150 lines
8.3 KiB
Text
150 lines
8.3 KiB
Text
== Changelog ==
|
|
|
|
= 1.2.1 =
|
|
|
|
_Release date: 2026-08-17_
|
|
|
|
**Highlights**
|
|
|
|
* Plugin updates are now delivered by Manager (by ROBOTSTXT) — the bundled Gitea self-updater was removed, and the plugin recommends the Manager on the Plugins page and its settings page when it is missing.
|
|
|
|
**Added**
|
|
|
|
* Dismissible admin notice on the Plugins list page when Manager (by ROBOTSTXT) is not installed and active, linking to https://www.robotstxt.software/plugins/robotstxt-manager/.
|
|
* Persistent (non-dismissible) Manager reminder on the plugin settings page when the Manager is not active.
|
|
* Uninstall cleanup for the legacy self-updater site transient.
|
|
|
|
**Changed**
|
|
|
|
* Removed the bundled self-updater (`robotstxt-updater.php`) and `update.json`; updates are delivered by Manager (by ROBOTSTXT).
|
|
* Plugin URI, Update URI, and author URLs now point to https://www.robotstxt.software/plugins/robotstxt-og/ and https://www.robotstxt.software/; contributors order is now robotstxt, javiercasares.
|
|
* Tested up to WordPress 7.1.
|
|
* Composer dev dependencies updated (PHPCS 3.13.6, WPCS 3.4.1, PHPUnit 9.6.36).
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 4.9.8 - 7.1
|
|
* PHP: 8.0 - 8.5
|
|
* WP-CLI: 2.x
|
|
|
|
**Tests**
|
|
|
|
* PHP Coding Standards: 3.13.6
|
|
* WordPress Coding Standards: 3.4.1
|
|
* Plugin Check (PCP): not run (no WP-CLI in build environment)
|
|
|
|
= 1.2.0 =
|
|
|
|
_Release date: 2026-08-10_
|
|
|
|
**Added**
|
|
|
|
* Per-term Open Graph metadata for Categories and Tags on the term edit page (`term.php`): custom OG title, OG image URL, and OG description, exposed on term archives.
|
|
* Manual `og:image:alt` override (per-post meta box and per-term), emitted as `og:image:alt` and `twitter:image:alt`.
|
|
* Per-post `og:type` override (Default / `website` / `article`); `article:*` sub-tags now emit on the resolved article type.
|
|
* Twitter/X: emit `twitter:url` (canonical) and per-post `twitter:creator` (author handle); handles normalised with a leading `@`.
|
|
* Platform integration tags (global settings): Facebook `fb:app_id`/`admins`/`pages`, Pinterest `p:domain_verify` + disable-pinning toggle, Telegram `telegram:channel`, Slack `slack-app-id`.
|
|
* Mobile / Web App tags (global settings): `theme-color`, web-app name, PWA standalone toggle, iOS status bar style, `format-detection`; Open Graph namespace added to `<html>` via `language_attributes`.
|
|
* Uninstall cleanup extended to remove the per-term OG meta and `_og_image_alt` / `_og_type` / `_twitter_creator` (opt-in only).
|
|
|
|
**Changed**
|
|
|
|
* Minimum supported WordPress lowered from 6.8 to 4.9.8 (verified by WP-Compat; bound by register_post_meta/register_term_meta at 4.9.8).
|
|
* Minimum supported PHP lowered from 8.2 to 8.0 (verified by the PHPCompatibility scan; the code uses 8.0 features only).
|
|
|
|
= 1.1.0 =
|
|
|
|
_Release date: 2026-03-28_
|
|
|
|
**Fixed**
|
|
|
|
* Fatal `TypeError` in `handle_thumbnail_change()`: the `deleted_post_meta` action passes an array of meta IDs as its first argument (unlike `updated_post_meta`, which passes a single `int`). The method signature now accepts `int|array` to handle both actions correctly.
|
|
|
|
**Security**
|
|
|
|
* Added SSRF protection in `Robotstxt_OG_Image_Resolver::is_safe_url()`: all outbound HTTP HEAD requests now validate that the target host resolves to a public IP address. Private (RFC 1918), loopback, link-local, and reserved ranges are blocked.
|
|
* Replaced deprecated `FILTER_SANITIZE_SPECIAL_CHARS` with `FILTER_SANITIZE_FULL_SPECIAL_CHARS` in nonce and input handling throughout admin and meta box classes.
|
|
|
|
**Added**
|
|
|
|
* GDPR Privacy API: registered `wp_privacy_personal_data_exporters` and `wp_privacy_personal_data_erasers` filters. Custom `_og_title` and `_og_description` post meta are now included in WordPress personal data export and erase requests.
|
|
* PHPUnit 9.6 test suite (with phpunit-polyfills) using Brain\Monkey for WordPress function mocking. Covers SSRF IP validation, image format detection (`ensure_compatible_format()`), external URL detection, and cache clearing. No WordPress installation required to run tests (`vendor/bin/phpunit`).
|
|
|
|
**Changed**
|
|
|
|
* Settings page and REST API permission check changed from `manage_options` to `edit_others_posts`. Editors and above can now access OG settings and trigger fallback image resolution. The WordPress Settings API form is unlocked via the `option_page_capability_robotstxt_og_settings` filter.
|
|
* REST API `check_permission()` now also verifies `edit_post` for the specific post ID requested.
