WordPress.org
Get WordPress

Plugin Directory

Changeset 3470054


Ignore:
Timestamp:
02/26/2026 09:11:54 AM (4 weeks ago)
Author:
bitpressadmin
Message:

Update to version 1.13.1 from GitHub

Location:
bit-social
Files:
218 added
218 deleted
26 edited
1 copied

Legend:

Unmodified
Added
Removed

  • bit-social/tags/1.13.1/assets/build-code-name.txt

    r3464211 r3470054  
    1 better-trees-lie
     1smooth-mugs-decide

  • bit-social/tags/1.13.1/backend/app/Config.php

    r3464211 r3470054  
    2222    public const VAR_PREFIX = 'bit_social_';
    2323
    24     public const VERSION = '1.13.0';
     24    public const VERSION = '1.13.1';
    2525
    2626    public const DB_VERSION = '1.1.0';
    … …  
    104104                }
    105105                if (self::isProActivated()) {
    106                     return file_get_contents(ProConfig::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt');
     106                    $proBuildCodeNameFile = ProConfig::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt';
     107
     108                    return file_exists($proBuildCodeNameFile) ? trim((string) file_get_contents($proBuildCodeNameFile)) : '';
    107109                }
    108110
    109                 return file_get_contents(self::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt');
     111                $freeBuildCodeNameFile = self::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt';
     112
     113                return file_exists($freeBuildCodeNameFile) ? trim((string) file_get_contents($freeBuildCodeNameFile)) : '';
    110114
    111115            case 'WP_DB_PREFIX':

  • bit-social/tags/1.13.1/backend/app/HTTP/Controllers/AutoPostController.php

    r3464211 r3470054  
    9393            'timeout'   => 0.1,
    9494            'blocking'  => false,
    95             'cookies'   => $_COOKIE,
     95            'cookies'   => $this->sanitizeRequestCookies(),
    9696            'sslverify' => apply_filters('https_local_ssl_verify', false), // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a WordPress core filter.
    9797        ];
    … …  
    109109    public function executeSocialPost($postId = null)
    110110    {
    111         // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce is verified by the REST API/AJAX handler before this method is called.
    112         if (isset($_REQUEST['post_id'])) {
    113             // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Nonce verified upstream; post_id is numeric and sanitized immediately.
    114             $postId = sanitize_text_field($_REQUEST['post_id']);
     111        $isAjaxRequest = wp_doing_ajax();
     112
     113        if ($isAjaxRequest) {
     114            check_ajax_referer(Config::withPrefix('nonce'));
     115
     116            if (!current_user_can('edit_posts')) {
     117                wp_send_json_error(['message' => 'Insufficient permission.'], 403);
     118            }
     119        }
     120
     121        if (null === $postId && $isAjaxRequest) {
     122            // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is validated at the start of this method.
     123            $postId = isset($_POST['post_id']) ? absint(wp_unslash($_POST['post_id'])) : 0;
     124        }
     125
     126        $postId = absint($postId);
     127
     128        if (0 === $postId) {
     129            if ($isAjaxRequest) {
     130                wp_send_json_error(['message' => 'Invalid post ID.'], 400);
     131            }
     132
     133            return;
     134        }
     135
     136        if ($isAjaxRequest && !current_user_can('edit_post', $postId)) {
     137            if ($isAjaxRequest) {
     138                wp_send_json_error(['message' => 'You are not allowed to access this post.'], 403);
     139            }
     140
     141            return;
     142        }
     143
     144        if (!get_post($postId)) {
     145            if ($isAjaxRequest) {
     146                wp_send_json_error(['message' => 'Post not found.'], 404);
     147            }
     148
     149            return;
    115150        }
    116151
    … …  
    127162
    128163        $allAccountIds = array_unique([...$accountIds, ...$groupAccountIds]);
     164        $accounts = [];
    129165
    130166        if (!empty($allAccountIds)) {
    … …  
    174210
    175211        Hooks::doAction(Config::withPrefix('all_platforms_post_publish'), $publishPostData);
     212
     213        if ($isAjaxRequest) {
     214            wp_send_json_success($publishPostData);
     215        }
    176216    }
    177217
    … …  
    204244        return $diff;
    205245    }
     246
     247    private function sanitizeRequestCookies(): array
     248    {
     249        $cookies = [];
     250
     251        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Cookies are only proxied to preserve the current authenticated AJAX session.
     252        foreach ((array) $_COOKIE as $cookieKey => $cookieValue) {
     253            if (!\is_scalar($cookieValue)) {
     254                continue;
     255            }
     256
     257            $cookies[sanitize_key((string) $cookieKey)] = sanitize_text_field(wp_unslash((string) $cookieValue));
     258        }
     259
     260        return $cookies;
     261    }
    206262}

