Repository navigation
Playback fixes for cached pages, playlists and the core embed block, plus a player brand colour.
- New - Brand colour setting for the player, with a live preview of the watermark, badge and button in Settings.
- New - Playback options (autoplay, loop, muted, controls) can be set on a playlist.
- New - A video's featured image is used as its poster.
- Improve - A playlist now plays through the same protected player as a single video, so its videos are watermarked, tracked and counted. Moving to another item swaps the player in without reloading the page.
- Improve - The playlist shortcode loads its script, so clicking or pressing Enter on an item switches the video.
- Improve - Videos added with the standard Vimeo or YouTube embed block are protected. Only the plain link is stored in the post, so they were not detected before.
- Improve - Vimeo videos show only MediaShield's full screen button. Vimeo's own button took only the picture full screen and left the watermark behind.
- Improve - The stream limit counts the other devices an account is watching on, not its players, so a page with several videos no longer shows "Too many active streams".
- Improve - The player's text is translatable.
- Fix - A protected self-hosted video no longer returns access denied to logged-in members, administrators included, when the page was cached or left open for hours. The player asks for a fresh address and resumes where it stopped.
- Fix - Pages that print a protected player are marked not cacheable, so a cached copy can no longer carry one viewer's access to another.
- Fix - The empty gap above a video added with the embed block is gone.
- Fix - A YouTube video added with the embed block keeps its full size instead of collapsing to nothing.
- Fix - Uploaded video files play for logged-in viewers when Hide Video Source URL is off and Require Login is on.
- Fix - Video addresses keep encoded characters such as %20 when saved.
- Fix - The video folder warning now appears on the Site Health screen, and the nginx rule uses the site's real uploads path.
- Fix - Pasted self-hosted URLs play when Hide Video Source URL is on.
- Fix - Bunny addresses are recognised the same way on every screen, including video.bunnycdn.com links.
- Fix - Licence and update screen assets load on hosts with a symlinked or non-standard document root, and a failed update check no longer breaks the plugin list on PHP 8.
- Fix - The licence key that ships with the plugin is no longer sent to the licence server on every admin request. A refused or unreachable server is retried once a day, and admin-ajax, cron and REST requests skip it.
- Security - The page no longer prints the visitor's name or IP address in the watermark settings, so a page cache cannot show one visitor's details to the next. The watermark still shows both while a video plays.
- Security - Playback heartbeats with an invalid session token are rate limited per visitor instead of per token, so a flood of made-up tokens is refused.
- Security - A self-hosted video file now plays, and is deleted, only for the video that uploaded it. Naming another video's file in your own no longer streams or removes it. Existing videos are assigned their file automatically after the update.
- Dev - GET /mediashield/v1/stream/{id}/url returns a freshly signed stream address for the current viewer.
- Dev - StreamController::signed_url() is the one place a stream address is signed.
- Compat - Aligned with MediaShield Pro 1.4.0. Install both updates together.
MediaShield Pro 1.4.0 ships with this release: https://github.com/vapvarun/mediashield-pro/releases/tag/v1.4.0
Full changelog: https://wbcomdesigns.com/release-notes/mediashield/