3.1.0

[3.1.0] - 2026-03-01

Changed

• Updated quote action navigation in assets/js/bitstream.js:
  • Changed feed card Quote button behavior to navigate in the current tab (matching other card actions) instead of opening a new tab.
• Unified Composer publish redirect behavior in assets/js/bitstream.js:
  • Composer/ReBit sidebar posts now redirect to feed URL with highlight_bit after publish.
  • Aligns sidebar quick-post flow with composer shortcode publish/highlight behavior.
• Improved hashtag sidebar wrapping in assets/css/bitstream.css:
  • Long hashtags now line-wrap inside each row instead of forcing horizontal scrolling on the hashtags container.
  • Preserved count alignment while allowing tag text to wrap.
• Hardened quoted Bit meta saving flow in class-admin-interface.php:
  • Added nonce field output in quoted preview UI.
  • Added nonce verification in save_quoted_meta().
  • Added autosave/revision bailouts.
  • Added current_user_can('edit_post', $post_id) capability check before write/delete.
• Standardized AJAX nonce validation in class-ajax-handlers.php:
  • Replaced raw wp_verify_nonce() checks with check_ajax_referer() for like, delete, load more, OG fetch, ReBit preview render, and quoted-bit fetch handlers.
• Reduced data-leak risk from debug logging in class-ajax-handlers.php:
  • Removed raw request payload dumps.
  • Gated remaining debug logs behind if ( defined('WP_DEBUG') && WP_DEBUG ) with redacted/minimal messages.
• Hardened class-pwa-manager.php request logging:
  • Removed logging of raw $_GET, $_POST, and $_FILES arrays.
  • Switched to minimal, redacted debug messages behind WP_DEBUG gate.
• Removed PHP session usage from PWA share flow in class-pwa-manager.php:
  • Removed session_start() and $_SESSION usage.
  • Replaced temporary share handoff with tokenized transient storage (set_transient, get_transient, delete_transient).
  • Preserved existing shared_key handoff behavior for composer prefill after login.
• Hardened inline editor script injection in class-block-editor.php:
  • Replaced direct <script> echo interpolation for shared/media query data with safe wp_add_inline_script() payloads.
  • Sanitized request-derived values with sanitize_text_field()/absint() (plus wp_unslash() where applicable) before JavaScript use.
  • Switched to encoded payload passing (wp_json_encode) instead of manual string concatenation.
• Reduced production log exposure in class-block-editor.php:
  • Added strict WP_DEBUG gating for PHP debug logging.
  • Removed high-volume/raw payload log patterns from runtime paths.
• Restored native WordPress comment submission flow in bitstream.php:
  • Removed custom comment_form() action/redirect overrides that used $_SERVER['REQUEST_URI'].
  • Reverted to default comment_form() behavior and native wp-comments-post.php handling.
• Hardened Bit search query extension in class-post-type.php:
  • Removed brittle regex-based SQL WHERE mutation (preg_replace) from search filtering.
  • Replaced raw SQL string manipulation with native posts_search hook logic using prepared SQL conditions.
  • Preserved search coverage for Bit content/title and relevant ReBit metadata fields while avoiding query-fragile patterns.
• Modernized log-clearing AJAX security/response handling in class-error-logger.php:
  • Replaced check_admin_referer() with check_ajax_referer('bitstream_clear_logs', 'nonce') in clear_logs().
  • Replaced non-JSON unauthorized path with wp_send_json_error(..., 403).
  • Standardized success payload via wp_send_json_success(...) for AJAX consumers.
• Hardened RSS feed item content sanitization in class-rss-feeds.php:
  • Sanitized feed description/content HTML with wp_kses_post() before outputting <description> and <content:encoded> CDATA payloads.
  • Preserved standard allowed markup (e.g., paragraphs, links, images) while preventing unsafe HTML/script injection.
• Reduced dead/unreachable admin surface in class-admin-interface.php:
  • Removed obsolete unhooked methods (handle_post_rebit_redirect, feed_intro_page, rss_feeds_page, reset_bitstream_page, media_cleanup_page).
  • Kept active admin pages/menu callbacks intact (bitstream-new-bit, bitstream-settings) to preserve current UI behavior.
• Reduced dead/phantom PWA routing surface in class-pwa-manager.php:
  • Removed rewrite/serving logic for missing sw-feed.js file.
  • Removed unused show_upload_progress_page() method after confirming no active call sites.
  • Kept main sw.js, manifest.json, and share-target transient handoff logic intact.
• Reduced dead OG background-processing surface in class-og-fetcher.php:
  • Removed unhooked obsolete methods schedule_og_fetch() and process_og_data().
  • Removed stale commented-out constructor hook registrations referencing those methods.
  • Kept active synchronous/AJAX OG fetching logic unchanged.
• Reduced dead frontend composer publish-path surface in assets/js/bitstream.js:
  • Removed unreachable UI-reset code that executed after publish redirect/return in the submit success handler.
  • Kept existing successful publish redirect behavior intact.
• Fixed ReBit mappings delete persistence in admin-rebit-mappings-interface.php:
  • Corrected remove-flag input name structure to bitstream_rebit_mappings[existing][i][remove] so it matches backend parser expectations.
  • Restored successful save-time deletion of existing mappings from the admin UI.