4.19.1

What's Changed

• Fix: escape output in shared helpers (attribute string builder, tooltips) by @pauloiankoski in #8350
• Fix: escape output on the System Info page by @pauloiankoski in #8351
• Fix: escape output in the legacy donation form metabox by @pauloiankoski in #8352
• Fix: escape output in core settings screens by @pauloiankoski in #8353
• Fix: escape output in gateway settings fields by @pauloiankoski in #8354
• Fix: escape output in the donors and payments admin screens by @pauloiankoski in #8355
• Fix: escape output in reports, upgrades, licenses and misc admin screens by @pauloiankoski in #8356
• Fix: escape output in tools import/export and email notifications by @pauloiankoski in #8357
• Fix: escape output in the legacy donation form (public) by @pauloiankoski in #8358
• Fix: escape output in legacy consumer field templates (public) by @pauloiankoski in #8359
• Fix: escape output in Stripe/PayPal gateway form fragments (public) by @pauloiankoski in #8360
• Fix: escape output in the Classic donation form template (public) by @pauloiankoski in #8361
• Fix: escape output in the Sequoia template and IntlTelInput field (public) by @pauloiankoski in #8362
• Fix: escape output in the v3 form skeleton, iframe and routes (public) by @pauloiankoski in #8363
• Fix: escape output in the form grid, donor wall and donation history shortcodes (public) by @pauloiankoski in #8364
• Fix: escape output in smaller shortcodes, receipts, profile editor and emails by @pauloiankoski in #8365
• Fix: escape output in includes/ core (misc, API, notices, scripts) by @pauloiankoski in #8366
• Fix: escape output in the onboarding setup guide by @pauloiankoski in #8367
• Fix: escape output in Elementor widgets (public) by @pauloiankoski in #8369
• Fix: escape output in promotions, dashboards and exports by @pauloiankoski in #8370
• Fix: escape output in admin pages, service providers and misc by @pauloiankoski in #8371
• Fix: escape output in campaign blocks and misc (public) by @pauloiankoski in #8368
• Fix: escape translated output on the System Info page by @pauloiankoski in #8379
• Fix: escape translated output in the donors and donations admin screens by @pauloiankoski in #8380
• Fix: escape translated output in the import and export tools by @pauloiankoski in #8381
• Fix: escape translated output in settings, license, report and update screens by @pauloiankoski in #8382
• Fix: escape translated output in form admin views and list-page mounts by @pauloiankoski in #8383
• Fix: escape translated output in the legacy donation form template by @pauloiankoski in #8384
• Fix: escape translated output in the profile editor, donation summary and Sequoia templates by @pauloiankoski in #8385
• Fix: escape translated output in the Elementor V1 widgets by @pauloiankoski in #8386
• Fix: escape exception messages in campaign, donation and framework migrations by @pauloiankoski in #8388
• Fix: escape exception messages in event ticket and subscription migrations by @pauloiankoski in #8389
• Fix: escape exception messages in the container, models and framework helpers by @pauloiankoski in #8390
• Fix: escape exception messages in value objects, HTTP helpers and legacy libraries by @pauloiankoski in #8391
• Fix: escape exception messages in the query builder, list tables and registrars by @pauloiankoski in #8392
• Fix: escape exception messages in the Fields API and Form API by @pauloiankoski in #8393
• Fix: escape exception messages in the domain repositories by @pauloiankoski in #8394
• Fix: escape exception messages in session objects, donor dashboards and form builder actions by @pauloiankoski in #8395
• Fix: escape exception messages in donation form validation and the REST donations endpoint by @pauloiankoski in #8396
• Fix: escape exception messages in the PayPal Commerce gateway by @pauloiankoski in #8397
• Fix: escape exception messages in the Stripe gateway by @pauloiankoski in #8398
• [SOFT-4778] [1/3]: Fix: add direct file access guards to 63 PHP files by @pauloiankoski in #8448
• [SOFT-4778] [2/3]: Fix: guard the function files that composer autoloaded by @pauloiankoski in #8449
• [SOFT-4778] [3/3]: Fix: add direct file access guards to form, campaign and admin views by @pauloiankoski in #8450
• [SMTNC-3086] [1/5]: Fix: add translators comments to the currency list by @pauloiankoski in #8441
• [SMTNC-3086] [2/5]: Fix: number placeholders, text domains and literal strings in translations by @pauloiankoski in #8442
• [SMTNC-3086] [3/5]: Fix: add translators comments in includes/ and src/ by @pauloiankoski in #8444
• [SMTNC-3086] [4/5]: Fix: add translators comments and plural fixes in the legacy admin by @pauloiankoski in #8445
• [SMTNC-3086] [5/5]: Fix: add translators comments in views, gateways and templates by @pauloiankoski in #8446
• [SMTNC-2777] [1/10]: Fix: prepare SQL in the Give_DB base class and sequential ordering by @pauloiankoski in #8429
• [SMTNC-2777] [2/10]: Fix: prepare SQL for donation notes and comments by @pauloiankoski in #8431
• [SMTNC-2777] [3/10]: Fix: prepare SQL in the cache and background processing classes by @pauloiankoski in #8432
