WordPress.org
Get WordPress

Plugin Directory

Changeset 3385033


Ignore:
Timestamp:
10/27/2025 08:22:24 AM (3 months ago)
Author:
amirition
Message:

Update to version 1.1.7 from GitHub

Location:
document-library-lite
Files:
16 edited
1 copied

Legend:

Unmodified
Added
Removed

  • document-library-lite/tags/1.1.7/changelog.txt

    r3375233 r3385033  
     1= 1.1.7 =
     2Release date 27 October 2025
     3
     4* Dev: Updated internal libraries
     5* Fix: Enhanced security for AJAX requests and adjusted post status handling
     6
    17= 1.1.6 =
    28Release date 08 October 2025

  • document-library-lite/tags/1.1.7/document-library-lite.php

    r3375233 r3385033  
    1212 * Plugin URI:      https://barn2.com/kb-categories/document-library-free-kb/
    1313 * Description:     Add documents and display them in a searchable document library.
    14  * Version:         1.1.6
     14 * Version:         1.1.7
    1515 * Author:          Barn2 Plugins
    1616 * Author URI:      https://barn2.com
    … …  
    3333}
    3434
    35 const PLUGIN_VERSION = '1.1.6';
     35const PLUGIN_VERSION = '1.1.7';
    3636const PLUGIN_FILE    = __FILE__;
    3737

  • document-library-lite/tags/1.1.7/readme.txt

    r3375233 r3385033  
    66Tested up to: 6.8
    77Requires PHP: 7.4
    8 Stable tag: 1.1.6
     8Stable tag: 1.1.7
    99License: GPL-3.0
    1010License URI: https://www.gnu.org/licenses/gpl.html
    … …  
    206206== Changelog ==
    207207
    208 = 1.1.6 =
    209 Release date 08 October 2025
     208= 1.1.7 =
     209Release date 27 October 2025
    210210
    211211* Dev: Updated internal libraries
    212 * Fix: Lazy loading did not working in block themes
     212* Fix: Enhanced security for AJAX requests and adjusted post status handling
    213213
    214214See changelog.txt for more details.

  • document-library-lite/tags/1.1.7/src/Document_Library_Shortcode.php

    r3375233 r3385033  
    6262            self::$script_params = [
    6363                'ajax_url'    => admin_url( 'admin-ajax.php' ),
    64                 'ajax_nonce'  => 'document-library',
     64                'ajax_nonce'  => wp_create_nonce( 'dll_load_posts' ),
    6565                'ajax_action' => 'dll_load_posts',
    6666                'lazy_load'   => $table->args['lazy_load'],

  • document-library-lite/tags/1.1.7/src/Frontend_Scripts.php

    r3375233 r3385033  
    7575
    7676        $script_params = [
     77            'ajax_nonce' => wp_create_nonce( 'dll_load_posts' ),
    7778            'language' => apply_filters(
    7879                'document_library_lite_language_defaults',

  • document-library-lite/tags/1.1.7/src/Simple_Document_Library.php

    r3281091 r3385033  
    493493        $valid_post_statuses = [ 'publish', 'pending', 'draft', 'future', 'any' ];
    494494        $args[ 'status' ] = in_array( $args['status'], $valid_post_statuses ) ? $args[ 'status' ] : 'publish';
    495        
     495           
    496496        return $args;
    497497    }

