Fix - Registration form status and role validation not enforced (#1419)

* Fix - Registration form status and role validation not enforced

* Fix - Harden role check against malformed filters and role-name capability lookup

* Fix stale wpeverest/.github reference to themegrill/.github

---------

Co-authored-by: Aashil Bijukshe <81949431+lihsaa591@users.noreply.github.com>

Author: deepench

includes/class-ur-form-handler.php

@@ -1042,7 +1042,7 @@ public function get_form( $id = '', $args = array() ) {
 				$the_post->post_content = str_replace( '"noopener"', "'noopener'", $the_post->post_content );
 
 				if ( isset( $args['publish'] ) ) {
-					if ( ( $args['publish'] && 'publish' === $the_post->post_type ) || ( ! $args['publish'] && 'publish' !== $the_post->post_type ) ) {
+					if ( ( $args['publish'] && 'publish' !== $the_post->post_status ) || ( ! $args['publish'] && 'publish' === $the_post->post_status ) ) {
 						return array();
 					}
 				}

includes/frontend/class-ur-frontend-form-handler.php

@@ -65,7 +65,23 @@ public static function handle_form( $form_data, $form_id ) {
 		self::$valid_form_data = array();
 
 		self::$form_id      = $form_id;
-		$post_content_array = ( $form_id ) ? UR()->form->get_form( $form_id, array( 'content_only' => true ) ) : array();
+		$post_content_array = ( $form_id ) ? UR()->form->get_form( $form_id, array( 'content_only' => true, 'publish' => true ) ) : array();
+
+		if ( empty( $post_content_array ) ) {
+			$logger->error(
+				sprintf( '[Form #%d] Form could not be loaded for submission (missing, unpublished, or trashed).', $form_id ),
+				array(
+					'source'  => 'form-submission',
+					'form_id' => $form_id,
+				)
+			);
+
+			wp_send_json_error(
+				array(
+					'message' => __( 'This form is currently unavailable.', 'user-registration' ),
+				)
+			);
+		}
 
 		if ( gettype( $form_data ) != 'array' && gettype( $form_data ) != 'object' ) {
 			$form_data = array();
@@ -134,8 +150,13 @@ public static function handle_form( $form_data, $form_id ) {
 		// $logger->info( __( 'Response received', 'user-registration' ), array( 'source' => 'form-submission' ) );
 
 		if ( count( self::$response_array ) === 0 ) {
-			$user_role            = ! in_array( ur_get_form_setting_by_key( $form_id, 'user_registration_form_setting_default_user_role' ), array_keys( ur_get_default_admin_roles() ) ) ? 'subscriber' : ur_get_form_setting_by_key( $form_id, 'user_registration_form_setting_default_user_role' );
-			$user_role            = apply_filters( 'user_registration_user_role', $user_role, self::$valid_form_data, $form_id );
+			$configured_user_role     = ur_get_form_setting_by_key( $form_id, 'user_registration_form_setting_default_user_role' );
+			$is_known_role            = in_array( $configured_user_role, array_keys( ur_get_default_admin_roles() ) );
+			$current_user_capability  = apply_filters( 'ur_registration_user_capability', 'create_users' );
+			// A logged-in submitter already passed this same capability check in ur_process_registration(); an anonymous one never has.
+			$is_trusted_submitter     = is_user_logged_in() && ( current_user_can( 'manage_options' ) || current_user_can( $current_user_capability ) );
+			$user_role                = ( $is_known_role && ( $is_trusted_submitter || ! ur_registration_role_is_privileged( $configured_user_role ) ) ) ? $configured_user_role : 'subscriber';
+			$user_role                = apply_filters( 'user_registration_user_role', $user_role, self::$valid_form_data, $form_id );
 			$user_registered_date = apply_filters( 'user_registration_user_registered_date', current_time( 'Y-m-d H:i:s' ) );
 			$userdata             = array(
 				'user_login'      => isset( self::$valid_form_data['user_login'] ) ? self::$valid_form_data['user_login']->value : '',

includes/functions-ur-core.php

@@ -1373,6 +1373,61 @@ function ur_get_default_admin_roles() {
 	return apply_filters( 'user_registration_user_default_roles', $all_roles );
 }
 
+if ( ! function_exists( 'ur_registration_role_is_privileged' ) ) {
+	/**
+	 * Whether a role carries administrator-tier capabilities.
+	 *
+	 * @since 5.2.8
+	 *
+	 * @param string $role Role key.
+	 * @return bool True if the role must never be auto-assigned to an anonymous registration.
+	 */
+	function ur_registration_role_is_privileged( $role ) {
+		$wp_role = get_role( $role );
+
+		// Fail closed: an unrecognized role is never safe to auto-assign.
+		if ( ! $wp_role ) {
+			return true;
+		}
+
+		$default_restricted_caps = array(
+			'manage_options',
+			'edit_others_posts',
+			'edit_users',
+			'delete_users',
+			'create_users',
+			'promote_users',
+			'install_plugins',
+			'edit_plugins',
+			'delete_plugins',
+			'edit_theme_options',
+			'unfiltered_html',
+			'update_core',
+		);
+
+		/**
+		 * Filters the capabilities that mark a role too privileged to be
+		 * auto-assigned to an anonymous public registration.
+		 *
+		 * @param array $restricted_caps Capability keys.
+		 */
+		$restricted_caps = apply_filters( 'user_registration_restricted_registration_capabilities', $default_restricted_caps );
+
+		// Fail closed: an invalid filter return must not silently disable the check.
+		if ( ! is_array( $restricted_caps ) ) {
+			$restricted_caps = $default_restricted_caps;
+		}
+
+		foreach ( $restricted_caps as $cap ) {
+			if ( ! empty( $wp_role->capabilities[ $cap ] ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+}
+
 
 /**
  * Random number generated by time()