  • bit-social/tags/1.13.1/backend/app/HTTP/Controllers/ShareNowController.php

    r3464211 r3470054  
    180180    }
    181181
    182     public function uploadFile(Request $request)
    183     {
    184         $requestFiles = $request->files();
    185 
    186         if ($requestFiles) {
    187             $files = [];
    188             $fileArray = $requestFiles['file'];
    189 
    190             foreach ($fileArray['name'] as $index => $name) {
    191                 $files[] = [
    192                     'name'     => $name,
    193                     'type'     => $fileArray['type'][$index],
    194                     'tmp_name' => $fileArray['tmp_name'][$index],
    195                     'error'    => $fileArray['error'][$index],
    196                     'size'     => $fileArray['size'][$index]
    197                 ];
    198             }
    199 
    200             foreach ($files as $file) {
    201                 $upload_dir = wp_upload_dir();
    202                 $uuid = wp_generate_uuid4();
    203                 $file_name = $file['name'];
    204                 $filename_without_ext = pathinfo($file_name, PATHINFO_FILENAME);
    205                 $file_path = $upload_dir['path'] . '/' . $uuid . '-' . $file_name;
    206 
    207                 // phpcs:ignore Generic.PHP.ForbiddenFunctions.Found -- move_uploaded_file is required here as wp_handle_upload expects $_FILES structure which is not available in this context.
    208                 if (move_uploaded_file($file['tmp_name'], $file_path)) {
    209                     // Create an attachment post
    210                     $attachmentData = [
    211                         'post_mime_type' => $file['type'],
    212                         'post_title'     => sanitize_file_name($filename_without_ext),
    213                         'post_content'   => '',
    214                         'post_status'    => 'inherit'
    215                     ];
    216                     $attachment_id = wp_insert_attachment($attachmentData, $file_path);
    217                     $attachment_data = wp_generate_attachment_metadata($attachment_id, $file_path);
    218                     wp_update_attachment_metadata($attachment_id, $attachment_data);
    219                 }
    220             }
    221         }
    222 
    223         return Response::success([]);
    224     }
    225 
    226182    public function getAllMedia()
    227183    {

  • bit-social/tags/1.13.1/backend/app/HTTP/Middleware/NonceCheckerMiddleware.php

    r3114392 r3470054  
    1111    public function handle(Request $request)
    1212    {
    13         if (!$request->has('_ajax_nonce') || !wp_verify_nonce(sanitize_key($request->_ajax_nonce), Config::withPrefix('nonce'))) {
    14             return Response::error('Invalid token')->httpStatus(411);
     13        if (!$request->has('_ajax_nonce')) {
     14            return Response::error('Invalid token')->httpStatus(403);
     15        }
     16
     17        $nonce = $request->_ajax_nonce;
     18
     19        if (!\is_scalar($nonce)) {
     20            return Response::error('Invalid token')->httpStatus(403);
     21        }
     22
     23        $nonce = sanitize_text_field(wp_unslash((string) $nonce));
     24
     25        if (empty($nonce) || !wp_verify_nonce($nonce, Config::withPrefix('nonce'))) {
     26            return Response::error('Invalid token')->httpStatus(403);
    1527        }
    1628

  • bit-social/tags/1.13.1/backend/app/Providers/HookProvider.php

    r3169366 r3470054  
    6565            RequestType::is(RequestType::AJAX)
    6666            && is_readable($this->_pluginBackend . 'routes' . DIRECTORY_SEPARATOR . 'ajax.php')
    67             && current_user_can('administrator')
     67            && current_user_can('manage_options')
    6868        ) {
    6969            $router = new Router(RequestType::AJAX, Config::VAR_PREFIX, '');

  • bit-social/tags/1.13.1/backend/bootstrap.php

    r3114392 r3470054  
    55if (! defined('ABSPATH')) {
    66    exit;
     7}
     8
     9if (!file_exists(__DIR__ . '/../vendor/autoload.php')) {
     10    add_action('admin_notices', static function () {
     11        $message = sprintf(
     12            // translators: %s: composer command
     13            __('Vendor dependencies are missing. Please run %s in the plugin directory.', 'bit-social'),
     14            '<code>composer install</code>'
     15        );
     16
     17        echo '<div class="notice notice-error"><p><strong>'
     18            . esc_html__('Bit Social:', 'bit-social')
     19            . '</strong> '
     20            . wp_kses($message, ['code' => []])
     21            . '</p></div>';
     22    });
     23
     24    return;
    725}
    826