  • document-library-lite/tags/1.1.7/src/Table/Ajax_Handler.php

    r3157590 r3385033  
    2424        add_action( 'wp_ajax_dll_load_posts', [ $this, 'load_posts' ] );
    2525        add_action( 'wp_ajax_nopriv_dll_load_posts', [ $this, 'load_posts' ] );
    26 
    2726    }
    2827   
    … …  
    3130
    3231    public function load_posts() {
    33         $args = Options::handle_shortcode_attribute_aliases( $_POST[ 'args' ] );
     32        // Parse and sanitize incoming args
     33        $args = isset( $_POST['args'] ) ? Options::handle_shortcode_attribute_aliases( wp_unslash( $_POST['args'] ) ) : [];
    3434        $args = shortcode_atts( Options::get_defaults(), $args, self::SHORTCODE );
     35
     36        $requested_status = isset( $args['status'] ) ? $args['status'] : 'publish';
     37        $is_logged_in = is_user_logged_in();
     38
     39        // Unauthenticated users can ONLY see published content
     40        if ( ! $is_logged_in ) {
     41            $args['status'] = 'publish';
     42        }
     43        // Authenticated users requesting non-published content must provide nonce and capability
     44        elseif ( $requested_status !== 'publish' ) {
     45            $nonce = '';
     46            if ( isset( $_POST['_ajax_nonce'] ) ) {
     47                $nonce = sanitize_text_field( wp_unslash( $_POST['_ajax_nonce'] ) );
     48            } elseif ( isset( $_POST['ajax_nonce'] ) ) {
     49                $nonce = sanitize_text_field( wp_unslash( $_POST['ajax_nonce'] ) );
     50            }
     51
     52            if ( ! $nonce || ! wp_verify_nonce( $nonce, 'dll_load_posts' ) ) {
     53                wp_send_json_error( [ 'message' => 'Security check failed' ], 403 );
     54            }
     55
     56            if ( ! current_user_can( 'edit_posts' ) ) {
     57                wp_send_json_error( [ 'message' => 'Insufficient permissions' ], 403 );
     58            }
     59        }
    3560
    3661        $table = new simple_Document_Library( $args );
    … …  
    3863
    3964        // Return the response as JSON
    40         wp_send_json($response);   
     65        wp_send_json( $response );
    4166   
    4267    }

  • document-library-lite/tags/1.1.7/vendor/composer/installed.php

    r3375233 r3385033  
    44        'pretty_version' => 'dev-main',
    55        'version' => 'dev-main',
    6         'reference' => 'ff62aee7e34351f3d8a11bb4c94a40c6a0e8888c',
     6        'reference' => 'cb7ae2775014c7bbcb88edc0e119b09b8afd891d',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    1414            'pretty_version' => 'dev-main',
    1515            'version' => 'dev-main',
    16             'reference' => 'ff62aee7e34351f3d8a11bb4c94a40c6a0e8888c',
     16            'reference' => 'cb7ae2775014c7bbcb88edc0e119b09b8afd891d',
    1717            'type' => 'wordpress-plugin',
    1818            'install_path' => __DIR__ . '/../../',

  • document-library-lite/trunk/changelog.txt

    r3375233 r3385033  
     1= 1.1.7 =
     2Release date 27 October 2025
     3
     4* Dev: Updated internal libraries
     5* Fix: Enhanced security for AJAX requests and adjusted post status handling
     6
    17= 1.1.6 =
    28Release date 08 October 2025

  • document-library-lite/trunk/document-library-lite.php

    r3375233 r3385033  
    1212 * Plugin URI:      https://barn2.com/kb-categories/document-library-free-kb/
    1313 * Description:     Add documents and display them in a searchable document library.
    14  * Version:         1.1.6
     14 * Version:         1.1.7
    1515 * Author:          Barn2 Plugins
    1616 * Author URI:      https://barn2.com
    … …  
    3333}
    3434
    35 const PLUGIN_VERSION = '1.1.6';
     35const PLUGIN_VERSION = '1.1.7';
    3636const PLUGIN_FILE    = __FILE__;
    3737

  • document-library-lite/trunk/readme.txt

    r3375233 r3385033  
    66Tested up to: 6.8
    77Requires PHP: 7.4
    8 Stable tag: 1.1.6
     8Stable tag: 1.1.7
    99License: GPL-3.0
    1010License URI: https://www.gnu.org/licenses/gpl.html
    … …  
    206206== Changelog ==
    207207
    208 = 1.1.6 =
    209 Release date 08 October 2025
     208= 1.1.7 =
     209Release date 27 October 2025
    210210
    211211* Dev: Updated internal libraries
    212 * Fix: Lazy loading did not working in block themes
     212* Fix: Enhanced security for AJAX requests and adjusted post status handling
    213213
    214214See changelog.txt for more details.

