secure-custom-fields
Last commit date
assets
2 days ago
includes
2 days ago
lang
2 weeks ago
pro
7 months ago
schemas
3 months ago
src
2 months ago
vendor
2 days ago
SECURITY.md
1 year ago
acf.php
8 months ago
composer.json
2 months ago
index.php
1 year ago
license.txt
1 year ago
readme.txt
2 days ago
secure-custom-fields.php
2 days ago
readme.txt
448 lines
| 1 | === Secure Custom Fields === |
| 2 | Contributors: wordpressdotorg |
| 3 | Tags: fields, custom fields, meta, scf |
| 4 | Requires at least: 6.2 |
| 5 | Tested up to: 7.0 |
| 6 | Requires PHP: 7.4 |
| 7 | Stable tag: 6.9.4 |
| 8 | License: GPLv2 or later |
| 9 | License URI: https://www.gnu.org/licenses/gpl-2.0.html |
| 10 | |
| 11 | Secure Custom Fields boosts content management with custom fields and options. It deactivates Advanced Custom Fields to prevent duplicate code errors. |
| 12 | |
| 13 | == Description == |
| 14 | |
| 15 | Secure Custom Fields (SCF) extends WordPress’s capabilities, transforming it into a flexible content management tool. With SCF, managing custom data becomes straightforward and efficient. |
| 16 | |
| 17 | **Easily create fields on demand.** |
| 18 | The SCF builder makes it easy to add fields to WordPress edit screens, whether you’re adding a new “ingredients” field to a recipe or designing complex metadata for a specialized site. |
| 19 | |
| 20 | **Flexibility in placement.** |
| 21 | Fields can be applied throughout WordPress—posts, pages, users, taxonomy terms, media, comments, and even custom options pages—organizing your data how you want. |
| 22 | |
| 23 | **Display seamlessly.** |
| 24 | Using SCF functions, you can display custom field data in your templates, making content integration easy for all levels of developers. |
| 25 | |
| 26 | **A comprehensive content management solution.** |
| 27 | Beyond custom fields, SCF allows you to register new post types and taxonomies directly from the SCF interface, providing more control without needing additional plugins or custom code. |
| 28 | |
| 29 | **Accessible and user-friendly design.** |
| 30 | The field interface aligns with WordPress’s native design, creating an experience that’s both accessible and easy for content creators to use. |
| 31 | |
| 32 | Installing this plugin will deactivate plugins with matching function names/functionality, specifically Advanced Custom Fields, Advanced Custom Fields Pro, and the legacy Secure Custom Fields plugins, to avoid code errors (this is the same behavior as ACF Pro). |
| 33 | |
| 34 | Read more about Secure Custom Fields at [developer.wordpress.org/secure-custom-fields](https://developer.wordpress.org/secure-custom-fields/). |
| 35 | |
| 36 | = Features = |
| 37 | * Clear and easy-to-use setup |
| 38 | * Robust functions for content management |
| 39 | * Over 30 Field Types |
| 40 | |
| 41 | == Screenshots == |
| 42 | |
| 43 | 1. Add groups of custom fields. |
| 44 | 2. Easy to add custom content while writing. |
| 45 | 3. Need a new post type? Just add it! |
| 46 | 4. Navigate the various field types with ease. |
| 47 | |
| 48 | = Acknowledgement = |
| 49 | |
| 50 | This plugin builds upon and is a fork of the previous work done by the contributors of Advanced Custom Fields. Please see the plugin's license.txt for the full license and acknowledgements. |
| 51 | |
| 52 | |
| 53 | == Changelog == |
| 54 | = 6.9.5 = |
| 55 | *Release Date 7th August 2026* |
| 56 | |
| 57 | *Security* |
| 58 | |
| 59 | - REST updates now reject bidirectional field writes when the current user cannot edit an inverse target. |
| 60 | - Gallery AJAX responses no longer render attachments the current user cannot read, and empty responses now close the attachment sidebar. |
| 61 | - PDF files uploaded through File and Image fields must start with a valid PDF header. Rejected files are removed from the uploads directory. |
| 62 | - The internal `acf_encrypt()` and `acf_decrypt()` helpers now authenticate encrypted values with an HMAC and require the OpenSSL extension instead of falling back to unauthenticated base64 encoding. Anonymous inline `acf_form()` submissions now require OpenSSL on the server. |
