A privacy fix for sites on nginx, plus interface fixes that only showed on themes other than ours.
- Security - Stored media could be downloaded by anyone with the address on servers that ignore .htaccess, which nginx does. Site Health now checks this by asking the server instead of trusting the deny file, and prints the exact rule to add when it finds a problem. Media set to Only me, Members or Friends was affected, and so was anything made private after being shared, because the older address kept working.
- Fix - A bulk actions bar with a Delete button, and a Loading indicator, no longer stay on screen on themes that do not reset the HTML hidden attribute. Both appeared permanently on the media library and every dashboard section.
- Fix - An Apply button meant only for browsers without JavaScript no longer shows alongside the filters that already apply themselves.
- Fix - Buttons in the chat panel header, the chat filter tabs, the grid selection control and Load More now meet the minimum tap target on a phone.
- Fix - The sort and filter controls on Explore and My Media no longer stretch to the full width of the page on themes that style select fields that way.
- Fix - The profile picture link in the My Media sidebar now meets the minimum tap target on a phone. The picture stays the same size; only the area you can tap grew.
- Fix - Clicking Compete in the My Media sidebar now opens the Compete page instead of leaving the content area blank. Any section that lives on its own page navigates properly, so a section added later cannot bring the problem back.
- Fix - A favorited document now shows a file icon in My Media instead of an empty tile, using the icon for its file type.
- Fix - The fullscreen button in the lightbox now works on the Activity page. It rendered and looked live but did nothing, while working everywhere else.
- Fix - Clicking a photo in the activity feed whose media has since been removed now opens its page and says so, instead of doing nothing at all.
- Dev - Journey coverage now asserts what these fixes changed: stored files are fetched directly and must not be readable, a privacy change is checked to actually revoke an address already in circulation, tap targets are measured against the plugin's own token rather than a restated number, and a new journey runs the frontend on a theme the project does not ship.
If your site runs nginx, do this after updating
Open Tools > Site Health. If you see "Media files can be downloaded by anyone with the link", copy the rule it shows into your nginx configuration and reload nginx. Nothing on your site loads media by that address, so the rule is safe to add. Sites on Apache are unaffected and need no action.
Verification
wp mvs cert 69 pass, 0 fail, 0 hole
wp mvs-pro cert 56 pass, 0 fail, 0 hole
composer ci green on both plugins, incl. journeys
PHPStan [OK] No errors, both repos
pristine install built zips installed fresh on a clean WordPress:
both active, frontend 200, debug.log 0 lines,
bundled SDK intact, degrade check passes
Every fix in this release was reproduced in the browser before any code changed, and re-verified the same way after.
Lockstep with WPMediaVerse Pro 2.4.1: https://github.com/vapvarun/wpmediaverse-pro/releases/tag/v2.4.1
Full changelog: https://wbcomdesigns.com/release-notes/mediaverse/