ROBOTSTXT/robotstxt-og
ROBOTSTXT/robotstxt-og
Watch
6
0
Fork
You've already forked robotstxt-og
 0
Code Issues Pull requests Releases 6 Activity

v1.1.0

Browse source
This commit is contained in:
Javier Casares 2026-03-28 07:59:52 +00:00
commit ddaaff71ad
23 changed files with 879 additions and 798 deletions
Download patch file Download diff file Expand all files Collapse all files

29
changelog.txt
View file

@ -1,18 +1,39 @@
== Changelog ==
= 1.0.1 =
= 1.1.0 =
_Release date: 2026-03-05_
_Release date: 2026-03-28_
**Compatibility**
**Fixed**
* Confirmed compatibility with WordPress 7.0. Supported range is now WordPress 6.7 – 7.0.
* Fatal `TypeError` in `handle_thumbnail_change()`: the `deleted_post_meta` action passes an array of meta IDs as its first argument (unlike `updated_post_meta`, which passes a single `int`). The method signature now accepts `int|array` to handle both actions correctly.
**Security**
* Added SSRF protection in `Robotstxt_OG_Image_Resolver::is_safe_url()`: all outbound HTTP HEAD requests now validate that the target host resolves to a public IP address. Private (RFC 1918), loopback, link-local, and reserved ranges are blocked.
* Replaced deprecated `FILTER_SANITIZE_SPECIAL_CHARS` with `FILTER_SANITIZE_FULL_SPECIAL_CHARS` in nonce and input handling throughout admin and meta box classes.
**Added**
* GDPR Privacy API: registered `wp_privacy_personal_data_exporters` and `wp_privacy_personal_data_erasers` filters. Custom `_og_title` and `_og_description` post meta are now included in WordPress personal data export and erase requests.
* PHPUnit 10 test suite using Brain\Monkey for WordPress function mocking. Covers SSRF IP validation, image format detection (`ensure_compatible_format()`), external URL detection, and cache clearing. No WordPress installation required to run tests (`vendor/bin/phpunit`).
**Changed**
* Settings page and REST API permission check changed from `manage_options` to `edit_others_posts`. Editors and above can now access OG settings and trigger fallback image resolution. The WordPress Settings API form is unlocked via the `option_page_capability_robotstxt_og_settings` filter.
* REST API `check_permission()` now also verifies `edit_post` for the specific post ID requested.
* Minimum supported WordPress version raised from 6.7 to 6.8 (two previous major versions back from WordPress 7.0).
* Added `Network: true` plugin header, formally documenting Multisite compatibility.
**Tests**
* WordPress: 6.8, 6.9, 7.0
* PHP: 8.2, 8.5
* PHP_CodeSniffer: 3.13.5
* WordPress Coding Standards: 3.3.0
* PHPCompatibility: 9.3.5
* PHPStan: level 9
* PHPUnit: 10.5
= 1.0.0 =