| 63 | |
| 64 | = 6.9.4 = |
| 65 | *Release Date 3rd August 2026* |
| 66 | |
| 67 | *Security* |
| 68 | |
| 69 | - Front-end `acf_form()` submissions are now limited to the save target, form settings, and fields that the rendered form exposed. Submissions carrying missing, altered, or expired form data are rejected before validation or saving. |
| 70 | - The `acf/form/allowed_field_keys` filter now applies while a form renders rather than on submit. Keys added through it are still accepted on save, so forms extended at runtime keep working. |
| 71 | |
| 72 | = 6.9.3 = |
| 73 | *Release Date 28th July 2026* |
| 74 | |
| 75 | *Hardening* |
| 76 | |
| 77 | - Restricted Local JSON writes for multisite users who are not super admins to save paths inside the current site's uploads directory. |
| 78 | - Limited Options Page saves to values for fields assigned to the current page. |
| 79 | - Excluded posts the current user cannot read from Post Object, Page Link, and Relationship field queries. |
| 80 | - Block render templates are now always resolved from the registered block path, and template paths using stream wrappers are rejected. |
| 81 | - Reduced User field values in REST API responses to user IDs, including within Group, Clone, Repeater, and Flexible Content fields. |
| 82 | |
| 83 | = 6.9.2 = |
| 84 | *Release Date 21st July 2026* |
| 85 | |
| 86 | *Fixes* |
| 87 | |
| 88 | - Fixed Google Maps field values being double-encoded when saved inside a block. |
| 89 | - Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved. |
| 90 | - Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template. |
| 91 | - V2 and V3 blocks no longer crash when rendering an oEmbed field whose title begins with `[` or `{`. |
| 92 | - Field group location rules without a location value no longer cause PHP warnings on page load. |
| 93 | - Improved the appearance of the URL, Number, and Select fields on WordPress 7.0+. |
| 94 | - Fields now save on WooCommerce orders when using HPOS in compatibility mode. |
| 95 | |
| 96 | = 6.9.1 = |
| 97 | *Release Date 2nd July 2026* |
| 98 | |
| 99 | *Security* |
| 100 | |
| 101 | - Capped the number of user-contributed choices that can be persisted to checkbox, radio, and select field definitions at 1000 by default, with a new `acf/fields/max_appended_choices` filter for customization. |
| 102 | - The WooCommerce order fields save handler is now only registered on order edit screens. |
| 103 | |
| 104 | *Fixes* |
| 105 | |
| 106 | - Fixed PHP 8.5 deprecation notices when numeric post ID values contain floats that cannot be represented as integers. |
| 107 | |
| 108 | = 6.9.0 = |
| 109 | *Release Date 23rd June 2026* |
| 110 | |
| 111 | *Hardening* |
| 112 | |
| 113 | - Improved input validation when duplicating field groups, post types, and taxonomies, including ownership and type checks on the target. |
| 114 | - Restricted persistence of custom choices on checkbox, radio, and select fields to authorized users. |
| 115 | - Constrained the field update ability input schema to known properties. |
| 116 | - Sanitized flexible content layout labels and cleaned up orphaned row meta on layout removal. |
| 117 | - Hardened REST type field-group metadata exposure and oEmbed source formatting. |
| 118 | - Normalized non-scalar block binding attribute values. |
| 119 | - Required authentication and nonce verification before saving fields on WooCommerce orders. |
| 120 | - Preserved localization wrappers in PHP exports and corrected nav menu field ID output. |
| 121 | |
| 122 | = 6.8.9 = |
| 123 | *Release Date 15th June 2026* |
| 124 | |
| 125 | *Security* |
| 126 | |
| 127 | - Hardened the escaping of wp_options LIKE queries used when loading option-page meta and during taxonomy term cleanup, switching to esc_like() so option-name prefixes are always matched as literals rather than as patterns. |
| 128 | |
| 129 | *Fixes* |
| 130 | |
