ROBOTSTXT/robotstxt-mediaaudit
Watch
2
0
Fork
You've already forked robotstxt-mediaaudit
 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions

v1.8.2

Browse source
This commit is contained in:
Javier Casares 2026-08-09 08:15:09 +00:00
commit 6c6a7fca00
4 changed files with 83 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

33
changelog.txt
View file

@ -1,5 +1,38 @@
== Changelog ==
= 1.8.2 =
_Release date: 2026-08-08_
**Changed**
* Contribution guidelines restructured: `AGENTS.md` is now a slim index pointing to topic-specific `AGENTS-*.md` files (single source of truth — the security checklist and the audit prompt template each live in exactly one canonical file).
* `bin/deploy.sh` now reads its release exclude list from a shared `bin/dist-exclude.txt` so staging and verification cannot drift apart.
**Added**
* `bin/preflight.sh` automated pre-deploy verification script (PHPCS, PHPStan level 9, PHPCompatibility, PHPUnit, `composer audit`, candidate-ZIP artifact inspection).
* Plugin header tests (`tests/`) validating required/forbidden headers and `Stable tag` ↔ `Version` ↔ `ROBOTSTXT_MEDIAAUDIT_VERSION` consistency.
* `.claude/settings.json` deny rules mechanically enforcing the no-auto-deploy / no-push / no-tag / no-merge boundary.
* `.claude/agents/security-auditor.md` (read-only pre-deploy audit subagent) and `.claude/commands/deploy-check.md` slash command.
**Fixed**
* `bin/deploy.sh` now excludes all `AGENTS-*.md` dev docs from the release ZIP; previously only `AGENTS.md` was excluded, so the split topic files would have leaked into the distribution.
**Compatibility**
* WordPress: 5.3 - 7.1
* PHP: 8.0 - 8.5
* WP-CLI: 2.x
**Tests**
* PHPCS (WordPress-Core, WordPress-Docs, WordPress-Extra): PASS
* PHPStan level 9: PASS
* PHPCompatibility 8.0-8.5: PASS
* PHPUnit: 8 tests, 41 assertions
= 1.8.1 =
_Release date: 2026-06-08_

