From 693e5ae2e6dce5f36a5421502b381617eebc5002 Mon Sep 17 00:00:00 2001 From: Javier Casares Date: Mon, 8 Jun 2026 12:52:03 +0000 Subject: [PATCH] v1.1.1 --- .phpunit.result.cache | 1 - CHANGELOG.md | 59 --------- docs/audit-pre-deploy-1.1.1.md | 90 -------------- docs/db-migrations.md | 9 -- docs/deploy-checklist-1.1.1.md | 113 ------------------ docs/known-issues.md | 11 -- .../robotstxt-documentation-markdown-ca.mo | Bin 0 -> 12254 bytes .../robotstxt-documentation-markdown-es_ES.mo | Bin 3909 -> 12256 bytes 8 files changed, 283 deletions(-) delete mode 100644 .phpunit.result.cache delete mode 100644 CHANGELOG.md delete mode 100644 docs/audit-pre-deploy-1.1.1.md delete mode 100644 docs/db-migrations.md delete mode 100644 docs/deploy-checklist-1.1.1.md delete mode 100644 docs/known-issues.md create mode 100644 languages/robotstxt-documentation-markdown-ca.mo diff --git a/.phpunit.result.cache b/.phpunit.result.cache deleted file mode 100644 index 724a358..0000000 --- a/.phpunit.result.cache +++ /dev/null @@ -1 +0,0 @@ -{"version":1,"defects":[],"times":{"Test_Plugin_Headers::plugin_file_exists":0.002,"Test_Plugin_Headers::plugin_name_header_is_present":0.001,"Test_Plugin_Headers::version_header_is_present_and_valid":0,"Test_Plugin_Headers::requires_at_least_header_is_present":0,"Test_Plugin_Headers::requires_php_header_is_present":0,"Test_Plugin_Headers::text_domain_matches_plugin_slug":0,"Test_Plugin_Headers::license_header_is_gpl3":0,"Test_Plugin_Headers::author_header_is_present":0,"Test_Plugin_Headers::readme_file_exists":0,"Test_Plugin_Headers::readme_has_stable_tag":0,"Test_Plugin_Headers::readme_has_requires_at_least":0,"Test_Plugin_Headers::readme_has_requires_php":0,"Test_Plugin_Headers::readme_has_license":0,"Test_Plugin_Headers::stable_tag_matches_plugin_version":0,"Test_Plugin_Headers::requires_at_least_is_consistent":0,"Test_Plugin_Headers::requires_php_is_consistent":0,"Test_Plugin_Headers::license_is_consistent":0}} \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index c446026..0000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,59 +0,0 @@ -# Changelog - -All notable changes to Documentation Markdown are documented in this file. - -For the WordPress.org–formatted changelog, see [`changelog.txt`](changelog.txt). - -## [1.1.1] — 2026-06-08 - -### Security -- CommonMark: disabled raw HTML passthrough (`html_input: strip`, `allow_unsafe_links: false`) — prevents stored XSS if an upstream repository is compromised -- Plugin settings option now stored with `autoload = false` — encrypted GitHub token no longer loaded on every WordPress request -- Replaced `serialize()` with `wp_json_encode()` in updater HMAC cache signature (eliminates object-injection risk surface) -- Added strict base64 length validation in `robotstxt_docmd_decrypt_token()` before IV extraction -- Added `base64_decode()` strict return-value check in `robotstxt_docmd_get_file_content()` - -### Fixed -- Admin notices now display results for all operations (mapping created/updated/deleted, sync complete, error messages); previously only "Settings saved" appeared -- `wp_update_post()` return value now checked during sync — silent failures previously reported as success -- Wrong textdomain `'robotstxt-smtp'` in updater class corrected to `'robotstxt-documentation-markdown'` - -### Changed -- `robotstxt-updater.php` renamed to `class-robotstxt-updater.php` (WordPress file-naming convention) -- `Requires PHP` header corrected to `8.0` (real minimum confirmed by PHPCompatibility scan — union types, `str_starts_with()`, `str_contains()`, `mixed` type are the binding constraints; no 8.1/8.2-specific features used) - -### Developer / Infrastructure -- Added `composer.json` with full `require-dev` tooling (PHPCS, PHPStan 2.x, PHPUnit 9.6, PHPCompatibility 10.0.0-alpha2, wp-compat, yoast/phpunit-polyfills) -- Added `phpstan.neon` (level 9), `.phpcs.xml` (WordPress standards), `bin/deploy.sh`, `phpunit.xml.dist` -- 17 PHPUnit plugin header tests added (`tests/PluginHeadersTest.php`) -- Added `docs/known-issues.md` and `docs/db-migrations.md` -- `class-robotstxt-updater.php`: PHPCS 0 errors, PHPStan level 9 0 errors -- PHPCompatibility updated to 10.0.0-alpha2 (PHP 8.x feature detection) - -## [1.1.0] — 2026-03-28 - -### Security -- Patched CVE-2026-33347 and CVE-2026-30838 (league/commonmark updated to 2.8.2) - -### Changed -- Access level changed from `manage_options` (administrator) to `edit_pages` (editor) - -### Fixed -- PHPStan level 9 compliance: zero errors across all plugin files -- `target_order` (menu_order) field now saved and applied end-to-end -- Type-safety improvements for all WordPress API returns -- Token decryption `false` return handled correctly -- Uninstall data cleanup narrows mixed option return before array access - -## [1.0.0] — 2026-01-26 - -### Added -- Initial release: GitHub → WordPress Markdown sync -- Encrypted GitHub token storage (AES-256-CBC) -- Custom Post Type `robotstxt_map` for mapping management -- Automatic cron sync (hourly, twice daily, daily) -- Manual on-demand sync via admin interface -- Markdown to HTML via CommonMark (league/commonmark) -- Multi-repository support -- Debug tools (visible when `WP_DEBUG` enabled) -- Full i18n support (es_ES bundled) diff --git a/docs/audit-pre-deploy-1.1.1.md b/docs/audit-pre-deploy-1.1.1.md deleted file mode 100644 index e29324f..0000000 --- a/docs/audit-pre-deploy-1.1.1.md +++ /dev/null @@ -1,90 +0,0 @@ -# Pre-Deploy AI Security Audit — v1.1.1 - -**Date:** 2026-06-08 -**Plugin:** Documentation Markdown (by ROBOTSTXT) -**Version:** 1.1.0 → 1.1.1 -**Auditor:** Claude Sonnet (Senior WordPress Plugin Security Auditor role) -**Scope:** Full codebase (all 7 PHP plugin files) - ---- - -## Executive Summary - -**Overall status: CONDITIONAL PASS → PASS (after fixes applied)** - -All [CRITICAL] findings were resolved before tagging. No SQL injection, no CSRF gaps, no direct object reference, no privilege escalation vectors found. Access is gated behind `edit_pages` throughout with both UI-level and execution-level checks. - -**Security risk: Low** (after fixes) -**Version recommendation: stable** - ---- - -## Findings Resolved Before Release - -### [CRITICAL → FIXED] Finding 011 — CommonMark raw HTML passthrough - -**File:** `robotstxt-documentation-markdown-map.php:296` -**Problem:** CommonMark's default config allows raw HTML blocks from Markdown. A compromised upstream GitHub repository could inject `