| 131 | - The URL, text, textarea, and select-style fields no longer raise PHP errors when a non-scalar value (such as an array) is submitted; such input is now treated as invalid. |
| 132 | |
| 133 | = 6.8.8 = |
| 134 | *Release Date 11th June 2026* |
| 135 | |
| 136 | *Security* |
| 137 | |
| 138 | - AJAX field handlers now validate that the request nonce was created for the expected field type, so a nonce minted for one field type can no longer be replayed against another field type's AJAX handler. The gallery field was also aligned with the typed nonce scheme used by all other AJAX fields. |
| 139 | - `acf_decrypt()` now treats malformed payloads as a decrypt failure and returns `false` instead of emitting PHP 8 warnings. |
| 140 | |
| 141 | *Enhancements* |
| 142 | |
| 143 | - `acf_inline_toolbar_editing_attrs()` now accepts a `return_array` argument that returns the attributes as an escaped array suitable for use with `wp_get_attachment_image()`. |
| 144 | |
| 145 | *Fixes* |
| 146 | |
| 147 | - `acf_form()` with `'post_id' => 'new_post'` and a `fields` list of field names no longer fatal errors when `acf_form_head()` runs before WordPress's main query is built. |
| 148 | - Multiple `acf_form()` calls wrapped inside a single outer form tag with one submit button no longer silently drop field values, `post_title`, or `post_content` from the non-last forms. A new `acf/form/meta_ttl` filter controls how long per-form metadata remains valid. |
| 149 | - Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate. |
| 150 | - Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll. |
| 151 | |
| 152 | = 6.8.7 = |
| 153 | *Release Date 8th June 2026* |
| 154 | |
| 155 | *Fixes* |
| 156 | |
| 157 | - SCF's Abilities API integration for its internal post types no longer triggers PHP warnings, notices, or a fatal error (500) on block editor and REST API requests when another active plugin builds the WordPress abilities registry earlier in the request; registration is skipped cleanly in that case and normal abilities behavior is otherwise unchanged. |
| 158 | |
| 159 | = 6.8.6 = |
| 160 | *Release Date 27th May 2026* |
| 161 | |
| 162 | *Security* |
| 163 | |
| 164 | - Hardened the oEmbed field's AJAX preview handling by restricting provider discovery for visitors and users without content-authoring capability while preserving previews from WordPress's registered oEmbed providers. |
| 165 | - Hardened front-end `acf_form()` submission processing so the `post_title` and `post_content` form options are respected on save, and the save pipeline only accepts values for fields the rendered form exposed. A new `acf/form/allowed_field_keys` filter is available for sites that legitimately extend a form at runtime. |
| 166 | |
| 167 | = 6.8.5 = |
| 168 | *Release Date 19th May 2026* |
| 169 | |
| 170 | *Features* |
| 171 | |
| 172 | Backports 6.8.1 feature work into SCF. |
| 173 | = 6.8.4 = |
| 174 | *Release Date 30th April 2026* |
| 175 | |
| 176 | *Features* |
| 177 | |
| 178 | - Backports 6.8.0 and 6.8.0.1 feature work into SCF. |
| 179 | - AI integration: SCF now integrates with the WordPress Abilities API, allowing external consumers, including AI tools, to manage field groups, post types, and taxonomies when explicitly enabled via the `enable_acf_ai` feature flag. |
| 180 | - Structured data: SCF can now generate JSON-LD structured data fields when explicitly enabled via the `enable_schema` feature flag. |
| 181 | - WP-CLI: Added `wp scf json` and backward-compatible `wp acf json` commands for importing, exporting, syncing, and checking the status of SCF JSON files. |
| 182 | - Post types: SCF custom post types now support the WordPress 6.9+ Notes editor feature via a new Notes checkbox in the Supports settings. |
| 183 | - JSON Schemas: Added v1 schemas for supported field types and updated field group, post type, and taxonomy schemas. |
| 184 | |
| 185 | *Enhancements* |
| 186 | |
| 187 | - Blocks V3: The Open in Expanded Editor button text can now be customized via a new `acf.expandedEditorButtonText` block.json property. |
