Skip to content

Co-Authors Plus 4.0.1

Choose a tag to compare

View all tags
@GaryJones GaryJones released this 24 Apr 21:17
· 356 commits to develop since this release
4.0.1
This tag was signed with the committer’s verified signature.
GaryJones Gary Jones
GPG key ID: 26945F7AF685BCCB
Verified
Learn about vigilant mode.
b80f577
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • Remove dynamic term backfill on the REST API read path, which could clear co-author assignments on posts whose author terms had not yet been materialised by @claudiulodro in #1242
  • Restore guest-author avatars on admin screens, threading user_type through the /coauthors REST endpoint so the correct avatar is resolved by @GaryJones in #1240

Security

  • Verify nonce and capability before overriding post_author in coauthors_set_post_author_field, closing an authorship-falsification path usable by Author-level users by @GaryJones in #1243
  • Require the edit_post capability when saving guest author post data and meta fields by @GaryJones in #1243
  • Escape the Co-Author Image block href with esc_url to strip unsafe URL schemes that could otherwise be surfaced via the rest_prepare_coauthor filter by @GaryJones in #1243

Maintenance

  • Exclude /docs/ from the distribution ZIP by @GaryJones in #1238
  • Silence a WPVIP users-table sniff in the avatar-collision test helper by @GaryJones in #1240

Documentation

  • Split the developer reference from user guides into /docs/ by @GaryJones in #1238

Full Changelog: 4.0.0...4.0.1

Contributors

GaryJones and claudiulodro
Assets 3
Loading