Repository navigation
- Fix: Hardened the database replacements against a possible PHP Object Injection, which could be exploited under certain conditions, safely disclosed by the Wordfence, PatchStack and WPScan teams;
- Fix: Users with the Author role now only see the standard replace option; renaming, changing the location and background removal are limited to Editors and above, following a security report from the Wordfence team;
- Fix: Strengthened the folder checks when a file is replaced into a new location, including on multisite installations, following a report from Adam Kahlon via the WPScan team;
- Fix: Uploaded replacement files now go through the same WordPress checks as regular media uploads, following a report from Adam Kahlon via the WPScan team;
- Fix: The database replacement no longer runs when there is nothing to search for (thanks to @ibeninc for reporting and proposing the fix);
- Compat: Improved the Breakdance builder integration and the cache purge after a replacement;
- Tweak: A few interface improvements when the replaced file is an SVG;
- Tweak: The admin scripts no longer depend on jQuery;
- Tweak: Removed the outdated bundled translation files, translations are provided through WordPress.org.
Contributors
ibeninc