WordPress.org
Get WordPress

Plugin Directory

Changeset 3383015


Ignore:
Timestamp:
10/23/2025 03:00:16 AM (7 weeks ago)
Author:
Alignak
Message:

v3.5.2

Location:
fast-velocity-minify/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • fast-velocity-minify/trunk/assets/fvm.js

    r2520880 r3383015  
    11// get logs via ajax
    22function fvm_get_logs() {
    3        
     3
    44    // ajax request
    55    jQuery( document ).ready(function() {
    6         var data = { 'action': 'fvm_get_logs' };
     6        var data = { 'action': 'fvm_get_logs', 'nonce': fvm_ajax_object.ajax_nonce };
    77        jQuery.post(ajaxurl, data, function(resp) {
    88            if(resp.success == 'OK') {

  • fast-velocity-minify/trunk/fvm.php

    r3382708 r3383015  
    44 * Plugin URI: https://fastvelocity.com
    55 * Description: Improve your speed score on GTmetrix, Pingdom Tools and Google PageSpeed Insights by merging and minifying CSS and JavaScript files into groups, compressing HTML and other speed optimizations.
    6  * Version: 3.5.1
     6 * Version: 3.5.2
    77 * Author: Raul Peixoto
    88 * Author URI: https://fastvelocity.com
    … …  
    6767    add_action('admin_menu', 'fvm_add_admin_menu');
    6868    add_action('admin_notices', 'fvm_show_admin_notice_from_transient');
    69     add_action('wp_ajax_fvm_get_logs', 'fvm_get_logs_callback');
     69    add_action('wp_ajax_fvm_get_logs', 'fvm_get_logs_callback'); # Note: JS must pass nonce as 'fvm_logs_nonce'
    7070       
    7171    # purge everything

  • fast-velocity-minify/trunk/inc/admin.php

    r2669786 r3383015  
    8787        # check if our tables exist, and do maintenance once a day
    8888        $fvm_table_checker = get_transient('fvm_table_checker');
    89         $fvm_table_checker = false;
    9089        if ($fvm_table_checker === false) {
    9190           
    … …  
    9493            if(!is_null($wpdb)) {
    9594                $sqla_table_name = $wpdb->prefix . 'fvm_cache';
    96                 if (!$wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $sqla_table_name)) === $sqla_table_name) {
    97                     fvm_plugin_activate();                             
     95                if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $sqla_table_name)) !== $sqla_table_name) {
     96                    fvm_plugin_activate();
    9897                }
    9998            }
    … …  
    168167                            if(is_string($v)) { $_POST['fvm_settings'][$group][$k] = strip_tags($v); }
    169168                           
    170                             # clean cdn url
    171                             if($group == 'cdn' && $k == 'url') {
    172                                 $_POST['fvm_settings'][$group][$k] = trim(trim(str_replace(array('http://', 'https://'), '', $v), '/'));
     169                            # clean cdn url with strict validation to prevent XSS
     170                            if($group == 'cdn' && $k == 'domain') {
     171                                $domain = trim(str_replace(array('http://', 'https://'), '', $v), '/');
     172                                // Only allow valid hostnames (alphanumeric, hyphens, dots)
     173                                if (!empty($domain) && !preg_match('/^[a-zA-Z0-9\-\.]+$/', $domain)) {
     174                                    $_POST['fvm_settings'][$group][$k] = '';
     175                                    add_settings_error('fvm_admin_notice', 'fvm_admin_notice', __('Invalid CDN domain format. Only alphanumeric characters, hyphens and dots allowed.', 'fast-velocity-minify'), 'error');
     176                                } else {
     177                                    $_POST['fvm_settings'][$group][$k] = sanitize_text_field($domain);
     178                                }
    173179                            }
    174180       
    … …  
    232238        # js
    233239        wp_enqueue_script('fvm', $fvm_var_url_path . 'assets/fvm.js', array('jquery'), filemtime($fvm_var_dir_path.'assets'. DIRECTORY_SEPARATOR .'fvm.js'));
     240
     241        # localize nonce for AJAX security
     242        wp_localize_script('fvm', 'fvm_ajax_object', array(
     243            'ajax_nonce' => wp_create_nonce('fvm_logs_nonce')
     244        ));
    234245       
    235246        # css
    … …  
    298309# function to list all cache files on the status page (js ajax code)
    299310function fvm_get_logs_callback() {
    300        
     311
     312    # Verify nonce for CSRF protection
     313    check_ajax_referer('fvm_logs_nonce', 'nonce');
     314
    301315    # must be able to cleanup cache
    302316    if (!current_user_can('manage_options')) {
    303         wp_die( __('You do not have sufficient permissions to access this page.'), __('Error:'), array('response'=>200)); 
     317        wp_die( __('You do not have sufficient permissions to access this page.'), __('Error:'), array('response'=>200));
    304318    }
    305319   
    … …  
    391405   
    392406    # test if at least one table exists
    393     if (!$wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $sqla_table_name)) === $sqla_table_name) {
    394        
     407    if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $sqla_table_name)) !== $sqla_table_name) {
     408
    395409        # log
    396410        $err = 'An error occurred when trying to create the database tables';