  • bit-social/tags/1.13.1/backend/routes/ajax.php

    r3437531 r3470054  
    6363
    6464        Route::get('smart-tags', [ScheduleController::class, 'getSmartTags']);
    65 
    66         Route::post('upload-files', [ShareNowController::class, 'uploadFile']);
    6765        Route::get('all-media', [ShareNowController::class, 'getAllMedia']);
    6866        Route::post('share-now', [ShareNowController::class, 'store']);

  • bit-social/tags/1.13.1/bit-social.php

    r3464211 r3470054  
    99 * Plugin URI:  https://bitapps.pro/bit-social
    1010 * Description: Blog to Social Media Auto Post Scheduler and Publisher
    11  * Version:     1.13.0
     11 * Version:     1.13.1
    1212 * Author:      Bit Social Auto Poster & Scheduler - by Bit Apps
    1313 * Author URI:  https://bitapps.pro

  • bit-social/tags/1.13.1/languages/bit-social.pot

    r3464211 r3470054  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Bit Social 1.13.0\n"
     5"Project-Id-Version: Bit Social 1.13.1\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/bit-social\n"
    77"Last-Translator: Bit Apps <[email protected]>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2026-02-18T10:30:43+00:00\n"
     12"POT-Creation-Date: 2026-02-26T09:07:44+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    107107#: backend/app/Views/SideBarMenu.php:120
    108108msgid "License & Support"
     109msgstr ""
     110
     111#. translators: %s: composer command
     112#: backend/bootstrap.php:13
     113#: pro/backend/bootstrap.php:11
     114#, php-format
     115msgid "Vendor dependencies are missing. Please run %s in the plugin directory."
     116msgstr ""
     117
     118#: backend/bootstrap.php:18
     119msgid "Bit Social:"
    109120msgstr ""
    110121
    … …  
    21052116msgid "Bit Social License is expired"
    21062117msgstr ""
     2118
     2119#: pro/backend/bootstrap.php:16
     2120msgid "Bit Social Pro:"
     2121msgstr ""

  • bit-social/tags/1.13.1/languages/frontend.pot

    r3464211 r3470054  
    22msgstr ""
    33"Content-Type: text/plain; charset=utf-8\n"
    4 "POT-Creation-Date: Wed Feb 18 2026 10:30:43 GMT+0000 (Coordinated Universal "
     4"POT-Creation-Date: Thu Feb 26 2026 09:07:43 GMT+0000 (Coordinated Universal "
    55"Time)\n"
    66"Content-Transfer-Encoding: 8bit\n"

