the minimum PHP version is now upgraded to 7.0. - Updated: Using $wpdb and WPCS for queries. Set minimum required version to 6.2 due to using %i for `$wpdb->prepare()`. - Updated: Revised wp-admin user actions handling. Now, the required capability is `edit_users` instead of `manage_options`. - Removed: User Profile hidden inputs on view mode. - Tweak: WPCS enhancements. * Bugfixes: - Fixed: Security issue CVE ID: CVE-2024-12276. - Fixed: Custom usermeta table metakeys for filtering in member directory (from `_money_spent` to `wc_money_spent_` and added `wc_order_count_`). - Fixed: Layout for "Download your data" and "Erase of your data" fields. - Fixed: Image sizes used for Open Graph meta in User Profile headers are now corrected. - Fixed: "Delete account text" settings visibility issue in wp-admin. - Fixed: The "Privacy Policy" field in the registration form. Disallowed HTML from the "Privacy Policy" content (like `