  • fast-velocity-minify/trunk/inc/common.php

    r3372990 r3383015  
    16071607# functions, get full url
    16081608function fvm_normalize_url($href, $purl=null) {
    1609    
     1609
    16101610    # preserve empty source handles
    1611     $href = trim($href);
    1612     if(empty($href)) { return false; }     
     1611    $href = trim($href);
     1612    if(empty($href)) { return false; }
     1613
     1614    # Detect and block path traversal attempts
     1615    if (strpos($href, '../') !== false || strpos($href, '..\\') !== false) {
     1616        error_log('FVM Security: Path traversal attempt blocked in URL: ' . $href);
     1617        return false;
     1618    }
    16131619
    16141620    # some fixes
    … …  
    21822188# try to open the file from the disk, before downloading
    21832189function fvm_maybe_download($url) {
    2184    
     2190
    21852191    # must have
    21862192    if(is_null($url) || empty($url)) { return false; }
    2187    
     2193
     2194    # Validate URL format and protocol
     2195    $parsed = parse_url($url);
     2196    if (!$parsed || !isset($parsed['scheme']) || !isset($parsed['host'])) {
     2197        return array('error' => 'Invalid URL format');
     2198    }
     2199
     2200    # Only allow http and https protocols (prevent file://, ftp://, etc.)
     2201    if (!in_array(strtolower($parsed['scheme']), array('http', 'https'))) {
     2202        return array('error' => 'Only HTTP and HTTPS protocols are allowed');
     2203    }
     2204
     2205    # Block internal/private IP ranges to prevent SSRF
     2206    $ip = gethostbyname($parsed['host']);
     2207    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
     2208        return array('error' => 'Access to private/internal IPs is not allowed');
     2209    }
     2210
    21882211    # get domain
    21892212    global $fvm_urls;
    … …  
    21942217        # file path + windows compatibility
    21952218        $f =  strtok(str_replace('/', DIRECTORY_SEPARATOR, str_replace(rtrim($fvm_urls['wp_site_url'], '/'), rtrim(ABSPATH, '/'), $url)), '?');
    2196                    
    2197         # did it work?
     2219
     2220        # did it work? - with path traversal protection
    21982221        if (file_exists($f) && is_file($f)) {
     2222
     2223            # Validate file path to prevent directory traversal attacks
     2224            $realfile = realpath($f);
     2225            $realbase = realpath(ABSPATH);
     2226
     2227            # Verify file is within WordPress installation
     2228            if ($realfile === false || $realbase === false || strpos($realfile, $realbase) !== 0) {
     2229                return array('error' => 'Invalid file path - outside allowed directory');
     2230            }
     2231
     2232            # Block sensitive files
     2233            $basename = basename($realfile);
     2234            $blocked_files = array('wp-config.php', '.htaccess', '.env', 'php.ini', '.user.ini');
     2235            if (in_array(strtolower($basename), $blocked_files)) {
     2236                return array('error' => 'Access to this file is not allowed');
     2237            }
     2238
    21992239            return array('content'=>file_get_contents($f), 'src'=>'Disk');
    22002240        }
    … …  
    22062246    $uagent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586';
    22072247
    2208     # fetch via wordpress functions
    2209     $response = wp_remote_get($url, array('user-agent'=>$uagent, 'timeout' => 7, 'httpversion' => '1.1', 'sslverify'=>false));
     2248    # fetch via wordpress functions (SSL verification enabled by default for security)
     2249    $response = wp_remote_get($url, array('user-agent'=>$uagent, 'timeout' => 7, 'httpversion' => '1.1'));
    22102250    if ( is_wp_error( $response ) ) {
    22112251        $error_message = $response->get_error_message();