|
|
* Minimum supported WordPress version raised from 6.7 to 6.8 (two previous major versions back from WordPress 7.0).
|
|
* Added `Network: true` plugin header, formally documenting Multisite compatibility.
|
|
|
|
**Tests**
|
|
|
|
* WordPress: 6.8, 6.9, 7.0
|
|
* PHP: 8.2, 8.5
|
|
* PHP_CodeSniffer: 3.13.5
|
|
* WordPress Coding Standards: 3.3.0
|
|
* PHPCompatibility: 9.3.5
|
|
* PHPStan: level 9
|
|
* PHPUnit: 9.6
|
|
|
|
= 1.0.0 =
|
|
|
|
_Release date: 2026-02-18_
|
|
|
|
**Highlights**
|
|
|
|
* Initial stable release of OpenGraph (by ROBOTSTXT).
|
|
* Outputs a complete set of Open Graph and Twitter Card meta tags, with automatic detection of incompatible image formats (AVIF, WebP, GIF, BMP, SVG, TIFF) and HTTP-based resolution of JPEG/PNG alternatives.
|
|
|
|
**Added**
|
|
|
|
* Full Open Graph meta tag output: `og:title`, `og:type`, `og:url`, `og:description`, `og:site_name`, `og:locale`, `og:image`, `og:image:width`, `og:image:height`, `og:image:type`, `og:image:alt`.
|
|
* Article-specific tags for singular posts: `article:published_time`, `article:modified_time`, `article:section`, `article:tag`.
|
|
* Twitter Card meta tag output: `twitter:card`, `twitter:site`, `twitter:image`.
|
|
* Direct tag injection via `wp_head` when no SEO plugin is active.
|
|
* Yoast SEO integration via `wpseo_opengraph_image` filter.
|
|
* RankMath integration via `rank_math/opengraph/facebook/og_image` filter.
|
|
* Automatic format detection for AVIF, WebP, GIF, BMP, SVG, and TIFF featured images.
|
|
* HTTP HEAD-based resolution of compatible JPEG/PNG alternatives.
|
|
* Postmeta caching (`_og_image_fallback_url`) with automatic invalidation when the featured image is changed or removed.
|
|
* Negative caching via transients (1-hour TTL) to avoid repeated failed HEAD requests.
|
|
* Global fallback image URL setting (Settings > OpenGraph).
|
|
* Homepage-specific image URL setting (Settings > OpenGraph).
|
|
* Image URL validation at save time: incompatible formats are auto-resolved to JPEG/PNG; invalid or unresolvable URLs are rejected with an admin notice.
|
|
* Twitter/X site handle setting for the `twitter:site` meta tag.
|
|
* Per-post Open Graph overrides: custom title and description via meta box in the post editor.
|
|
* Taxonomy archive image support via `robotstxt_og_taxonomy_image` filter.
|
|
* Admin settings page (Settings > OpenGraph) with three tabs: Settings, Tools, Diagnostics.
|
|
* Tools tab: Clear All Caches, Re-resolve All Images, Plugin Information.
|
|
* Diagnostics tab: statistics (cached count, coverage), URL tester with HTTP header display, paginated cached entries table with per-row clear action.
|
|
* WP-CLI command `wp og-fallback resolve` with `--all`, `--dry-run`, `--post-type` options.
|
|
* WP-CLI command `wp og-fallback clear-cache` with `--all` and `--dry-run` options.
|
|
* REST API: `POST /wp-json/robotstxt-og/v1/resolve/{post_id}` and `GET /wp-json/robotstxt-og/v1/status/{post_id}`.
|
|
* Developer filters: `robotstxt_og_external_image_enabled`, `robotstxt_og_external_image_timeout`, `robotstxt_og_taxonomy_image`, `robotstxt_og_enable_logging`.
|
|
* Auto-updater integration via Gitea (`robotstxt-updater.php`).
|
|
* Full internationalization (text domain: `robotstxt-og`, POT file included). Spanish (es_ES) translation included.
|
|
* `uninstall.php` with optional data deletion on plugin removal (opt-in, off by default).
|
|
* Multisite compatible with per-site configuration.
|
|
|
|
**Security**
|
|
|
|
* Nonce verification on all forms and state-changing GET actions.
|
|
* `manage_options` capability check on all admin pages, REST endpoints, and WP-CLI commands.
|
|
* Input sanitization via WordPress APIs (`sanitize_key`, `sanitize_text_field`, `esc_url_raw`, `filter_input`) throughout.
|
|
* Output escaping on all dynamic HTML (`esc_html`, `esc_attr`, `esc_url`, `absint`).
|
|
* Prepared statements (`$wpdb->prepare()`) for all raw database queries; no direct SQL writes.
|
|
* CSRF protection on all state-changing actions via `wp_nonce_url` / `wp_verify_nonce`.
|
|
* HTTP requests use `wp_remote_head()` with configurable timeout — no `file_get_contents` or `curl` directly.
|
|
|
|
**Compatibility**
|
|
|
|
* WordPress: 6.7 - 6.9
|
|
* PHP: 8.2 - 8.5
|
|
* WP-CLI: 2.x
|
|
* MariaDB: 10.6+
|
|
|
|
**Tests**
|
|
|
|
* PHP_CodeSniffer: 3.13.5
|
|
* WordPress Coding Standards: 3.3.0
|
|
* PHPCompatibility: 9.3.5
|