What's in 1.8.1
A small hardening release over 1.8.0. It adds explicit input sanitizers to five administrator-only mailbox settings fields and brings the PHP_CodeSniffer security gate back to green. No user-facing changes, no database, schema, or REST changes, and no behavior change. A straight upgrade over 1.8.0.
Hardened
Five admin form inputs in the new mail apps now pass their value through an explicit WordPress sanitizer at the point of read, matching the project's coding standard:
- Inbox settings (
ZIB_Admin::save):internal_domains,client_secret - Exchange identity (
ZMI_Admin):zmi_upn,zmi_aliases,zmi_services
Every one of these handlers was already capability-gated (manage_options / edit_users) and nonce-verified, and every value was already unslashed and parsed downstream, so this is defense in depth rather than a fix for an exploitable issue. Nothing in 1.8.0 was exploitable: the release ships no SQL injection (all queries are parameterized through $wpdb->prepare()) and no unauthenticated data path.
Why a point release
The 1.8.0 security gate (PHP_CodeSniffer, security ruleset, scoped to the lines a change touches) flagged these five reads because the new mail code did not sanitize at the boundary. Its other findings were false positives on safe code: parameterized SQL with interpolated table names, a nonce verified inside a shared helper, integer casts, and pre-escaped output. The changed-lines gate does not re-scan those once a change is not touching them, so hardening the five real reads restores a green gate without churning safe code.
Install / upgrade
Zorderz ships as two artifacts that upgrade together. Install or upgrade the theme first, then the apps. The order matters and is not enforced by WordPress.
zorderz-theme-1.8.1.zip— the platform kernel and Core serviceszorderz-apps-1.8.1.zip— the app bundle
Fresh install: upload just the theme, and it installs and activates the apps itself. Theme and apps bundle move to 1.8.1 in lockstep.
Artifacts
zorderz-theme-1.8.1.zipzorderz-apps-1.8.1.zipzorderz-1.8.1-checksums.txt(SHA-256)
Verified clean by the private tenant-data gate: zero customer, employee, pricing, or cost data in the release.