  • document-library-lite/trunk/src/Document_Library_Shortcode.php

    r3375233 r3385033  
    6262            self::$script_params = [
    6363                'ajax_url'    => admin_url( 'admin-ajax.php' ),
    64                 'ajax_nonce'  => 'document-library',
     64                'ajax_nonce'  => wp_create_nonce( 'dll_load_posts' ),
    6565                'ajax_action' => 'dll_load_posts',
    6666                'lazy_load'   => $table->args['lazy_load'],

  • document-library-lite/trunk/src/Frontend_Scripts.php

    r3375233 r3385033  
    7575
    7676        $script_params = [
     77            'ajax_nonce' => wp_create_nonce( 'dll_load_posts' ),
    7778            'language' => apply_filters(
    7879                'document_library_lite_language_defaults',

  • document-library-lite/trunk/src/Simple_Document_Library.php

    r3281091 r3385033  
    493493        $valid_post_statuses = [ 'publish', 'pending', 'draft', 'future', 'any' ];
    494494        $args[ 'status' ] = in_array( $args['status'], $valid_post_statuses ) ? $args[ 'status' ] : 'publish';
    495        
     495           
    496496        return $args;
    497497    }

  • document-library-lite/trunk/src/Table/Ajax_Handler.php

    r3157590 r3385033  
    2424        add_action( 'wp_ajax_dll_load_posts', [ $this, 'load_posts' ] );
    2525        add_action( 'wp_ajax_nopriv_dll_load_posts', [ $this, 'load_posts' ] );
    26 
    2726    }
    2827   
    … …  
    3130
    3231    public function load_posts() {
    33         $args = Options::handle_shortcode_attribute_aliases( $_POST[ 'args' ] );
     32        // Parse and sanitize incoming args
     33        $args = isset( $_POST['args'] ) ? Options::handle_shortcode_attribute_aliases( wp_unslash( $_POST['args'] ) ) : [];
    3434        $args = shortcode_atts( Options::get_defaults(), $args, self::SHORTCODE );
     35
     36        $requested_status = isset( $args['status'] ) ? $args['status'] : 'publish';
     37        $is_logged_in = is_user_logged_in();
     38
     39        // Unauthenticated users can ONLY see published content
     40        if ( ! $is_logged_in ) {
     41            $args['status'] = 'publish';
     42        }
     43        // Authenticated users requesting non-published content must provide nonce and capability
     44        elseif ( $requested_status !== 'publish' ) {
     45            $nonce = '';
     46            if ( isset( $_POST['_ajax_nonce'] ) ) {
     47                $nonce = sanitize_text_field( wp_unslash( $_POST['_ajax_nonce'] ) );
     48            } elseif ( isset( $_POST['ajax_nonce'] ) ) {
     49                $nonce = sanitize_text_field( wp_unslash( $_POST['ajax_nonce'] ) );
     50            }
     51
     52            if ( ! $nonce || ! wp_verify_nonce( $nonce, 'dll_load_posts' ) ) {
     53                wp_send_json_error( [ 'message' => 'Security check failed' ], 403 );
     54            }
     55
     56            if ( ! current_user_can( 'edit_posts' ) ) {
     57                wp_send_json_error( [ 'message' => 'Insufficient permissions' ], 403 );
     58            }
     59        }
    3560
    3661        $table = new simple_Document_Library( $args );
    … …  
    3863
    3964        // Return the response as JSON
    40         wp_send_json($response);   
     65        wp_send_json( $response );
    4166   
    4267    }

  • document-library-lite/trunk/vendor/composer/installed.php

    r3375233 r3385033  
    44        'pretty_version' => 'dev-main',
    55        'version' => 'dev-main',
    6         'reference' => 'ff62aee7e34351f3d8a11bb4c94a40c6a0e8888c',
     6        'reference' => 'cb7ae2775014c7bbcb88edc0e119b09b8afd891d',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    1414            'pretty_version' => 'dev-main',
    1515            'version' => 'dev-main',
    16             'reference' => 'ff62aee7e34351f3d8a11bb4c94a40c6a0e8888c',
     16            'reference' => 'cb7ae2775014c7bbcb88edc0e119b09b8afd891d',
    1717            'type' => 'wordpress-plugin',
    1818            'install_path' => __DIR__ . '/../../',
Note: See TracChangeset for help on using the changeset viewer.