  • bit-social/tags/1.13.1/readme.txt

    r3464211 r3470054  
    66Tested up to: 6.9
    77Requires PHP: 7.4
    8 Stable tag: 1.13.0
     8Stable tag: 1.13.1
    99License: GPLv2 or later
    1010
    … …  
    2222
    2323 With Bit Social, you can **schedule posts, auto publish & auto share** for each platform, saving time and ensuring a consistent online presence. With a minimum click auto-post, schedule, and recycle your blog content from WordPress posts. Whether it's a new post or recycling old content, Bit Social integrates with all the social sharing platforms for sharing on Facebook, Twitter, LinkedIn, Google Business Profile, Tumblr, Discord & Pinterest!
     24
     25**Useful Links**
     26🚀[Try Full Version Demo](https://towp.io/) | 🚀[Documentation](https://bit-social.com/documentation) | 🚀[Video Tutorials](https://www.youtube.com/playlist?list=PL7c6CDwwm-ALFAjnM5ZPuId8qcGqPBDvK) | 🚀[Support](https://tawk.to/chat/60eac4b6d6e7610a49aab375/1faah0r3e) | 🚀[Facebook Group](https://www.facebook.com/groups/3308027439209387) | 🚀[Upgrade to Pro](https://bit-social.com/) |
     27
     28The entire source code is [available on GitHub](https://github.com/Bit-Apps-Pro/bit-social-lite).
    2429
    2530
    … …  
    4449
    4550== Automate and Schedule WordPress Posts with Bit Social - The Ultimate WordPress Auto-Poster ==
    46 
    47 
    48 
    49  🚀 [Documentation](https://bit-social.com/documentation/) |  🚀 [Premium](https://bit-social.com/pricing/) |  🚀 [Support](https://bit-social.com/contact/) |  🚀 [Facebook Community](https://www.facebook.com/groups/bitapps) |  🚀 [YouTube Channel](https://www.youtube.com/@bit-apps)
    5051
    5152## 🔥 Social Media Platforms 🔥
    … …  
    154155## FAQ
    155156
     157
     158== External Services ==
     159
     160= LinkedIn API (`api.linkedin.com`, `linkedin.com`) =
     161
     162- **What it does:** Connects a LinkedIn account and publishes posts to LinkedIn from WordPress.
     163- **What data is sent:** Access tokens, account identifiers, and post payload data (text, links, media URLs, and metadata required by LinkedIn endpoints).
     164- **When data is sent:** When an administrator connects/reconnects a LinkedIn account and when a post is published or scheduled to LinkedIn.
     165- **Why it is required:** LinkedIn publishing and account authorization cannot work without LinkedIn APIs.
     166- **Terms of Service:** https://www.linkedin.com/legal/user-agreement
     167- **Privacy Policy:** https://www.linkedin.com/legal/privacy-policy
     168
     169= Facebook Graph API (`graph.facebook.com`) =
     170
     171- **What it does:** Connects Facebook Pages/Profiles and publishes scheduled or instant posts to Facebook.
     172- **What data is sent:** Access tokens, page/account IDs, and post content data (message text, links, image/video URLs, and publish parameters).
     173- **When data is sent:** During Facebook account authorization and each time a Facebook post is published from the plugin.
     174- **Why it is required:** Facebook posting and page/account synchronization depend on Facebook Graph API endpoints.
     175- **Terms of Service:** https://www.facebook.com/terms.php
     176- **Privacy Policy:** https://www.facebook.com/privacy/policy/
     177
     178= BitApps Auth Server (`auth-apps.bitapps.pro`) =
     179
     180- **What it does:** Handles the plugin's account/authentication exchange for supported social integrations.
     181- **What data is sent:** Site URL/domain, integration state parameters, redirect/auth callback data, and temporary authorization credentials needed to complete account connection.
     182- **When data is sent:** Only when an administrator starts or completes a social account connection flow from plugin settings.
     183- **Why it is required:** The plugin uses this service as the authorization broker to complete secure OAuth/app connection flows.
     184- **Terms of Service:** https://bitapps.pro/terms-of-service/
     185- **Privacy Policy:** https://bitapps.pro/privacy-policy/
     186
    156187= What is Bit Social? =
    157188Bit Social is a WordPress plugin that helps you to share your WordPress post on social media platform automatically. You can set schedule for each social media.
    … …  
    196227== Changelog ==
    197228
     229
     230= v1.13.1 (February 25, 2026) =
     231   * Security:
     232      * Hardened AJAX auto-post flow with strict nonce, capability, and post ID validation.
     233   * Compliance:
     234      * Added external services and build/source-code documentation for WordPress.org review.
    198235
    199236= v1.13.0 (February 18, 2026) =
    … …  
    208245   * Fixed:
    209246      * Few minor bug fixes & improvements
     247
     248= v1.13.1 (February 25, 2026) =
     249   * Security:
     250      * Hardened AJAX auto-post flow with strict nonce, capability, and post ID validation.
     251      * Improved upload handling and input sanitization for safer media processing.
     252   * Compliance:
     253      * Added external services and build/source-code documentation for WordPress.org review.
    210254
    211255= v1.12.1 (February 02, 2026) =

  • bit-social/tags/1.13.1/vendor/composer/installed.php

    r3464211 r3470054  
    22    'root' => array(
    33        'name' => 'bitapps/social',
    4         'pretty_version' => '1.13.0.1',
    5         'version' => '1.13.0.1',
    6         'reference' => '6a739116d9e3c5473c84395aab214515107d6424',
     4        'pretty_version' => '1.13.1',
     5        'version' => '1.13.1.0',
     6        'reference' => 'f589109817e1bd572ef93c617b4fdbc2996791e0',
    77        'type' => 'library',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    1212    'versions' => array(
    1313        'bitapps/social' => array(
    14             'pretty_version' => '1.13.0.1',
    15             'version' => '1.13.0.1',
    16             'reference' => '6a739116d9e3c5473c84395aab214515107d6424',
     14            'pretty_version' => '1.13.1',
     15            'version' => '1.13.1.0',
     16            'reference' => 'f589109817e1bd572ef93c617b4fdbc2996791e0',
    1717            'type' => 'library',
    1818            'install_path' => __DIR__ . '/../../',

