v2.17.1 - Security Patch

What's Changed

Security patch. Hardens RSS description rendering, the transcript proxy, image caching, and public AJAX endpoints. Recommended for all users.

Security Fixes

• HTML Sanitization: Centralized RSS description sanitization (podloom_sanitize_rss_description_html()) strips javascript:, data:, and vbscript: hrefs and adds rel="noopener noreferrer" to external links; replaces three duplicated sanitization blocks
• Transcript Proxy: Enforces http/https scheme after URL validation, adds wp_http_validate_url() as a second SSRF layer, caps response size via limit_response_size before reading body into memory, checks Content-Length header
• Image Cache: URL validated with esc_url_raw + wp_http_validate_url + scheme check before any fetch; limit_response_size added to request args; Content-Length header checked before reading body
• Image Cache AJAX: Endpoint now requires a valid podloom_image_cache_nonce nonce (HTTP 403 on failure); queue items validated for required fields before processing
• Pagination: Public episode AJAX endpoints clamp limit to max(1, min(x, 50)) to prevent division-by-zero edge cases
• Episode Ingest: Episode description and content sanitized at cache time in refresh_feed_with_data() and re-sanitized on read in get_episodes() for defense-in-depth on legacy cached data
• Block Editor: Client-side sanitizeHtmlForPreview() sanitizer added to episode block editor preview, replacing raw dangerouslySetInnerHTML binding

v2.17.0

What's New

• Playlist Search: Added real-time search and filtering to the podcast episode playlist

Upgrade Notice

New playlist search! Filter podcast episodes in real time directly within the player.

What's Changed

• feat: Add playlist search feature by @thewpminute in #3

New Contributors

• @thewpminute made their first contribution in #3

Full Changelog: v2.16.0...v2.17.0

v2.16.0

What's New

Smart Caching System

• Dynamic Cache Duration: Cache duration now automatically adjusts based on podcast release patterns - daily shows refresh more often, inactive feeds less frequently
• Per-Feed Scheduling: Cron system checks each feed against its own optimal refresh interval
• Retry with Backoff: Failed feed fetches now use exponential backoff to avoid hammering unresponsive servers
• Persistent Storage: New database-backed storage ensures episodes survive cache clears

Performance Improvements

• FOUC Prevention: Players now fade in smoothly instead of flashing unstyled content
• Lazy Initialization: Dynamically-loaded players (AJAX, page builders) auto-initialize via CSS animation detection
• Playlist Prefetching: Large playlists automatically prefetch more episodes as you scroll
• Responsive Images: Episode artwork now uses srcset for optimal image sizes across devices

Accessibility

• Audio Element Cleanup: Native audio elements properly hidden from assistive tech (custom controls handle accessibility)

Full Changelog: v2.15.0...v2.16.0

v2.15.0

What's New

• Configurable Episode Limit: New "Max Episodes" setting in General tab to control how many episodes are parsed from RSS feeds (default: 50)
• Removed Playlist Cap: Playlist mode no longer limited to 100 episodes in both Gutenberg block and Elementor widget
• Flexible Feed Parsing: Parse as many episodes as your feed contains for podcasts with large back catalogs

Full Changelog: v2.14.2...v2.15.0

v2.14.2

Full Changelog: https://github.com/thewpminute/PodLoom/commits/v2.14.2