v0.25.4

Marketplace icon redesign and missing cache language string.

• Redesigned the Marketplace listing icon: a browser window with a guiding
  cursor and a small lock badge, replacing the previous shield+lock design
  so the icon reads as "co-browsing support inside Moodle" rather than a
  generic security icon.
• Added the cachedef_eventratelimit language string (English and
  Spanish), required by the eventratelimit cache definition in
  db/caches.php and missing since that cache was introduced.

Full details in CHANGELOG.md.

v0.25.3 — Documentation corrections ahead of Marketplace submission

Two README inaccuracies found during a compliance review against Moodle Marketplace's plugin requirements:

• "Requirements" stated Moodle 4.1 or later, but version.php has declared 4.2 as the minimum since 0.25.0 (the AJAX layer's namespaced external_api classes don't exist before 4.2 — a hard, CI-confirmed failure, already documented correctly in docs/limitations.md).
• "Project status" still said Alpha, though maturity was bumped to Beta in 0.25.1.

Also simplifies $plugin->release to a plain version string (0.25.3), dropping the descriptive parentheticals used since 0.24.x — non-standard per MoodleDev's version.php docs, and the direct cause of this release's initial CI failure (the sentence-length string exceeded phpcs's line-length limit).

No functional code changes. See CHANGELOG.md for full details.

Installation

Download moodle-local_remotesupport-0.25.3.zip, extract it, and place the resulting remotesupport folder at local/remotesupport inside your Moodle dirroot. Then visit the site administration notifications page as an admin to complete installation. See README.md for details.

v0.25.2 — Security fixes

Supersedes v0.25.1 (removed — see below).

Fixes

Two findings from an earlier adversarial review, previously documented as
known, low-impact, not-currently-exploitable risks, are now fixed rather
than just accepted (ahead of a Moodle Plugins directory submission):

• html_sanitizer::clean_attributes()'s `javascript:` filter now strips
  tab/newline/CR from a url before checking it, closing a known
  browser-parsing bypass technique.
• `session_manager::create_request()` now rejects any `returnurl`
  containing a `..` path segment, closing a same-site-only open-redirect
  quirk.

Maturity bumped from alpha to beta.

See CHANGELOG.md for full details and the 0.25.0 feature list this release is built on.

Installation

Download `moodle-local_remotesupport-0.25.2.zip`, extract it, and place
the resulting `remotesupport` folder at `local/remotesupport` inside your
Moodle `dirroot`. Then visit the site administration notifications page
as an admin to complete installation. See README.md
for details.