1.5.15

Fixed

• XSS: subpage title now escaped with esc_html() in mpp_the_content() output
• XSS: translated strings in quicktag JS now escaped with esc_js() instead of raw _e()
• PHP 8.2: re-declared $admin property on Multipage class to prevent dynamic property deprecation warning
• mpp_pre_handle_404() returned null instead of true, failing to short-circuit the 404 handler
• versions() called get_option( null, 'multipage' ) with swapped arguments — corrected to get_option( 'multipage' )
• $comments_link potentially undefined before use in mpp_the_content() — now initialized
• Admin CSS enqueued without version string, preventing cache busting — now uses MPP_VERSION
• save_post hook ran on revisions and autosaves — now filtered with wp_is_post_revision() / wp_is_post_autosave()
• save_post() could crash if get_post() returned null — added guard
• mpp_the_title() loaded the wordpress-seo text domain even when Yoast SEO was not active — now guarded with defined( 'WPSEO_VERSION' )
• Double slash in hide_comments() path (MPP_PLUGIN_DIR . '/index.php')
• Navigation CSS class not sanitized — now uses sanitize_html_class()
• Missing text domain on __( 'Next page' ), __( 'Previous page' ), and __( 'Comments' ) in mpp-template.php
• _mpp_link_page_url() could crash if get_post() returned null — added guard
• Duplicate $handle assignment in MPP_Admin::enqueue_scripts()
• Plugin URI used http:// instead of https://
• MPP_VERSION constant was '1.5.14' while plugin header declared 1.5.15
• Comments link in TOC was missing <li> wrapper, producing invalid HTML
• multipage_return_array() returned an empty array instead of false when no valid shortcodes were found
• "Build Multipage postmetas" only found shortcode posts — now also detects Gutenberg block posts
• Plugin action links detection used fragile /trunk path hack — now uses plugin_basename()
• Security: missing exit after wp_safe_redirect() in both settings save functions — PHP continued executing after redirect
• esc_html() used instead of esc_attr() on radio input value attributes in settings page
• Operator precedence ambiguity in versions() — (int) cast applied to condition instead of ternary result
• Incorrect @since 1.6 docblock tags corrected to @since 1.5 (version 1.6 does not exist)
• Copy-paste docblock errors: mpp_hide_intro_title(), mpp_toc_only_on_the_first_page(), and mpp_hide_toc_header() incorrectly described as "standard WordPress pagination"
• SEO: rel=next link on the first page pointed to itself instead of page 2 — normalized page index in mpp_rel_links()
• Comments TOC link for first-page / last-page was missing #comments URL fragment — 'comments' was passed as $rel instead of $p parameter to _mpp_link_page()
• Swapped file headers: admin-settings.php said "Admin Advanced" and admin-advanced-settings.php said "Admin Settings"
• mpp_get_comments_on_page() docblock declared @return int but the function returns a string
• mpp_the_content filter docblock had wrong parameter names ($toc_labels instead of $toc) and types (array instead of string)
• mpp_link_pages_args filter docblock had @since 3.0.0 copied from WordPress core — corrected to @since 1.4
• Typo « fitler » corrected to « filter » in setup_actions() comment
• mpp_toc() default position was 'top_right' (underscore) instead of 'top-right' (hyphen), producing an invalid CSS class
• mpp_toc_pages_row filter docblock documented 2 parameters but 3 are passed ($row, $title, $i)
• Typo « positon » corrected to « position » in mpp_get_toc_position() filter docblock
• @param bool|string corrected to @param int for priority option defaults in mpp-options.php
• Missing $multipage parameter documented in mpp_link_pages() and mpp_toc() docblocks
• Redundant $post && check removed in mpp_pre_handle_404() — already validated above
• JS TypeError: cancelling the quicktag subpage prompt caused null.length crash — now checks for null explicitly
• CSS handle: enqueue_styles() used full filesystem path (get_stylesheet_directory()) as handle identifier — replaced with get_stylesheet() / get_template() slug
• mpp_get_admin_tabs() docblock declared @return string but the function returns an array
• mpp_get_db_version() and mpp_get_db_version_raw() docblocks declared @return string but the functions return an int
• Self-referencing @uses enqueue_styles() tag removed from enqueue_styles() docblock
• _mpp_link_page_url() docblock @param string $p Paragraph id corrected to « Fragment identifier »
• in_array() missing strict mode (true) in mpp_modify_admin_menu_highlight()
• mpp_toc() docblock for $pagelink incorrectly described as "Link text for the previous page link" — corrected to "Page number template; % is replaced by the page number"
• mpp_link_pages() docblock declared wrong defaults: $before = <p> Pages: / $after = </p> / $echo = 1|true — corrected to <div> / </div> / 0|false
• mpp_toc() docblock declared $echo default as 1|true — corrected to 0|false
• mpp_toc() docblock for $comments declared @type int|bool but actually receives an opening <a> tag or 0 — corrected to string|int
• Unused global $numpages declaration removed from mpp_toc()
• Dead JavaScript variable shortcode removed from quicktag prompt_subtitle() function
• Security: missing current_user_can( 'manage_options' ) check in mpp_admin_settings_save() and mpp_admin_advanced_settings_save() — added for defense-in-depth
• mpp_the_content filter docblock started with /* instead of /**, invisible to PHPDoc
• hide_standard_pagination() docblock missing @param and @return tags
• mpp_pre_handle_404() docblock missing @return tag
• mpp_add_post_multipage_meta() docblock missing @param for $update_option

