#1408 Fix - Match the meta auth_callback to WP's 6-arg filter signature and dedupe the redirect host

Author: MILAN88888

includes/frontend/class-ur-frontend.php

@@ -262,7 +262,7 @@ public function allow_custom_redirect_host( $hosts ) {
 
 		$host = wp_parse_url( $external_url, PHP_URL_HOST );
 
-		if ( ! empty( $host ) ) {
+		if ( ! empty( $host ) && ! in_array( $host, $hosts, true ) ) {
 			$hosts[] = $host;
 		}
 

modules/membership/includes/Admin.php

@@ -995,20 +995,22 @@ public function protect_membership_post_meta() {
 		/**
 		 * Whether the current user may write membership post meta.
 		 *
-		 * Registered as a register_post_meta() auth_callback, which WordPress invokes with the
-		 * filter arguments below. AND-ing with $allowed means this can only ever narrow a core
-		 * decision, never widen one.
+		 * Registered as a register_post_meta() auth_callback. WordPress invokes it through the
+		 * auth_{$object_type}_meta_{$meta_key} filter with the six arguments below; only the write
+		 * decision it returns is used. Write access is limited to users who can manage options.
 		 *
 		 * @since 5.2.8
 		 *
 		 * @param bool   $allowed   Whether the write is allowed so far.
 		 * @param string $meta_key  Meta key being written.
 		 * @param int    $object_id Post ID.
 		 * @param int    $user_id   User attempting the write.
+		 * @param string $cap       Capability being checked.
+		 * @param array  $caps      Primitive capabilities required.
 		 * @return bool True when the user can manage the site's options.
 		 */
-		public function can_manage_membership_meta( $allowed = false, $meta_key = '', $object_id = 0, $user_id = 0 ) {
-			return $allowed && current_user_can( 'manage_options' );
+		public function can_manage_membership_meta( $allowed = false, $meta_key = '', $object_id = 0, $user_id = 0, $cap = '', $caps = array() ) {
+			return current_user_can( 'manage_options' );
 		}
 
 		/**