  • bit-social/trunk/assets/build-code-name.txt

    r3464211 r3470054  
    1 better-trees-lie
     1smooth-mugs-decide

  • bit-social/trunk/backend/app/Config.php

    r3464211 r3470054  
    2222    public const VAR_PREFIX = 'bit_social_';
    2323
    24     public const VERSION = '1.13.0';
     24    public const VERSION = '1.13.1';
    2525
    2626    public const DB_VERSION = '1.1.0';
    … …  
    104104                }
    105105                if (self::isProActivated()) {
    106                     return file_get_contents(ProConfig::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt');
     106                    $proBuildCodeNameFile = ProConfig::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt';
     107
     108                    return file_exists($proBuildCodeNameFile) ? trim((string) file_get_contents($proBuildCodeNameFile)) : '';
    107109                }
    108110
    109                 return file_get_contents(self::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt');
     111                $freeBuildCodeNameFile = self::get('ROOT_DIR') . self::ASSETS_FOLDER . '/build-code-name.txt';
     112
     113                return file_exists($freeBuildCodeNameFile) ? trim((string) file_get_contents($freeBuildCodeNameFile)) : '';
    110114
    111115            case 'WP_DB_PREFIX':

  • bit-social/trunk/backend/app/HTTP/Controllers/AutoPostController.php

    r3464211 r3470054  
    9393            'timeout'   => 0.1,
    9494            'blocking'  => false,
    95             'cookies'   => $_COOKIE,
     95            'cookies'   => $this->sanitizeRequestCookies(),
    9696            'sslverify' => apply_filters('https_local_ssl_verify', false), // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a WordPress core filter.
    9797        ];
    … …  
    109109    public function executeSocialPost($postId = null)
    110110    {
    111         // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce is verified by the REST API/AJAX handler before this method is called.
    112         if (isset($_REQUEST['post_id'])) {
    113             // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Nonce verified upstream; post_id is numeric and sanitized immediately.
    114             $postId = sanitize_text_field($_REQUEST['post_id']);
     111        $isAjaxRequest = wp_doing_ajax();
     112
     113        if ($isAjaxRequest) {
     114            check_ajax_referer(Config::withPrefix('nonce'));
     115
     116            if (!current_user_can('edit_posts')) {
     117                wp_send_json_error(['message' => 'Insufficient permission.'], 403);
     118            }
     119        }
     120
     121        if (null === $postId && $isAjaxRequest) {
     122            // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is validated at the start of this method.
     123            $postId = isset($_POST['post_id']) ? absint(wp_unslash($_POST['post_id'])) : 0;
     124        }
     125
     126        $postId = absint($postId);
     127
     128        if (0 === $postId) {
     129            if ($isAjaxRequest) {
     130                wp_send_json_error(['message' => 'Invalid post ID.'], 400);
     131            }
     132
     133            return;
     134        }
     135
     136        if ($isAjaxRequest && !current_user_can('edit_post', $postId)) {
     137            if ($isAjaxRequest) {
     138                wp_send_json_error(['message' => 'You are not allowed to access this post.'], 403);
     139            }
     140
     141            return;
     142        }
     143
     144        if (!get_post($postId)) {
     145            if ($isAjaxRequest) {
     146                wp_send_json_error(['message' => 'Post not found.'], 404);
     147            }
     148
     149            return;
    115150        }
    116151
    … …  
    127162
    128163        $allAccountIds = array_unique([...$accountIds, ...$groupAccountIds]);
     164        $accounts = [];
    129165
    130166        if (!empty($allAccountIds)) {
    … …  
    174210
    175211        Hooks::doAction(Config::withPrefix('all_platforms_post_publish'), $publishPostData);
     212
     213        if ($isAjaxRequest) {
     214            wp_send_json_success($publishPostData);
     215        }
    176216    }
    177217
    … …  
    204244        return $diff;
    205245    }
     246
     247    private function sanitizeRequestCookies(): array
     248    {
     249        $cookies = [];
     250
     251        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Cookies are only proxied to preserve the current authenticated AJAX session.
     252        foreach ((array) $_COOKIE as $cookieKey => $cookieValue) {
     253            if (!\is_scalar($cookieValue)) {
     254                continue;
     255            }
     256
     257            $cookies[sanitize_key((string) $cookieKey)] = sanitize_text_field(wp_unslash((string) $cookieValue));
     258        }
     259
     260        return $cookies;
     261    }
    206262}