Added

• Docblocks for frontend_init() and mpp_post() methods in Multipage class
• Docblock for _mpp_link_page() helper function in mpp-template.php
• uninstall.php to clean up all plugin options and _mpp_data post meta on deletion
• Requires at least: 5.0 and Requires PHP: 7.4 headers in plugin file
• History section in README.md documenting the plugin's origins and fork lineage
• aria-label attributes on TOC and navigation <nav> elements for accessibility

Changed

• _e() replaced with esc_html_e() in admin settings templates (17 occurrences) for translation security
• _mpp_link_page_url() called get_permalink() up to 3 times — now stored in a local variable
• $this->version now reads from MPP_VERSION constant instead of a hardcoded string
• All require() calls replaced with require_once (without parentheses) in class-mpp.php and class-mpp-admin.php
• sanitize_html_class() applied to TOC container position class
• mpp_is_block_editor_active() simplified — removed unnecessary WP < 5.0 and Gutenberg plugin checks
• TinyMCE disable setting description updated (no longer references WordPress 3.9)
• mpp_get_continue_or_prev_next() called once and stored instead of twice
• mpp_get_toc_position() called once and stored instead of three times in mpp_the_content()
• mpp_get_comments_on_page() called once and stored instead of twice in mpp_post()
• constant('MPP_PLUGIN_DIR') / constant('MPP_PLUGIN_URL') replaced with direct constant access in setup_globals()
• strip_tags() string allowlist updated to array form (recommended since PHP 7.4) in Multipage_Parser
• Redundant trailingslashit() removed from setup_globals() — plugin_dir_path() / plugin_dir_url() already add a trailing slash
• Redundant is_null( $post ) || empty( $post ) simplified to empty( $post ) in mpp_post()
• json_encode() replaced with wp_json_encode() in TinyMCE languages.php
• Minor formatting: added missing space in $this->page - 1 arithmetic expression
• Removed trailing semicolons (};) after ABSPATH guard closing braces in class-mpp.php and mpp-update.php
• Gutenberg block description replaced (was "lorem ipsum" placeholder)
• Gutenberg block script dependency changed from deprecated wp-editor to wp-block-editor
• Frontend CSS header updated to current author and HTTPS Plugin URI

Removed

• Obsolete WP < 4.4 title fallback in mpp_the_title()
• Orphaned <input type="checkbox"> and commented-out toggle HTML in TOC template
• Dead mpp_admin_settings_callback_excerpt_on_all_pages() (called non-existent mpp_excerpt_all_pages())
• Dead mpp_admin_settings_callback_prettylinks() (referenced old envire.it URL)
• Unused $notices property from MPP_Admin class
• Unused $options property from Multipage class
• Dead widget files: class-mpp-table-of-contents-widget.php and mpp-widgets.php (never loaded, non-functional)
• Dead mpp_uninstall() function in mpp-update.php (replaced by uninstall.php)
• Orphaned .toctogglespan CSS rule (toggle was removed from PHP)
• Dead mpp_get_default_options() function (never called, option keys used underscores instead of hyphens)
• Unused MPP__MINIMUM_WP_VERSION constant (minimum WP version already declared in plugin header)
• Redundant MPP__PLUGIN_DIR constant (same value as MPP_PLUGIN_DIR, only used once — inlined)