| 188 | - Blocks V3: Added an `acf/blocks/default_expanded_editor_button_text` PHP filter to customize the default Open in Expanded Editor button text. |
| 189 | - Blocks V3: The edit and Open in Expanded Editor buttons can now be hidden via a new `acf.expandedEditorButtons` block.json property. |
| 190 | - Blocks V3: Added a `blocks/expanded_editor_overlay_class` JavaScript filter for customizing the Expanded Editor modal overlay class. |
| 191 | - Blocks V3: The block form HTML is now preloaded alongside the preview, eliminating an extra AJAX call on mount. |
| 192 | - Blocks V3: Expanded Editor buttons are now hidden for V3 blocks that have no fields assigned. |
| 193 | - SCF inline script tags now use `wp_print_inline_script_tag()` for Content Security Policy (CSP) compliance and nonce support. |
| 194 | |
| 195 | *Fixes* |
| 196 | |
| 197 | - V3 blocks with WYSIWYG fields no longer enqueue TinyMCE editor assets on the frontend. |
| 198 | - V3 blocks with identical attributes and different InnerBlocks content no longer return cached output from the first block on the frontend. |
| 199 | - Flexible Content fields now properly clean up nested postmeta when a parent layout containing nested Flexible Content fields is deleted. |
| 200 | - The Expanded Editor Done button now stays disabled until the AJAX save completes, preventing data loss. |
| 201 | - Pressing Escape while the Expanded Editor is saving will no longer close the modal, preventing data loss. |
| 202 | - InnerBlocks content containing backslashes or dollar signs now renders correctly. |
| 203 | - Auto Inline Editing now only applies to SCF Blocks V3, resolving incorrect hover/focus borders appearing on V2 blocks. |
| 204 | - Auto Inline Editing blocks now receive block context variables in render templates. |
| 205 | - Auto Inline Editing now works with blocks using `renderCallback`. |
| 206 | - Validation errors in the V3 Expanded Editor no longer cause a dead-end state. |
| 207 | - Icon Picker selections in Repeater fields no longer disappear. |
| 208 | - Range field number input now syncs to the slider and correctly updates V3 block previews. |
| 209 | - Message field Name and Instructions settings are no longer shown in the field group editor. |
| 210 | - Image field no longer crashes in WordPress 7.0 release candidates. |
| 211 | - V3 blocks registered via PHP now correctly show the Open in Expanded Editor button. |
| 212 | - Flexible Content disabled layouts now work correctly in Blocks V3. |
| 213 | |
| 214 | = 6.8.3 = |
| 215 | *Release Date 22th April 2026* |
| 216 | |
| 217 | *Fixes* |
| 218 | |
| 219 | - Fix command palette type error on wp-admin. |
| 220 | - Plugins requiring ACF are also validated for SCF. |
| 221 | - REST API calls now honor the user's `unfiltered_html` capability. |
| 222 | - Block Preview rendering now verifies the user can edit the target post. |
| 223 | - Paginated Repeater fields now verify the user can edit the target post. |
| 224 | - Flexible Content layout title AJAX requests now validate a security nonce. |
| 225 | - Clone field AJAX endpoints now enforce SCF admin permissions on field group listings. |
| 226 | |
| 227 | = 6.8.2 = |
| 228 | *Release Date 24th March 2026* |
| 229 | |
| 230 | *Fixes* |
| 231 | |
| 232 | - AJAX Handlers: Prefix field-specific nonces to resolve an issue where third-party nonces could be treated as valid for AJAX calls. |
| 233 | - Block Preview: Verify that user has access to post specified via block context. |
| 234 | - Repeater Field: Verify that user has access to specified post. |
| 235 | - REST API: Apply KSES sanitization to field content saved by users without `unfiltered_html` capabilities. |
| 236 | - REST API: Respect `show_in_rest` setting for field groups in `/types` endpoint. |
| 237 | |
| 238 | = 6.8.1 = |
| 239 | *Release Date 11th March 2026* |
| 240 | |
| 241 | *Backports from 6.7.1* |
| 242 | |
| 243 | - Security - User field AJAX queries now enforce field-configured role restrictions and validate search permissions. |