57
readme.txt
View file

@ -2,10 +2,10 @@
Contributors: javiercasares, robotstxt
Tags: media, copyright, images, reverse image search, media library
Requires at least: 5.3
Tested up to: 7.0
Tested up to: 7.1
Requires PHP: 8.0
Requires Plugins: action-scheduler
Stable tag: 1.8.1
Stable tag: 1.8.2
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.txt
@ -90,8 +90,8 @@ By default, no. Enable **Settings → Delete data on uninstall** if you want all
== Compatibility ==
* WordPress: 6.8 - 7.0
* PHP: 8.2 - 8.4
* WordPress: 5.3 - 7.1
* PHP: 8.0 - 8.5
* WP-CLI: 2.x
* Requires Plugins: action-scheduler
@ -99,44 +99,27 @@ By default, no. Enable **Settings → Delete data on uninstall** if you want all
Only the 3 latest versions. The full changelog is in [changelog.txt](changelog.txt).
= 1.6.0 =
= 1.8.2 =
* Settings page reorganised into four tabs: General, API Credentials, Filters, External Scanning.
* New Filters tab: configurable Alert Hostnames and Ignored Hostnames lists with wildcard support (`*.example.com`), auto-normalization (strips scheme/path/port/www., deduplicates, sorts), and default pre-populated lists (60 alert domains, 56 ignored domains) seeded on first activation.
* New "Alert" status filter in the audit list and alert badge in the External Status column.
* Dashboard stats: new "Alert" card showing attachments with at least one alert domain match.
* Quick-view modal: ignored domains filtered out; alert domains highlighted with a status badge.
* Full Report detail page: external results split into three sections — Alert, Other, and Ignored domains.
* Unified CSV export replacing separate internal/external exports: "Export CSV" (all) and "Export CSV (Alerts only)", one row per attachment with all internal and external data including per-provider match counts and classified domain lists.
* "Media Audit" admin menu repositioned immediately below the built-in Media menu.
* Contribution guidelines restructured: `AGENTS.md` is now an index to topic-specific `AGENTS-*.md` files (single source of truth).
* Added `bin/preflight.sh` automated pre-deploy verification (PHPCS, PHPStan, PHPCompatibility, PHPUnit, composer audit, ZIP inspection).
* Added plugin header tests validating header consistency (`Stable tag` ↔ `Version` ↔ version constant).
* Added `.claude/settings.json` deny rules enforcing no-auto-deploy / no-push / no-tag / no-merge.
* Added `.claude/agents/security-auditor.md` and `.claude/commands/deploy-check.md` for clean-context pre-deploy audits.
* Fixed `bin/deploy.sh` excluding all `AGENTS-*.md` dev docs from the release ZIP (previously only `AGENTS.md`).
= 1.5.0 =
= 1.8.1 =
* Added PicDefense as a third external scan provider: POST-based reverse image search with risk classification (high/medium/low), backlinks with similarity scores, risk flags (face/logo/landmark/stock/EXIF copyright), and label detection.
* Full Report page now shows PicDefense results with picRisk badge, risk flags list, backlinks table sorted by similarity score, and detected labels.
* Audit list modal shows picRisk badge inline next to the PicDefense match count.
* Network Operations buttons now use standard HTML POST Forms with server-side redirect (PRG pattern), replacing the AJAX approach that failed due to network admin script-loading constraints.
* Removed unreliable in-render script enqueueing for Network Tools page; operation buttons now work without JavaScript.
* JS dismiss/cancel labels on the Alerts page now use i18n strings from `wp_localize_script`.
= 1.4.0 =
= 1.8.0 =
* Added full attachment detail page (Media Audit → Full Report) showing all raw external scan data: Google Vision pages/full/partial matches with clickable URLs; TinEye backlinks with page URL, image URL, and crawl date sorted newest-first.
* Fixed `rate_limit_per_minute` setting having no effect — providers were ignoring it and using a hardcoded value of 10.
* Fixed `external_batch_size` setting being ignored by Action Scheduler batch processing.
* Fixed TinEye domain extraction using the image CDN URL instead of the webpage URL (API field `backlink`, not `url`).
= 1.2.0 =
* Added browser-based AJAX scan runner in the Tools page (runs without WP-Cron or Action Scheduler).
* Added "Requeue scan errors" operation to retry failed external scans after fixing API key issues.
* Added "Last Scanned" column in the audit list, sortable with NULLs-last ordering.
* Added bulk action to export external scan results as a CSV file.
= 1.1.0 =
* Updated plugin URI, author, and contributor metadata.
= 1.0.0 =
* First stable release. Internal usage scanning, external reverse image search (Google Vision + TinEye), consensus detection, WP-CLI commands, GDPR privacy tools, and Spanish/Catalan translations.
* **WordPress Multisite support** — plugin now declares `Network: true` and can be activated network-wide, with two operating modes (per site / central) configurable from Network Admin → Media Audit → Settings.
* Network admin panel (central mode): aggregated Audit list, Alerts list, and Tools page showing all media across all sites, plus a network mirror table for fast cross-site queries.
* New site provisioning via `wp_initialize_site`; settings migration on first switch to central mode; network-aware uninstall.
* DB schema version bumped to `1.3.0`.
= Previous versions =

6
robotstxt-mediaaudit.php
View file

@ -3,9 +3,9 @@
* Plugin Name: Media Audit (by ROBOTSTXT)
* Plugin URI: https://git.robotstxt.es/ROBOTSTXT/robotstxt-mediaaudit
* Description: Internal media library usage auditing and external reverse image search to detect potential copyright issues.
* Version: 1.8.1
* Version: 1.8.2
* Requires at least: 5.3
* Tested up to: 7.0
* Tested up to: 7.1
* Requires PHP: 8.0
* Requires Plugins: action-scheduler
* Network: true
@ -24,7 +24,7 @@ if ( ! defined( 'ABSPATH' ) ) {
exit;
}
define( 'ROBOTSTXT_MEDIAAUDIT_VERSION', '1.8.1' );
define( 'ROBOTSTXT_MEDIAAUDIT_VERSION', '1.8.2' );
define( 'ROBOTSTXT_MEDIAAUDIT_DB_VERSION', '1.3.0' );
define( 'ROBOTSTXT_MEDIAAUDIT_PLUGIN_FILE', __FILE__ );
define( 'ROBOTSTXT_MEDIAAUDIT_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

