Releases · 9ete/remote-media-source

wp.org launch release.

What's in 1.0.0

Source role

Connection key lifecycle: generate / rotate, hash-only storage, one-time display
Authenticated REST verify endpoint (GET /wp-json/rms/v1/verify) reporting site metadata and the real uploads base URL

Consumer role

Upload-URL rewrite that activates only after a verified connection
Honors the source-reported uploads base URL — Bedrock, custom upload_url_path, and multisite /sites/N layouts all work
Upload modes: local-only (default) or block uploads entirely
SSRF-hardened connection test: https-only scheme allowlist (filterable), wp_http_validate_url, redirects refused, 64-hex key format enforced
Status-aware connection errors (key rejected / plugin missing / server error) and explicit save-validation notices

Housekeeping

All plugin options scrubbed on uninstall (multisite-aware)
i18n complete with shipped .pot (63 strings)
QA: 108 PHPUnit tests, 15 Cypress e2e across a 3-site Lando matrix, WPCS-clean, Plugin Check zero errors

SHA-256 ec17373ce88f7eb665438b23ca895b520effaef785b7c6a0b2e41d391c27a38d