Skip to content

v2026.04.04

Choose a tag to compare

View all tags
@edequalsawesome edequalsawesome released this 04 Apr 20:08
· 2 commits to main since this release
v2026.04.04
a4588a3

What's Changed

Security

  • All code paths (snippets + header/footer) now require unfiltered_html capability, closing a multisite privilege escalation gap where non-super-admins could inject arbitrary JS/HTML
  • PHP snippet cache moved from wp-content/uploads/ to wp-content/cache/ — no longer relies on .htaccess to block direct web access, fixing exposure on Nginx

Bug Fixes

  • clear_cache() now removes stale PHP cache files when snippets are deleted, deactivated, or change type
  • Migration path (v1.2) cleans up old cache location on upgrade

Improvements

  • Consolidated snippet cache: single transient instead of 3-4 DB queries per page load
  • PHP snippets use content-addressed cached files (written once per code change, not per request)
  • Admin JS extracted to properly enqueued assets/admin.js

Accessibility

  • role="alert" on all admin notices for screen reader announcement
  • Descriptive aria-label on all snippet actions (edit, delete, toggle)
  • CodeMirror keyboard trap fixed with Escape key handler + visible hint

Full Changelog: v2026.03.10...v2026.04.04

Assets 3
Loading