  • bit-social/trunk/backend/app/HTTP/Controllers/ShareNowController.php

    r3464211 r3470054  
    180180    }
    181181
    182     public function uploadFile(Request $request)
    183     {
    184         $requestFiles = $request->files();
    185 
    186         if ($requestFiles) {
    187             $files = [];
    188             $fileArray = $requestFiles['file'];
    189 
    190             foreach ($fileArray['name'] as $index => $name) {
    191                 $files[] = [
    192                     'name'     => $name,
    193                     'type'     => $fileArray['type'][$index],
    194                     'tmp_name' => $fileArray['tmp_name'][$index],
    195                     'error'    => $fileArray['error'][$index],
    196                     'size'     => $fileArray['size'][$index]
    197                 ];
    198             }
    199 
    200             foreach ($files as $file) {
    201                 $upload_dir = wp_upload_dir();
    202                 $uuid = wp_generate_uuid4();
    203                 $file_name = $file['name'];
    204                 $filename_without_ext = pathinfo($file_name, PATHINFO_FILENAME);
    205                 $file_path = $upload_dir['path'] . '/' . $uuid . '-' . $file_name;
    206 
    207                 // phpcs:ignore Generic.PHP.ForbiddenFunctions.Found -- move_uploaded_file is required here as wp_handle_upload expects $_FILES structure which is not available in this context.
    208                 if (move_uploaded_file($file['tmp_name'], $file_path)) {
    209                     // Create an attachment post
    210                     $attachmentData = [
    211                         'post_mime_type' => $file['type'],
    212                         'post_title'     => sanitize_file_name($filename_without_ext),
    213                         'post_content'   => '',
    214                         'post_status'    => 'inherit'
    215                     ];
    216                     $attachment_id = wp_insert_attachment($attachmentData, $file_path);
    217                     $attachment_data = wp_generate_attachment_metadata($attachment_id, $file_path);
    218                     wp_update_attachment_metadata($attachment_id, $attachment_data);
    219                 }
    220             }
    221         }
    222 
    223         return Response::success([]);
    224     }
    225 
    226182    public function getAllMedia()
    227183    {

  • bit-social/trunk/backend/app/HTTP/Middleware/NonceCheckerMiddleware.php

    r3114392 r3470054  
    1111    public function handle(Request $request)
    1212    {
    13         if (!$request->has('_ajax_nonce') || !wp_verify_nonce(sanitize_key($request->_ajax_nonce), Config::withPrefix('nonce'))) {
    14             return Response::error('Invalid token')->httpStatus(411);
     13        if (!$request->has('_ajax_nonce')) {
     14            return Response::error('Invalid token')->httpStatus(403);
     15        }
     16
     17        $nonce = $request->_ajax_nonce;
     18
     19        if (!\is_scalar($nonce)) {
     20            return Response::error('Invalid token')->httpStatus(403);
     21        }
     22
     23        $nonce = sanitize_text_field(wp_unslash((string) $nonce));
     24
     25        if (empty($nonce) || !wp_verify_nonce($nonce, Config::withPrefix('nonce'))) {
     26            return Response::error('Invalid token')->httpStatus(403);
    1527        }
    1628

  • bit-social/trunk/backend/app/Providers/HookProvider.php

    r3169366 r3470054  
    6565            RequestType::is(RequestType::AJAX)
    6666            && is_readable($this->_pluginBackend . 'routes' . DIRECTORY_SEPARATOR . 'ajax.php')
    67             && current_user_can('administrator')
     67            && current_user_can('manage_options')
    6868        ) {
    6969            $router = new Router(RequestType::AJAX, Config::VAR_PREFIX, '');

  • bit-social/trunk/backend/bootstrap.php

    r3114392 r3470054  
    55if (! defined('ABSPATH')) {
    66    exit;
     7}
     8
     9if (!file_exists(__DIR__ . '/../vendor/autoload.php')) {
     10    add_action('admin_notices', static function () {
     11        $message = sprintf(
     12            // translators: %s: composer command
     13            __('Vendor dependencies are missing. Please run %s in the plugin directory.', 'bit-social'),
     14            '<code>composer install</code>'
     15        );
     16
     17        echo '<div class="notice notice-error"><p><strong>'
     18            . esc_html__('Bit Social:', 'bit-social')
     19            . '</strong> '
     20            . wp_kses($message, ['code' => []])
     21            . '</p></div>';
     22    });
     23
     24    return;
    725}
    826

