Skip to content

Edit Flow 0.11.0

Choose a tag to compare

View all tags
@GaryJones GaryJones released this 10 Jun 10:57
· 63 commits to develop since this release
0.11.0
This tag was signed with the committer’s verified signature.
GaryJones Gary Jones
GPG key ID: 26945F7AF685BCCB
Verified
Learn about vigilant mode.
7238c10
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release completes the security-review remediation begun in 0.10.4. It resolves the remaining issues from a full audit of the plugin's authenticated code paths — the headline stored XSS in the editorial-metadata location field, two information-disclosure issues (the iCal feed and the Story Budget), and a long tail of defence-in-depth hardening across access control, input handling, deserialisation, output escaping, and client-side code. None are known to be exploited in the wild, but all users are encouraged to update.

Breaking: the iCal subscription feed now uses a per-user, revocable secret instead of a single site-wide key. Existing calendar-subscription URLs will stop working, and each user must copy their new feed URL from the calendar's Screen Options. This is the reason for the minor version bump.

Security

  • fix: escape the editorial metadata location field to close a stored XSS by @GaryJones in #970
  • fix: restrict Story Budget to a user's own posts when they cannot edit others' by @GaryJones in #972
  • fix: escape the custom status name in the Custom Statuses list table by @GaryJones in #973
  • fix: stop the calendar metadata AJAX creating arbitrary taxonomy terms by @GaryJones in #974
  • fix: secure the calendar iCal feed against unauthenticated disclosure by @GaryJones in #975
  • fix: harden the settings and screen-options save handlers by @GaryJones in #984
  • fix: require a nonce to change Story Budget filters by @GaryJones in #985
  • fix: restrict notification subscriptions and harden the webhook sender by @GaryJones in #987
  • fix: gate calendar quick-create on the post type's create capability by @GaryJones in #988
  • fix: harden custom status migration and the publish-timestamp workaround by @GaryJones in #989
  • fix: block PHP object injection when decoding term descriptions by @GaryJones in #990
  • fix: harden admin form and AJAX input handling by @GaryJones in #992
  • fix: escape admin screen output consistently by @GaryJones in #993
  • refactor: tidy up bootstrap and select-form code quality by @GaryJones in #995
  • fix: harden client-side JS DOM and selector handling by @GaryJones in #996

Fixed

  • fix: prevent a critical error on the user groups dashboard when no groups exist by @Morpheus636 in #982
  • fix: correct checkbox-attribute escaping and the "no one notified" message in the user-select form by @jerclarke in #980
  • fix: use the slug-specific template when previewing custom statuses by @GaryJones in #994
  • fix: correct stale URLs in the module help sidebar panels by @thisismyurl in #967

Documentation

  • docs: correct GitHub brand capitalisation across modules and docs by @GaryJones in #971
  • docs: fix the broken CHANGELOG.md link in the plugin readme by @GaryJones in #983

Maintenance

  • ci: speed up CI with targeted caching and fewer jobs by @GaryJones in #951
  • ci: stop the integration test suite terminating early by @GaryJones in #991
  • ci: guard against non-npmjs registry URLs in the lockfile by @GaryJones in #1000
  • ci: hold React-19-blocking @WordPress updates in Dependabot by @GaryJones in #1004
  • Routine dependency updates for npm packages and GitHub Actions

New Contributors

Full Changelog: 0.10.4...0.11.0

Contributors

GaryJones, jerclarke, and 3 other contributors
Assets 3
Loading