Skip to content

CGM Core 3.0.0

Choose a tag to compare

View all tags
@bfrye26 bfrye26 released this 14 Aug 16:36
· 2 commits to master since this release
v3.0.0
0daf902

CGM Core 3.0.0 — final release

First stable release of the WordPress content interoperability platform.

Security fixes

  • Author privilege escalation closed: workflow transitions/schedules now require per-object edit_post caps at both REST and manager layers; cron sweeps use an internal path (WorkflowController/WorkflowManager)
  • Private content disclosure closed: query status forcing now keys on
    ead_private_posts instead of edit_posts; non-public saved queries refuse to run outside managers (QueryEngine)
  • Relationship traversal leaks closed: relationship reads are visibility-filtered for all non-privileged callers (traversal, dynamic data, reverse reads); RelationshipManager::can() no longer falls through to a generic capability
  • Dynamic data REST: keys checked against their public flag centrally; object readability verified; anonymous site-wide reads require real caps
  • REST nonce enforcement on every state-changing route (defense-in-depth alongside core cookie checks)
  • CSV export guards against formula injection
  • Webhook rule action: https-only + private-IP-range SSRF guard with cgm_core/rule_webhook_url_allowed escape hatch
  • Registry editor route requires manage/inspect caps instead of edit_posts
  • Saved query definitions validated and allowlisted at write time

Bug fixes

  • Automation rules created in the UI now persist (client-generated ids)
  • Workflow state stays in sync with native WordPress publishing and enforces the registered transition graph
  • Cache invalidation dependency IDs aligned between the query engine and invalidator; user/term meta invalidation added; trash/untrash invalidates; relationship hook signature fixed
  • JSON-path keys quoted (hyphenated meta keys no longer error); invalid keys compile to NULL
  • Network relationship store sanitizes IN() values; term provider supports reverse/count relationship filters; single sort objects normalized
  • Saved-query lookup rejects trashed/draft/corrupt definitions; query page param capped; caching limited to page-1 runs of saved queries; usage tracking pruned
  • VisibilityPolicy::is_public() added (fixed latent fatal on wildcard-target relationships)
  • ListTables state filter only applies to registered CGM post lists; Bootstrap endpoint admits configuration managers; UI pages gate their requests on capabilities

Cleanup

  • Removed dead code: Permissions class + cgm_core_can(), PathController, ConfirmDialog, unused UI components, SuiteIntegration no-op hook, 11 unused Radix dependencies
  • Uninstall now removes telemetry/rules/notifications/workflow options and the multisite network table under CGM_CORE_REMOVE_DATA_ON_UNINSTALL
  • Tooling: PHPStan WordPress stubs, PHPCS covers uninstall/includes, test paths fixed for case-sensitive CI, vite emptyOutDir: true
  • Telemetry opt-out filter, Pathauto uniquify hook, CLI export restricted to WP_CONTENT_DIR

Notes

  • README corrected to match shipped reality (RSS/feed displays removed, capability model documented)
  • Deliberately unchanged: empty registry subclasses (typed public API), build assets tracked in VCS (distributable plugin), auto-transition sweep capped at 200 posts/day (documented in code)
Assets 2
Loading