  • bit-social/trunk/backend/routes/ajax.php

    r3437531 r3470054  
    6363
    6464        Route::get('smart-tags', [ScheduleController::class, 'getSmartTags']);
    65 
    66         Route::post('upload-files', [ShareNowController::class, 'uploadFile']);
    6765        Route::get('all-media', [ShareNowController::class, 'getAllMedia']);
    6866        Route::post('share-now', [ShareNowController::class, 'store']);

  • bit-social/trunk/bit-social.php

    r3464211 r3470054  
    99 * Plugin URI:  https://bitapps.pro/bit-social
    1010 * Description: Blog to Social Media Auto Post Scheduler and Publisher
    11  * Version:     1.13.0
     11 * Version:     1.13.1
    1212 * Author:      Bit Social Auto Poster & Scheduler - by Bit Apps
    1313 * Author URI:  https://bitapps.pro

  • bit-social/trunk/languages/bit-social.pot

    r3464211 r3470054  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Bit Social 1.13.0\n"
     5"Project-Id-Version: Bit Social 1.13.1\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/bit-social\n"
    77"Last-Translator: Bit Apps <[email protected]>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2026-02-18T10:30:43+00:00\n"
     12"POT-Creation-Date: 2026-02-26T09:07:44+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    107107#: backend/app/Views/SideBarMenu.php:120
    108108msgid "License & Support"
     109msgstr ""
     110
     111#. translators: %s: composer command
     112#: backend/bootstrap.php:13
     113#: pro/backend/bootstrap.php:11
     114#, php-format
     115msgid "Vendor dependencies are missing. Please run %s in the plugin directory."
     116msgstr ""
     117
     118#: backend/bootstrap.php:18
     119msgid "Bit Social:"
    109120msgstr ""
    110121
    … …  
    21052116msgid "Bit Social License is expired"
    21062117msgstr ""
     2118
     2119#: pro/backend/bootstrap.php:16
     2120msgid "Bit Social Pro:"
     2121msgstr ""

  • bit-social/trunk/languages/frontend.pot

    r3464211 r3470054  
    22msgstr ""
    33"Content-Type: text/plain; charset=utf-8\n"
    4 "POT-Creation-Date: Wed Feb 18 2026 10:30:43 GMT+0000 (Coordinated Universal "
     4"POT-Creation-Date: Thu Feb 26 2026 09:07:43 GMT+0000 (Coordinated Universal "
    55"Time)\n"
    66"Content-Transfer-Encoding: 8bit\n"

