Skip to content

Syndication 2.2.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Sep 13:57
· 6 commits to develop since this release
2.2.1
This tag was signed with the committer’s verified signature.
GaryJones Gary Jones
GPG key ID: 26945F7AF685BCCB
Verified
Learn about vigilant mode.
882556a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Sites running 2.2.0 or earlier should update.

Upgrade note: The syndication.addThumbnail and syndication.postGalleryImage XML-RPC methods now fetch thumbnail URLs with wp_safe_remote_get(), which blocks loopback and reserved IP ranges. The thumbnail URL is built from the source site's own attachment URL, so a site that syndicates from a host on a private address will find that posts continue to syndicate while thumbnails silently stop. If that applies to you, allow the source host through the core http_request_host_is_external filter.

Security

  • Require edit_post capability in syndication.addThumbnail by @GaryJones in #209
  • Harden the syn_log meta read in the log viewer by @GaryJones in #210
  • Escape Syndication log viewer output to fix stored XSS by @GaryJones in #211
  • Deny capability-checked writes to the syndication log meta keys by @GaryJones in #211
  • Authenticate XML-RPC thumbnail methods before fetching remote URLs by @GaryJones in #212
  • Verify TLS certificates on WordPress.com API requests by @GaryJones in #216
  • Reject XML feeds that declare a doctype by @GaryJones in #219
  • Authorise site settings saves on their own nonce by @GaryJones in #220
  • Make stored credential fields write-only in the admin by @GaryJones in #221
  • Validate the syndication settings and encrypt the stored client secret by @GaryJones in #222

Fixed

  • fix: resolve filtering and pagination issues in Syndication Logs screen by @GaryJones in #193
  • Correct the log ID filter dropdown, which could never match the selected log by @GaryJones in #211
  • Clean up the plugin's internationalisation by @GaryJones in #223
  • Fix deprecation notices and label accessibility in the admin UI by @GaryJones in #224
  • Stop the RSS client emitting a SimplePie deprecation notice by @GaryJones in #225

Maintenance

  • chore: exclude dev files from release archives by @GaryJones in #191
  • chore: PHPCS coding standards fixes by @GaryJones in #194
  • Stop unit tests exiting non-zero when a coverage driver is installed by @GaryJones in #213
  • Enforce coding standards on the lines a pull request changes by @GaryJones in #214
  • Automate releases and reconnect the plugin to WordPress.org by @GaryJones in #226

Contributors

GaryJones
Assets 3
Loading