WPAdverts_ARMember 0.4.1

New Features

• None.

Improvements

• The plugin now displays as "WP Adverts <> ARMember" on the Plugins screen, in the Settings menu, and on its settings page.

Bug Fixes

• None.

Upgrade Notes

This release changes display strings only. The plugin directory, main file, text domain, settings page slug, and option name are unchanged, so updates continue to apply to the existing installation.

WPAdverts_ARMember 0.4.0

New Features

• WPAdverts blocks and shortcodes are now filtered at render time, so protection covers block-theme templates, template parts, synced patterns, and widgets that never appear in post_content. Blocked content renders a member-only notice.
• WPAdverts admin-ajax actions are now access-controlled, including the logged-out adverts_show_contact, contact form, and gallery endpoints.
• Protected REST requests are resolved by post type instead of a fixed route-prefix list, covering oEmbed, /wp/v2/search, /wp/v2/media, and /wp/v2/comments.

Improvements

• Access decisions are memoized per request, since they are now evaluated on every block render and search query.
• Protected block, shortcode, and admin-ajax action names are shared constants, so detection and enforcement cannot drift apart.
• Minimum WordPress version raised to 7.0 and minimum PHP version raised to 8.0.
• Declared Requires Plugins: wpadverts, armember-membership, so WordPress lists both dependencies on the plugins screen and blocks activation until they are active. Plugin dependencies match by folder slug, so sites running ARMember premium (the armember folder) must remove the armember-membership entry from the plugin header and readme.txt.

Bug Fixes

• Unauthorized visitors could read advert data through REST routes outside the three protected prefixes: oEmbed for an advert permalink, /wp/v2/search with an advert subtype, and /wp/v2/media and /wp/v2/comments queries scoped to an advert. All now return HTTP 401.
• advert is a public post type, so a plain /?s=term search exposed advert titles and excerpts without touching a protected surface. Adverts are now removed from frontend and REST search results for unauthorized visitors.
• WPAdverts blocks and shortcodes placed outside post_content were served to everyone, because detection scanned only the page's own content.
• WPAdverts admin-ajax endpoints registered for logged-out users bypassed every access check.
• The redirect_to value on login redirects is now URL-encoded.