v1.2.0

Implements the email-notification feature that earlier versions advertised but never actually sent.

Install: download wedding-photo-uploader-1.2.0.zip below and upload via Plugins → Add New → Upload Plugin (choose Replace current). Your data is preserved.

✨ New: admin email notifications

• When a guest uploads new media, the site admin is emailed that content is awaiting moderation — with a count of pending items and a link to the moderation screen. The recipient is the Notification Email setting (defaults to your site admin address). The upload form doesn't collect guest emails, so notifications go to the host, not uploaders.
• Debounced (one email per 15 minutes by default) so a guest uploading many files — or abuse of the public endpoint — can't flood your inbox.
• Best-effort: a mail failure never affects the guest's upload.
• Customizable via filters: wpu_notification_recipient (return empty to turn notifications off), wpu_notification_throttle, wpu_notification_subject, wpu_notification_message.

📝 Docs

• Corrected the feature description: the notification goes to the site admin when new media is uploaded for review, not "for approved content."

---

Requires WordPress 5.8+ and PHP 7.4+. Licensed GPL-2.0-or-later. See CHANGELOG.md for full details.

v1.1.8

Maintenance & housekeeping release following the 1.1.7 security work. No changes to the normal guest-upload, moderation, or gallery-display flow — a safe drop-in update.

Install: download wedding-photo-uploader-1.1.8.zip below and upload via Plugins → Add New → Upload Plugin (choose Replace current). No need to delete the old version first; your data is preserved.

🧹 Cleanup

• Removed unused/dead code: the legacy upload form, a stale admin script, and unused helper methods.
• Removed a dead admin query, two phantom transient deletions, and the superseded dev scaffold.

🐛 Fixes

• Fixed a double CSS-unit bug so the uploader block's padding/border-radius render correctly.
• Upload dates now respect the site's timezone and locale.
• Gallery video thumbnails no longer show stray native controls; removed a leftover debug log.
• Dropped an unused database JOIN from the gallery and admin queries.

♿ Accessibility

• Upload status is now announced to screen readers; decorative icons hidden from them.
• Attribution and the video play cue now appear on keyboard focus and on touch devices (not hover-only).
• Added a no-JavaScript notice to the upload form.

---

Requires WordPress 5.8+ and PHP 7.4+. Licensed GPL-2.0-or-later. See CHANGELOG.md for full details.

v1.1.7

Security hardening + WordPress.org compliance release. Follows a full pre-publish security audit and independent verification — no critical/high exploitable issues were found; the items below address the confirmed medium/low findings and plugin-directory compliance.

Install: download wedding-photo-uploader-1.1.7.zip below and upload via Plugins → Add New → Upload Plugin (choose Replace current when prompted). After updating, deactivate and reactivate the plugin once so the hardened upload-directory protection is applied.

🔐 Security

• Anonymous-upload abuse (DoS): added a per-IP rate limit, a per-request file cap, and per-uploader quota enforcement on the upload endpoint.
• Admin upload limits now work: settings were written to one option but read from another, so configured limits had no effect. The Settings screen is now reachable, validated, and enforced.
• DOM XSS: user-controlled file names are now escaped everywhere they're inserted into the page.

🛡️ WordPress.org compliance

• Bundled the SimpleLightbox library locally instead of loading it from a CDN.
• Removed runtime ini_set() overrides of server PHP limits.
• Hardened the upload directory (.htaccess blocks script execution; added an index.php guard).
• upload_mimes now merges with, rather than replaces, WordPress's allowed types.

🧹 Code quality

• Removed a duplicate/shadowed admin action handler and a dead auto_approve flag.

---

Requires WordPress 5.8+ and PHP 7.4+. Licensed GPL-2.0-or-later. See CHANGELOG.md for full details.