27
update.json Normal file
View file

@ -0,0 +1,27 @@
{
"name": "Media Audit (by ROBOTSTXT)",
"slug": "robotstxt-mediaaudit",
"version": "1.8.2",
"download_url": "https://git.robotstxt.es/ROBOTSTXT/robotstxt-mediaaudit/releases/download/1.8.2/robotstxt-mediaaudit-1.8.2.zip",
"requires": "5.3",
"requires_php": "8.0",
"tested": "7.1",
"last_updated": "2026-08-08",
"author": "ROBOTSTXT",
"author_profile": "https://www.robotstxt.es/",
"homepage": "https://git.robotstxt.es/ROBOTSTXT/robotstxt-mediaaudit",
"description": "Audit your media library for copyright risks: track internal usage, run reverse image search via Google Vision, TinEye, and PicDefense, and classify results against configurable alert and ignored hostname lists.",
"changelog": "<h3>1.8.2 - 2026-08-08</h3><ul><li><strong>Changed:</strong> Contribution guidelines restructured into a slim index plus topic-specific files (single source of truth).</li><li><strong>Added:</strong> Automated pre-deploy verification (bin/preflight.sh) and plugin header tests.</li><li><strong>Added:</strong> Clean-context pre-deploy audit tooling (.claude agents and slash command).</li><li><strong>Fixed:</strong> deploy.sh now excludes all AGENTS-*.md dev docs from the release ZIP.</li><li><strong>Compatibility:</strong> WordPress 5.3 - 7.1, PHP 8.0 - 8.5.</li></ul><h3>1.8.1 - 2026-06-08</h3><ul><li><strong>Fixed:</strong> Network Operations buttons now use PRG POST forms instead of AJAX.</li><li><strong>Fixed:</strong> Removed unreliable Network Tools script enqueueing.</li><li><strong>Fixed:</strong> JS dismiss/cancel labels now i18n via wp_localize_script.</li></ul><h3>1.8.0 - 2026-06-08</h3><ul><li><strong>Added:</strong> WordPress Multisite support (Network: true) with per-site and central operating modes.</li><li><strong>Added:</strong> Network admin panel with aggregated audit/alerts/tools and a network mirror table.</li><li><strong>Added:</strong> New site provisioning and network-aware uninstall.</li></ul>",
"sections": {
"description": "Audit your media library for copyright risks: track internal usage, run reverse image search via Google Vision, TinEye, and PicDefense, and classify results against configurable alert and ignored hostname lists.",
"changelog": "<h3>1.8.2 - 2026-08-08</h3><ul><li><strong>Changed:</strong> Contribution guidelines restructured into a slim index plus topic-specific files (single source of truth).</li><li><strong>Added:</strong> Automated pre-deploy verification (bin/preflight.sh) and plugin header tests.</li><li><strong>Added:</strong> Clean-context pre-deploy audit tooling (.claude agents and slash command).</li><li><strong>Fixed:</strong> deploy.sh now excludes all AGENTS-*.md dev docs from the release ZIP.</li><li><strong>Compatibility:</strong> WordPress 5.3 - 7.1, PHP 8.0 - 8.5.</li></ul><h3>1.8.1 - 2026-06-08</h3><ul><li><strong>Fixed:</strong> Network Operations buttons now use PRG POST forms instead of AJAX.</li><li><strong>Fixed:</strong> Removed unreliable Network Tools script enqueueing.</li><li><strong>Fixed:</strong> JS dismiss/cancel labels now i18n via wp_localize_script.</li></ul><h3>1.8.0 - 2026-06-08</h3><ul><li><strong>Added:</strong> WordPress Multisite support (Network: true) with per-site and central operating modes.</li><li><strong>Added:</strong> Network admin panel with aggregated audit/alerts/tools and a network mirror table.</li><li><strong>Added:</strong> New site provisioning and network-aware uninstall.</li></ul>"
},
"banners": {
"low": "",
"high": ""
},
"icons": {
"1x": "",
"2x": ""
}
}