• [SMTNC-2777] [4/10]: Fix: prepare the donor search, form filter and fields in Give_Donors_Query by @pauloiankoski in #8433
• [SMTNC-2777] [5/10]: Fix: prepare SQL in donor addresses, the donor wall and donor lookups by @pauloiankoski in #8435
• [SMTNC-2777] [6/10]: Fix: prepare SQL in upgrade routines, install and uninstall, and delete only GiveWP options on uninstall by @pauloiankoski in #8436
• [SMTNC-2777] [7/10]: Fix: prepare SQL in the legacy subscription queries by @pauloiankoski in #8437
• [SMTNC-2777] [8/10]: Fix: prepare SQL for donation totals, payment queries and stats by @pauloiankoski in #8438
• [SMTNC-2777] [9/10]: Fix: prepare SQL in admin tools, export, system info and the form duplicator by @pauloiankoski in #8439
• [SMTNC-2777] [10/10]: Fix: prepare SQL in the remaining src classes by @pauloiankoski in #8443
• [SMTNC-3084] [1/6]: Fix: use gmdate() in reports, stats and the legacy API by @pauloiankoski in #8455
• [SMTNC-3084] [2/6]: Fix: use gmdate() for stored dates, queries and keys in legacy code by @pauloiankoski in #8456
• [SMTNC-3084] [3/6]: Fix: use gmdate() for stored dates and queries in src by @pauloiankoski in #8457
• [SMTNC-3084] [4/6]: Fix: use gmdate() in legacy screens, emails and exports by @pauloiankoski in #8458
• [SMTNC-3084] [5/6]: Fix: replace short echo tags in admin views, campaign blocks and form views by @pauloiankoski in #8459
• [SMTNC-3084] [6/6]: Fix: replace short echo tags in the Classic and Sequoia form templates by @pauloiankoski in #8460
• [SMTNC-3087] [1/13]: Fix: add nonce checks to admin AJAX, PayPal and Stripe settings, tracking links and manual migration by @pauloiankoski in #8462
• [SMTNC-3087] [2/13]: Fix: use safe redirects and close two open redirects in login and profile forms by @pauloiankoski in #8464
• [SMTNC-3087] [3/13]: Fix: check nonces and sanitize input in legacy AJAX, admin actions and importers by @pauloiankoski in #8465
• [SMTNC-3087] [4/13]: Fix: check nonces and sanitize input in export and data tools, payments and reports by @pauloiankoski in #8466
• [SMTNC-3087] [5/13]: Fix: sanitize input in legacy donors, forms admin, settings and emails by @pauloiankoski in #8467
• [SMTNC-3087] [6/13]: Fix: sanitize input in legacy donation processing by @pauloiankoski in #8468
• [SMTNC-3087] [7/13]: Fix: sanitize input in form rendering, public includes, legacy Stripe and gateways by @pauloiankoski in #8469
• [SMTNC-3087] [8/13]: Fix: add nonce and capability checks to the form builder and sanitize input in modern admin and forms code by @pauloiankoski in #8470
• [SMTNC-3087] [9/13]: Fix: remove debug backtraces and send logging through the GiveWP logger by @pauloiankoski in #8471
• [SMTNC-3087] [10/13]: Fix: enqueue assets with versions and use the options API in the batch tools by @pauloiankoski in #8472
• [SMTNC-3087] [11/13]: Fix: document accepted direct DB, slow query and template variable findings by @pauloiankoski in #8473
• [SMTNC-3087] [12/13]: Fix: prefix global functions and keep deprecated aliases by @pauloiankoski in #8474
• [SMTNC-3087] [13/13]: Fix: prefix hooks and keep the old names firing as deprecated by @pauloiankoski in #8475
• Docs: fix GiveWP security reporting link by @pasmud in #8477
• Fix: wrap admin_url() with esc_url() on donor row action href by @thisismyurl in #8239
• fix: wrap admin_url() with esc_url() on settings section nav links by @thisismyurl in #8243
• Chore: keep deprecation tags off method lines in the status enums by @jonwaldstein in #8497
• Chore: let CodeRabbit auto-review pull requests against any base branch by @jonwaldstein in #8499
• [SMTNC-3103]: Fix: Donor Register email preview fatals with Peer-to-Peer active by @WayneRocha in #8487
• Fix: [SMTNC-3055] Cannot edit credit card info in Donor Dashboard by @WayneRocha in #8476
• [SMTNC-908]: Fix: Form Grid Donate button text color fails contrast by @WayneRocha in #8488
• Fix: [SMTNC-1509] Logging out on the Donor Dashboard while in mobile view should work by @WayneRocha in #8478
• [SMTNC-2353]: Fix: Keyboard Tab skips Form Field Manager fields on Sequoia multi-step forms by @WayneRocha in #8502
• [SMTNC-2779]: Fix: escape output findings across the codebase by @pauloiankoski in #8399
• [SMTNC-2778]: Fix: escape unsafe printing functions and exception messages across the codebase by @pauloiankoski in #8400
• [SMTNC-3084]: Fix: use gmdate() and remove short echo tags by @pauloiankoski in #8454
• [SMTNC-2777]: Fix: prepare all direct SQL across the codebase by @pauloiankoski in #8434
• [SMTNC-3085]: Fix: add direct file access protection by @pauloiankoski in #8447
• [SMTNC-3086]: Fix: add translators comments and fix i18n errors from Plugin Check by @pauloiankoski in #8440
• [SMTNC-3087]: Fix: triage Plugin Check warnings (nonce, sanitization, prefix globals, direct DB, performance) by @pauloiankoski in #8461
• Chore: take the Plugin Check baseline from the target branch's latest run by @pauloiankoski in #8515
• [SMTNC-2760] Fix: Donation form grid block and shortcode only displays featured image when Columns is set to 1 by @WayneRocha in #8503

New Contributors

• @pasmud made their first contribution in #8477
• @thisismyurl made their first contribution in #8239

Full Changelog: 4.19.0.2...4.19.1