Release Notes — PMPro Magic Levels 1.2.0
This release focuses on security hardening, privacy, and infrastructure reliability. It introduces significant improvements to token management, audit logging, and documentation workflow.
Security and Privacy
- Manual Token Rotation: Admins can now rotate existing bearer tokens from the settings page. This generates a new raw token and replaces the stored hash for improved security.
- SQL Injection Prevention: Hardened the level matcher by improving placeholder count validation and argument unpacking in database queries.
- Privacy-First Logging: Webhook logging is now opt-in. Logs include stronger redaction and parameter fingerprinting to avoid storing PII (Personally Identifiable Information) by default.
- Debug Redaction: Sensitive data is automatically redacted from REST API debug output and system logs.
New Features
- Lightweight Audit Logging: Token lifecycle events (rotation, revocation, validation) are now logged as structured JSON. Developers can use the new
pmpro_magic_levels_auditaction to forward these to external systems. - Rate Limiting Support: The API now returns 429 Too Many Requests with a Retry-After header when rate limits are reached, supporting both internal and external validator limits.
Documentation and UX
- Wiki Migration: Documentation has been moved from the local repository directory to the GitHub Wiki for better maintenance and searchability.
- Admin UI Enhancements: Updated documentation links within the WordPress admin dashboard to point to the new Wiki locations.
- WPCS Compliance: Fixed various WordPress Coding Standards issues to ensure better compatibility and code quality.
Bug Fixes
- Corrected repository metadata and default branch references.
- Moved redirect URL generation logic to the core process function for better consistency across integrations.
- Fixed an issue where unreachable return statements were present after certain error responses.
Integration Notice
If you are using the REST API webhook, we recommend rotating your tokens after upgrading to this version to take advantage of the new secure hashing and rotation system.