[s2Get user_field="my_field" /] stopped working

#21

Hi,

I recently noticed the s2Get shortcode was returning the wrong “display_name”. To verify the shortcode, I created a test page and manually tested with different “user_id” values. Regardless of the “user_id”, it was always returning the “display_name” of the logged in user.

For reference, I’m using this shortcode:
[s2Get user_field=“display_name” user_id=“123” /]

Per the messages above, I went ahead and updated to version (v260301). Unfortunately, that didn’t fix the issue. I was able to track down the shortcode here: /plugins/s2member/src/includes/classes/sc-gets-in.inc.php

On line #75? I see the “user_id” attribute was hard coded to “0” ($attr[‘user_id’] = 0). When I comment this out, the shortcode works as expected and returns the correct “display_name”.

Can one of the staff or moderators confirm this is the issue causing these problems. I’m guessing someone accidentally tested this out, but forgot to remove it, when this was pushed to production.

Thoughts?

Thanks

Mark

#22

I see. Yeah, I disabled the user_id="" attribute for [s2Get /] a while back while patching a reported vulnerability.

At the moment, [s2Get /] will use the current user’s value for the field instead. That’s enough for the most common use cases, but clearly not for yours.

Normally [s2Get /] is used to personalize a page for the current user, like showing their own name or profile-related details. In your example, you’re trying to always show a particular user’s name regardless of who is viewing the page, which is a different use case.

I also forgot to update the KB article to remove the user_id="" attribute from the documented examples, so that’s on me.

To improve this, I’m looking at adding an admin setting so site owners can allow user_id="" again for specific [s2Get /] fields they choose.

:slight_smile:

#23

Hi Clavaque,

Yep. I’ve been using this version of the shortcode for many years, and didn’t realize it had changed :slight_smile:

Just in case others are accessing the KB, please update the 6 references under the section “Shortcode Equivalents Using [s2Get /]” (https://s2member.com/kb-article/s2get-shortcode-documentation/)

There’s no need for you to create an admin featured for me. I can simply create a new shortcode for my purposes.

Thanks

Mark

1 Like
#24

I think I may have found the issue to this long standing issue.

On line #75 of “sc-gets-in.inc.php” the $attr[‘user_id’] variable is hardcoded with a value of “0”. This was causing every call to the s2Get shortcode to return the current user, regardless of the user_id passed in the shortcode.

When I comment this out, the shortcode is working as expected.

Can anyone else confirm this? I believe this was accidentally left in the code during some testing in early 2025.

The file is located in /s2member/src/includes/classes/sc-gets-in.inc.php

Thoughts?

1 Like
#25

yup, works for me!

I cant believe someone left this in. Looks like a bit of code left there when testing. hahahaha

the following lines in s2member/src/includes/classes/sc-gets-in.inc.php should be commented out.

 74                         $attr['user_id_backup'] = $attr['user_id'];
 75                         $attr['user_id'] = 0;

user_id_backup is used nowhere else in the s2member or s2member-pro codebase.

#26

No, that wasn’t testing, it was on purpose to disable the user_id attribute from the shortcode as part of a security patch a while ago. I just forgot to update the knowledge base article. :sweat_smile:

I now added a new option to whitelist fields you’d like to use a user_id with. WP admin > s2Member > General Options > s2Get Shortcode

And updated the kb article. https://s2member.com/kb-article/s2get-shortcode-documentation/#toc-bf42e51c

:slight_smile:

1 Like