  • fast-velocity-minify/trunk/layout/admin-layout-settings.php

    r2669786 r3383015  
    150150<td><fieldset>
    151151<label for="fvm_settings_css_ignore"><span class="fvm-bold-green fvm-rowintro"><?php _e( "Ignore the following CSS URL's", 'fast-velocity-minify' ); ?></span></label>
    152 <p><textarea name="fvm_settings[css][ignore]" rows="7" cols="50" id="fvm_settings_css_ignore" class="large-text code" placeholder="ex: /plugins/something/assets/problem.css"><?php echo fvm_get_settings_value($fvm_settings, 'css', 'ignore'); ?></textarea></p>
     152<p><textarea name="fvm_settings[css][ignore]" rows="7" cols="50" id="fvm_settings_css_ignore" class="large-text code" placeholder="ex: /plugins/something/assets/problem.css"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'css', 'ignore')); ?></textarea></p>
    153153<p class="description">[ <?php _e( 'CSS files are merged and grouped automatically by mediatype, hence you have an option to exclude files.', 'fast-velocity-minify' ); ?> ]</p>
    154154<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the <code>href attribute</code> on the <code>link tag</code>', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    160160<td><fieldset>
    161161<label for="fvm_settings_css_remove"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Remove the following CSS files', 'fast-velocity-minify' ); ?></span></label>
    162 <p><textarea name="fvm_settings[css][remove]" rows="7" cols="50" id="fvm_settings_css_remove" class="large-text code" placeholder="ex: fonts.googleapis.com"><?php echo fvm_get_settings_value($fvm_settings, 'css', 'remove'); ?></textarea></p>
     162<p><textarea name="fvm_settings[css][remove]" rows="7" cols="50" id="fvm_settings_css_remove" class="large-text code" placeholder="ex: fonts.googleapis.com"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'css', 'remove')); ?></textarea></p>
    163163<p class="description">[ <?php _e( 'This will allow you to remove unwanted CSS files by URI path from the frontend', 'fast-velocity-minify' ); ?> ]</p>
    164164<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the <code>href attribute</code> on the <code>link tag</code>', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    170170<td><fieldset>
    171171<label for="fvm_settings_css_async"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Async the following CSS files', 'fast-velocity-minify' ); ?></span></label>
    172 <p><textarea name="fvm_settings[css][async]" rows="7" cols="50" id="fvm_settings_css_async" class="large-text code" placeholder="ex: /plugins/something/assets/low-priority.css"><?php echo fvm_get_settings_value($fvm_settings, 'css', 'async'); ?></textarea></p>
     172<p><textarea name="fvm_settings[css][async]" rows="7" cols="50" id="fvm_settings_css_async" class="large-text code" placeholder="ex: /plugins/something/assets/low-priority.css"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'css', 'async')); ?></textarea></p>
    173173<p class="description">[ <?php _e( 'This will allow you to Async CSS files by URI path from the frontend', 'fast-velocity-minify' ); ?> ]</p>
    174174<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the <code>href attribute</code> on the <code>link tag</code>', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    239239<td><fieldset>
    240240<label for="fvm_settings_js_ignore"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Will prevent merging or minification for all JS files matching the paths below', 'fast-velocity-minify' ); ?></span></label>
    241 <p><textarea name="fvm_settings[js][ignore]" rows="7" cols="50" id="fvm_settings_js_ignore" class="large-text code" placeholder="<?php _e( '--- ex: /plugins/something/assets/problem.js ---', 'fast-velocity-minify' ); ?>"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'ignore'); ?></textarea></p>
     241<p><textarea name="fvm_settings[js][ignore]" rows="7" cols="50" id="fvm_settings_js_ignore" class="large-text code" placeholder="<?php _e( '--- ex: /plugins/something/assets/problem.js ---', 'fast-velocity-minify' ); ?>"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'ignore')); ?></textarea></p>
    242242<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the script <code>src</code> attribute', 'fast-velocity-minify' ); ?> ]</p>
    243243<p class="description">[ <?php _e( 'It is highly recommended to try to leave this empty and later be more specific on what to merge', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    249249<td><fieldset>
    250250<label for="fvm_settings_merge_header"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'This will render block all JS files matching the paths below', 'fast-velocity-minify' ); ?></span></label>
    251 <p><textarea name="fvm_settings[js][merge_header]" rows="7" cols="50" id="fvm_settings_js_merge_header" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?> 
    252 /jquery-migrate.js 
    253 /jquery.js 
    254 /jquery.min.js"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'merge_header'); ?></textarea></p>
     251<p><textarea name="fvm_settings[js][merge_header]" rows="7" cols="50" id="fvm_settings_js_merge_header" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?>
     252/jquery-migrate.js
     253/jquery.js
     254/jquery.min.js"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'merge_header')); ?></textarea></p>
    255255<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the script <code>src attribute</code>', 'fast-velocity-minify' ); ?> ]</p>
    256256</fieldset></td>
    … …  
    261261<td><fieldset>
    262262<label for="fvm_settings_merge_defer"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'This will defer all JS files matching the paths below', 'fast-velocity-minify' ); ?></span></label>
    263 <p><textarea name="fvm_settings[js][merge_defer]" rows="7" cols="50" id="fvm_settings_js_merge_defer" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?> 
    264 /wp-admin/ 
    265 /wp-includes/ 
    266 /wp-content/"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'merge_defer'); ?></textarea></p>
     263<p><textarea name="fvm_settings[js][merge_defer]" rows="7" cols="50" id="fvm_settings_js_merge_defer" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?>
     264/wp-admin/
     265/wp-includes/
     266/wp-content/"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'merge_defer')); ?></textarea></p>
