Repository navigation
Releases
Releases · iworks/sierotki
v3.4.6
- Fixed Stored Cross-Site Scripting (XSS) via the comment parameter - the protected-tags placeholder digest was predictable, which allowed an unauthenticated attacker to restore raw markup inside an HTML attribute. The digest is now salted with a site-specific key. (CVE-2026-124216). Props for Santh.
v3.4.5
- Build system converted from Grunt to the Bun bundler (
bun run build). - Developer documentation moved from
readme.txttoREADME.md- the WordPress.org readme is now end-user focused only. - New
bun run update-libstask to update the vendored iWorks libraries. - Translation files regenerated with wp-cli (
i18n make-pot/update-po). - Security hardening: capability check (new
iworks/orphans/capabilityfilter, defaultmanage_options) is now enforced for configuration import and export. - Security hardening: imported option names are whitelisted to plugin options only - arbitrary options can no longer be overwritten.
- Security hardening: uploaded import file is fully validated before parsing.
- Security hardening: orphan terms are escaped with
preg_quote()before building replacement patterns. - Export file name is now properly quoted in the
Content-Dispositionheader. - Import/export admin scripts are loaded only on the Orphans settings screen.
- The
iworks_orphans_capabilityfilter, previously documented, is now actually applied - renamed toiworks/orphans/capabilitywith the old name kept as a deprecated fallback. - All
iworks_orphan_*(andorphans_*) filters renamed to the namespacediworks/orphans/...schema - legacy names still work as deprecated (3.6.0) fallbacks. - Fixed release packaging:
.git*,.gitmodules,.github/and.editorconfigfiles are no longer included in the ZIPs. - Fixed build: the
PLUGIN_URLplaceholder replacement no longer corrupts theIWORKS_ORPHANS_PLUGIN_URLconstant (a fatal error on activation). - Empty banner-only
sierotki-admin/sierotki-frontendJS and CSS bundles are no longer shipped. - Plugin root, plugin basename and assets URL are now derived from the plugin constants instead of relative directory guessing.
v3.4.4
v3.4.2
- Updated & enhaced build process.
- Updated the iWorks Options module to version 3.1.0.
v3.4.1
- Updated the iWorks Options module to version 3.0.8.
- Updated the iWorks Rate module to version 2.3.2.
v3.4.0
- Resolved conflict arising from differing implementations of the acf/format_value filter in Advanced Custom Fields and Secure Custom Fields plugins.
- Refactored codebase by separating Secure Custom Fields integration into its own dedicated file.
- Refactored codebase by separating Advanced Custom Fields integration into its own dedicated file.
v3.3.9
- Integration with the Secure Custom Fields plugin has been added.
- Updated the iWorks Options module to version 3.0.7.
- Updated the iWorks Rate module to version 2.3.1.
v3.3.8
- Replaced
logo.pngbylogo.svg. - Updated the iWorks Options module to version 3.0.2.
- Updated the iWorks Rate module to version 2.3.0.
v3.3.7
- Enhanced PHPDoc documentation across the codebase for better maintainability.
- Improved code organization and added proper escaping for output security.
- Added constants for plugin paths and URLs to improve code reliability.
- Fixed URL escaping in admin interface for better security.
- Updated documentation with more detailed function descriptions and parameter information.
- Improved code comments and inline documentation for better developer experience.
- Updated the iWorks Options module to version 3.0.1.