Skip to content

1.0.2

Choose a tag to compare

View all tags
@mohammad425 mohammad425 released this 14 Jul 09:18
· 167 commits to master since this release
1.0.2
34cbf46
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security-hardening release from a pre-release audit of the plugin. No breaking changes.

Security

  • Server card rendering — the server-designed result card renderer now fully escapes indexed field values (quotes included) and strips javascript:/vbscript:/data: URL schemes from templated href/src, so a value from an indexed document can no longer break out of an HTML attribute or inject a script-bearing link. Affected sites using the "Search Cloud templates" card source.
  • Domain-ownership verify endpoint — the public search-cloud/v1/verify route now requires the verification token the Search Cloud ping always sends, so a tokenless request can no longer read the write key.
  • Protected meta — WordPress protected meta (keys starting with _) is no longer pushed to Search Cloud through a meta: field mapping by default, preventing accidental exposure of internal data in public search. Opt a specific key back in with the new webhead_search_cloud/index/allow_protected_meta filter.

Build

  • Excluded the local .wp-env.override.json dev file from the release package.

Full details in PR #2.

Assets 3
Loading