    267267<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the script <code>src attribute', 'fast-velocity-minify' ); ?></code> ]</p>
    268268</fieldset></td>
    … …  
    273273<td><fieldset>
    274274<label for="fvm_settings_defer_dependencies"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Preserve the order of scripts execution when deferring JS files dependencies', 'fast-velocity-minify' ); ?></span></label>
    275 <p><textarea name="fvm_settings[js][defer_dependencies]" rows="7" cols="50" id="fvm_settings_js_defer_dependencies" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?> 
     275<p><textarea name="fvm_settings[js][defer_dependencies]" rows="7" cols="50" id="fvm_settings_js_defer_dependencies" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?>
    276276wp.i18n
    277277wp.apiFetch.use
    278278window.lodash
    279279wp.hooks
    280 wp.url"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'defer_dependencies'); ?></textarea></p>
     280wp.url"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'defer_dependencies')); ?></textarea></p>
    281281<p class="description">[ <?php _e( 'Inline JavaScript matching these rules, will be deferred with script type module', 'fast-velocity-minify' ); ?> ]</p>
    282282<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the script <code>innerHTML</code>', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    288288<td><fieldset>
    289289<label for="fvm_settings_js_thirdparty"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Delay JS files or inline scripts until user interaction', 'fast-velocity-minify' ); ?></span></label>
    290 <p><textarea name="fvm_settings[js][thirdparty]" rows="7" cols="50" id="fvm_settings_js_thirdparty" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?> 
    291 function(w,d,s,l,i) 
     290<p><textarea name="fvm_settings[js][thirdparty]" rows="7" cols="50" id="fvm_settings_js_thirdparty" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?>
     291function(w,d,s,l,i)
    292292function(f,b,e,v,n,t,s)
    293293function(h,o,t,j,a,r)
    294 www.googletagmanager.com/gtm.js"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'thirdparty'); ?></textarea></p>
     294www.googletagmanager.com/gtm.js"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'thirdparty')); ?></textarea></p>
    295295<p class="description">[ <?php _e( 'Used interaction events: mouseover, keydown, touchstart, touchmove and wheel', 'fast-velocity-minify' ); ?> ]</p>
    296296<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the inline script <code>innerHTML</code> or <code>src</code> attribute for JS files', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    302302<td><fieldset>
    303303<label for="fvm_settings_js_remove"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Remove the following JS files or Inline Scripts', 'fast-velocity-minify' ); ?></span></label>
    304 <p><textarea name="fvm_settings[js][remove]" rows="7" cols="50" id="fvm_settings_js_remove" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?> 
    305 /some/duplicate/file.js"><?php echo fvm_get_settings_value($fvm_settings, 'js', 'remove'); ?></textarea></p>
     304<p><textarea name="fvm_settings[js][remove]" rows="7" cols="50" id="fvm_settings_js_remove" class="large-text code" placeholder="<?php _e( '--- example ---', 'fast-velocity-minify' ); ?>
     305/some/duplicate/file.js"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'js', 'remove')); ?></textarea></p>
    306306<p class="description">[ <?php _e( 'This will allow you to remove unwanted script tags from the frontend', 'fast-velocity-minify' ); ?> ]</p>
    307307<p class="description">[ <?php _e( 'Will match using <code>PHP stripos</code> against the script <code>outerHTML</code>', 'fast-velocity-minify' ); ?> ]</p>
    … …  
    347347<td><fieldset>
    348348<label for="fvm_settings_cdn_domain">
    349 <p><input type="text" name="fvm_settings[cdn][domain]" id="fvm_settings_cdn_domain" value="<?php echo fvm_get_settings_value($fvm_settings, 'cdn', 'domain'); ?>" size="80" /></p>
     349<p><input type="text" name="fvm_settings[cdn][domain]" id="fvm_settings_cdn_domain" value="<?php echo esc_attr(fvm_get_settings_value($fvm_settings, 'cdn', 'domain')); ?>" size="80" /></p>
    350350<p class="description">[ <?php _e( 'You can ignore this if your CDN url matches your domain name (ie: Cloudflare)', 'fast-velocity-minify' ); ?> ]</p>
    351351</label>
    … …  
    357357<td><fieldset>
    358358<label for="fvm_settings_cdn_integration"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'Missing HTML elements to replace', 'fast-velocity-minify' ); ?></span></label>
    359 <p><textarea name="fvm_settings[cdn][integration]" rows="7" cols="50" id="fvm_settings_cdn_integration" class="large-text code" placeholder="--- check the help section for suggestions ---"><?php echo fvm_get_settings_value($fvm_settings, 'cdn', 'integration'); ?></textarea></p>
     359<p><textarea name="fvm_settings[cdn][integration]" rows="7" cols="50" id="fvm_settings_cdn_integration" class="large-text code" placeholder="--- check the help section for suggestions ---"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'cdn', 'integration')); ?></textarea></p>
    360360<p class="description">[ <?php _e( 'Additional replacement rules with syntax from <code>https://simplehtmldom.sourceforge.io/manual.htm</code>', 'fast-velocity-minify' ); ?> ]</p>
    361361</fieldset></td>
    … …  
    373373<td><fieldset>
    374374<label for="fvm_settings_settings_qs"><span class="fvm-bold-green fvm-rowintro"><?php _e( 'One query string key per line', 'fast-velocity-minify' ); ?></span></label>
    375 <p><textarea name="fvm_settings[settings][qs]" rows="7" cols="50" id="fvm_settings_settings_qs" class="large-text code" placeholder="--- check the help section for suggestions ---"><?php echo fvm_get_settings_value($fvm_settings, 'settings', 'qs'); ?></textarea></p>
     375<p><textarea name="fvm_settings[settings][qs]" rows="7" cols="50" id="fvm_settings_settings_qs" class="large-text code" placeholder="--- check the help section for suggestions ---"><?php echo esc_textarea(fvm_get_settings_value($fvm_settings, 'settings', 'qs')); ?></textarea></p>
    376376<p class="description">[ <?php _e( 'Additional query strings, keys only', 'fast-velocity-minify' ); ?> ]</p>
    377377</fieldset></td>

