v1.2.0
This commit is contained in:
parent
693e5ae2e6
commit
7d3fc1969d
52 changed files with 1776 additions and 295 deletions
47
readme.txt
47
readme.txt
|
|
@ -1,10 +1,10 @@
|
|||
=== Documentation Markdown (by ROBOTSTXT) ===
|
||||
Contributors: robotstxt
|
||||
Tags: github, documentation, markdown, sync, automation
|
||||
Requires at least: 6.7
|
||||
Requires at least: 6.8
|
||||
Tested up to: 7.1
|
||||
Requires PHP: 8.0
|
||||
Stable tag: 1.1.1
|
||||
Stable tag: 1.2.0
|
||||
License: GPLv3 or later
|
||||
License URI: https://www.gnu.org/licenses/gpl-3.0.html
|
||||
|
||||
|
|
@ -44,8 +44,8 @@ Synchronize Markdown documentation from GitHub repositories to WordPress pages a
|
|||
|
||||
= Requirements =
|
||||
|
||||
* PHP 8.2 or higher
|
||||
* WordPress 6.9 or higher
|
||||
* PHP 8.0 or higher
|
||||
* WordPress 6.8 or higher
|
||||
* GitHub Personal Access Token (free, for accessing repositories)
|
||||
* Composer (for production build with dependencies)
|
||||
|
||||
|
|
@ -63,7 +63,7 @@ Synchronize Markdown documentation from GitHub repositories to WordPress pages a
|
|||
|
||||
* Clean, well-documented code
|
||||
* Follows WordPress Coding Standards (WPCS)
|
||||
* Modern PHP 8.2+ features
|
||||
* Modern PHP 8.0+ features
|
||||
* Extensive PHPDoc documentation
|
||||
* Procedural approach (KISS principles)
|
||||
* Extensible with WordPress hooks and filters
|
||||
|
|
@ -178,13 +178,46 @@ Then go to Documentation → Settings, and you'll see a "Debug Tools" section at
|
|||
|
||||
== Compatibility ==
|
||||
|
||||
* WordPress: 6.7 - 7.1
|
||||
* WordPress: 6.8 - 7.1
|
||||
* PHP: 8.0 - 8.5
|
||||
|
||||
== Changelog ==
|
||||
|
||||
For the complete changelog, see [changelog.txt](https://git.robotstxt.es/ROBOTSTXT/robotstxt-documentation-markdown/raw/branch/main/changelog.txt).
|
||||
|
||||
= 1.2.0 - 2026-08-07 =
|
||||
|
||||
**Added**
|
||||
|
||||
* **Title from H1:** the synced post title is now taken from the first `# H1` in the Markdown (inline formatting stripped), with the H1 removed from the body to avoid a duplicate heading. Falls back to the filename-derived title when no H1 is present
|
||||
* **Internal link translation:** repo-relative Markdown links (e.g. `./api.md`, `../README.md`) are rewritten to the permalink of the matching mapped WordPress content. External, `mailto:`, and anchor links are left untouched; links with no matching mapping keep their original URL
|
||||
* **Repository image sideloading:** images referenced in the Markdown are downloaded from the repository, added to the Media Library, and their references replaced with the attachment URL. Already-imported images are reused on subsequent syncs (tracked per post); removed images are kept in the Media Library (non-destructive)
|
||||
|
||||
**Security**
|
||||
|
||||
* Patched CVE-2026-71478 (and advisory GHSA-2q4p-g7hv-5rgv) in league/commonmark — an unsafe-link filter bypass that could defeat `allow_unsafe_links: false`. Updated league/commonmark 2.8.2 → 2.9.0
|
||||
* GitHub token encryption now derives its AES-256 key with HKDF-SHA256 from `wp_salt('auth')` instead of using the salt directly; existing tokens are migrated transparently to the new `v2:` format on first decrypt (covers the cron path too)
|
||||
* Discover Files "Refresh from GitHub" action is now nonce-protected — previously a crafted link could force an unrequested GitHub API call (CSRF)
|
||||
* GitHub API request paths are now `rawurlencode()`d (defensive hardening)
|
||||
* Sideloaded images are validated by extension (jpg, jpeg, png, gif, webp) and size (< 10 MB) before storage; SVG is intentionally excluded
|
||||
|
||||
**Fixed**
|
||||
|
||||
* "Using cached data / fetching fresh data" indicator on Discover Files now reflects reality — it always showed "cached" because the cache was tested after being populated
|
||||
* `target_post_type` is now validated against registered public post types on save, falling back to `page` (prevents saving an unregistered or internal type)
|
||||
* Debug action dispatch refactored into a single `switch`, each case retaining its `check_admin_referer()` check, to reduce the chance of a missing nonce check
|
||||
|
||||
**Changed**
|
||||
|
||||
* Inline `onclick` confirm on Delete replaced with a `data-confirm` attribute + delegated handler (CSP-friendlier, less fragile)
|
||||
* Add Mapping "existing content" dropdown now queries only public post types (excludes attachments and the internal mapping CPT) with `no_found_rows` for better performance on large sites
|
||||
|
||||
**Compatibility**
|
||||
|
||||
* Minimum WordPress raised to 6.8 (latest stable + two previous majors)
|
||||
* Verified compatible with WordPress 7.1
|
||||
* Declared PHP minimum made consistent across `readme.txt`, `composer.json`, `phpstan.neon`, and the PHPCompatibility scan range — real minimum remains 8.0
|
||||
|
||||
= 1.1.1 - 2026-06-08 =
|
||||
|
||||
**Security**
|
||||
|
|
@ -274,7 +307,7 @@ For the complete changelog, see [changelog.txt](https://git.robotstxt.es/ROBOTST
|
|||
|
||||
**Developer Features:**
|
||||
* Procedural PHP following KISS principles
|
||||
* PHP 8.2+ modern features
|
||||
* PHP 8.0+ modern features
|
||||
* Complete PHPDoc documentation
|
||||
* WordPress hooks and filters
|
||||
* Extensible architecture
|
||||
|
|
|
|||
Loading…
Reference in a new issue