  • bit-social/trunk/readme.txt

    r3464211 r3470054  
    66Tested up to: 6.9
    77Requires PHP: 7.4
    8 Stable tag: 1.13.0
     8Stable tag: 1.13.1
    99License: GPLv2 or later
    1010
    … …  
    2222
    2323 With Bit Social, you can **schedule posts, auto publish & auto share** for each platform, saving time and ensuring a consistent online presence. With a minimum click auto-post, schedule, and recycle your blog content from WordPress posts. Whether it's a new post or recycling old content, Bit Social integrates with all the social sharing platforms for sharing on Facebook, Twitter, LinkedIn, Google Business Profile, Tumblr, Discord & Pinterest!
     24
     25**Useful Links**
     26🚀[Try Full Version Demo](https://towp.io/) | 🚀[Documentation](https://bit-social.com/documentation) | 🚀[Video Tutorials](https://www.youtube.com/playlist?list=PL7c6CDwwm-ALFAjnM5ZPuId8qcGqPBDvK) | 🚀[Support](https://tawk.to/chat/60eac4b6d6e7610a49aab375/1faah0r3e) | 🚀[Facebook Group](https://www.facebook.com/groups/3308027439209387) | 🚀[Upgrade to Pro](https://bit-social.com/) |
     27
     28The entire source code is [available on GitHub](https://github.com/Bit-Apps-Pro/bit-social-lite).
    2429
    2530
    … …  
    4449
    4550== Automate and Schedule WordPress Posts with Bit Social - The Ultimate WordPress Auto-Poster ==
    46 
    47 
    48 
    49  🚀 [Documentation](https://bit-social.com/documentation/) |  🚀 [Premium](https://bit-social.com/pricing/) |  🚀 [Support](https://bit-social.com/contact/) |  🚀 [Facebook Community](https://www.facebook.com/groups/bitapps) |  🚀 [YouTube Channel](https://www.youtube.com/@bit-apps)
    5051
    5152## 🔥 Social Media Platforms 🔥
    … …  
    154155## FAQ
    155156
     157
     158== External Services ==
     159
     160= LinkedIn API (`api.linkedin.com`, `linkedin.com`) =
     161
     162- **What it does:** Connects a LinkedIn account and publishes posts to LinkedIn from WordPress.
     163- **What data is sent:** Access tokens, account identifiers, and post payload data (text, links, media URLs, and metadata required by LinkedIn endpoints).
     164- **When data is sent:** When an administrator connects/reconnects a LinkedIn account and when a post is published or scheduled to LinkedIn.
     165- **Why it is required:** LinkedIn publishing and account authorization cannot work without LinkedIn APIs.
     166- **Terms of Service:** https://www.linkedin.com/legal/user-agreement
     167- **Privacy Policy:** https://www.linkedin.com/legal/privacy-policy
     168
     169= Facebook Graph API (`graph.facebook.com`) =
     170
     171- **What it does:** Connects Facebook Pages/Profiles and publishes scheduled or instant posts to Facebook.
     172- **What data is sent:** Access tokens, page/account IDs, and post content data (message text, links, image/video URLs, and publish parameters).
     173- **When data is sent:** During Facebook account authorization and each time a Facebook post is published from the plugin.
     174- **Why it is required:** Facebook posting and page/account synchronization depend on Facebook Graph API endpoints.
     175- **Terms of Service:** https://www.facebook.com/terms.php
     176- **Privacy Policy:** https://www.facebook.com/privacy/policy/
     177
     178= BitApps Auth Server (`auth-apps.bitapps.pro`) =
     179
     180- **What it does:** Handles the plugin's account/authentication exchange for supported social integrations.
     181- **What data is sent:** Site URL/domain, integration state parameters, redirect/auth callback data, and temporary authorization credentials needed to complete account connection.
     182- **When data is sent:** Only when an administrator starts or completes a social account connection flow from plugin settings.
     183- **Why it is required:** The plugin uses this service as the authorization broker to complete secure OAuth/app connection flows.
     184- **Terms of Service:** https://bitapps.pro/terms-of-service/
     185- **Privacy Policy:** https://bitapps.pro/privacy-policy/
     186
    156187= What is Bit Social? =
    157188Bit Social is a WordPress plugin that helps you to share your WordPress post on social media platform automatically. You can set schedule for each social media.
    … …  
    196227== Changelog ==
    197228
     229
     230= v1.13.1 (February 25, 2026) =
     231   * Security:
     232      * Hardened AJAX auto-post flow with strict nonce, capability, and post ID validation.
     233   * Compliance:
     234      * Added external services and build/source-code documentation for WordPress.org review.
    198235
    199236= v1.13.0 (February 18, 2026) =
    … …  
    208245   * Fixed:
    209246      * Few minor bug fixes & improvements
     247
     248= v1.13.1 (February 25, 2026) =
     249   * Security:
     250      * Hardened AJAX auto-post flow with strict nonce, capability, and post ID validation.
     251      * Improved upload handling and input sanitization for safer media processing.
     252   * Compliance:
     253      * Added external services and build/source-code documentation for WordPress.org review.
    210254
    211255= v1.12.1 (February 02, 2026) =

  • bit-social/trunk/vendor/composer/installed.php

    r3464211 r3470054  
    22    'root' => array(
    33        'name' => 'bitapps/social',
    4         'pretty_version' => '1.13.0.1',
    5         'version' => '1.13.0.1',
    6         'reference' => '6a739116d9e3c5473c84395aab214515107d6424',
     4        'pretty_version' => '1.13.1',
     5        'version' => '1.13.1.0',
     6        'reference' => 'f589109817e1bd572ef93c617b4fdbc2996791e0',
    77        'type' => 'library',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    1212    'versions' => array(
    1313        'bitapps/social' => array(
    14             'pretty_version' => '1.13.0.1',
    15             'version' => '1.13.0.1',
    16             'reference' => '6a739116d9e3c5473c84395aab214515107d6424',
     14            'pretty_version' => '1.13.1',
     15            'version' => '1.13.1.0',
     16            'reference' => 'f589109817e1bd572ef93c617b4fdbc2996791e0',
    1717            'type' => 'library',
    1818            'install_path' => __DIR__ . '/../../',
Note: See TracChangeset for help on using the changeset viewer.