  • fast-velocity-minify/trunk/readme.txt

    r3382716 r3383015  
    44Requires at least: 5.6
    55Requires PHP: 7.2
    6 Stable tag: 3.5.1
     6Stable tag: 3.5.2
    77Tested up to: 6.8.3
    88Text Domain: fast-velocity-minify
    … …  
    4949
    5050== Changelog ==
     51
     52= 3.5.2 [2025.10.22] =
     53* **SECURITY**: Fixed Stored XSS vulnerability in CDN domain input validation (CVE-2025-12034)
     54* **SECURITY**: Fixed Path Traversal vulnerability allowing arbitrary local file disclosure
     55* **SECURITY**: Enabled TLS certificate verification for external resource downloads
     56* **SECURITY**: Added AJAX nonce validation for log retrieval endpoint (CSRF protection)
     57* **SECURITY**: Added URL protocol whitelist and SSRF prevention for external requests
     58* **SECURITY**: Added sensitive file protection blocking access to wp-config.php, .htaccess, .env files
     59* **SECURITY**: Added output escaping for all admin textarea fields
     60* Fixed transient checker operator precedence bug causing unnecessary database checks
     61* Fixed AJAX nonce implementation to properly pass security token from JavaScript
    5162
    5263= 3.5.1 [2025.10.22] =
Note: See TracChangeset for help on using the changeset viewer.