| 244 | - Security - Post Object, Relationship, and Page Link field AJAX queries now enforce field-configured restrictions for post status, post type, and taxonomy. |
| 245 | - Site Health - Track blocks using auto inline editing. |
| 246 | |
| 247 | = 6.8.0 = |
| 248 | *Release Date 30 Dec 2025* |
| 249 | |
| 250 | *Features* |
| 251 | |
| 252 | - Abilities integration: addded field abilities for Field Groups. |
| 253 | - Abilities integration: added trash/untrash abilities for internal post types. |
| 254 | - All backports up to 6.7.0.2. |
| 255 | - JSON Schemas: Added several fields schemas. |
| 256 | - WooCommerce HPOS: Added support for custom fields on any WooCommerce Order Types. |
| 257 | - Added PHPUnit tests. |
| 258 | |
| 259 | *Fixes* |
| 260 | |
| 261 | - Hide duplicated Command Palette Commands on WP 6.9+. |
| 262 | - Fix field schema validation for WP Rest API. |
| 263 | - Fix checkbox toggle functionality. |
| 264 | |
| 265 | |
| 266 | = 6.7.0 = |
| 267 | |
| 268 | = 6.7.1 = |
| 269 | *Release Date 10 Dec 2025* |
| 270 | |
| 271 | *Features* |
| 272 | |
| 273 | - JSON Schemas: Added Options Pages schema. |
| 274 | |
| 275 | *Fixes* |
| 276 | |
| 277 | - Fixed too-early validation of schemas causing a fatal error. |
| 278 | - Fix block validation on WordPress 6.2. |
| 279 | |
| 280 | = 6.7.0 = |
| 281 | *Release Date 3 Dec 2025* |
| 282 | |
| 283 | *Features* |
| 284 | |
| 285 | - Tested compatibility up to WordPress 6.9. |
| 286 | - Abilities support. Taxonomy abilities. |
| 287 | - JSON schemas. Taxonomy schema. |
| 288 | |
| 289 | |
| 290 | = 6.6.0 = |
| 291 | *Release Date 19 Nov 2025* |
| 292 | |
| 293 | *Features* |
| 294 | |
| 295 | - Backported features up to 6.6.0. |
| 296 | - Abilities API integration. Post Type abilities. |
| 297 | - JSON schemas validation infrastructure. |
| 298 | |
| 299 | *Fixes* |
| 300 | |
| 301 | - Fixed Function in network.php |
| 302 | - SCF label in "More" menu. |
| 303 | - Get the formatted_value from the original field value. |
| 304 | - Blocks V3: Fix flexible content not working in sidebar - modal. |
| 305 | - Use specific entity prefixes for key generation when duplicating entities. |
| 306 | |
| 307 | |
| 308 | = 6.5.7 = |
| 309 | *Release Date 28 Aug 2025* |
| 310 | |
| 311 | *Features* |
| 312 | |
| 313 | - Flexible Content layouts can now be renamed in the post editor, giving content editors better clarity when managing layouts. |
| 314 | - Flexible Content layouts can now be disabled, preventing them from rendering on the frontend without needing to delete their data. |
| 315 | - Flexible Content layouts can now be collapsed and expanded in bulk for faster content editing. |
| 316 | - Editing a Flexible Content layout now highlights the layout being edited, making it easier to identify. |
| 317 | - The Date and Date Time Picker fields can now be configured to default to the current date. |
| 318 | - Custom Icon Picker tabs now work correctly when used inside an ACF Block. |
| 319 | - Duplicating a Field Group no longer causes a fatal error when using Russian translations. |
| 320 | - ACF classes no longer use dynamic class properties, improving compatibility with PHP 8.2+. |
| 321 | - Field group metabox collapse and expand buttons are no longer misaligned in the post editor. |
| 322 | - HTML is now escaped from field validation errors and tooltips. |
| 323 | - Added a new source parameter to the /wp/v2/types REST API endpoint that allows filtering post types by their origin: core (WordPress built-in), scf (for SCF managed types), or other for the rest of CPTs. |
| 324 | |
| 325 | *Security* |
| 326 | |
| 327 | – Unsafe HTML in field group labels is now correctly escaped for conditionally loaded field groups, resolving a JS execution vulnerability in the classic editor. |
| 328 | – HTML is now escaped from field group labels when output in the ACF admin. |
| 329 | – Bidirectional and Conditional Logic Select2 elements no longer render HTML in field labels or post titles. |
| 330 | – The acf.escHtml function now uses the third party DOMPurify library to ensure all unsafe HTML is removed. A new esc_html_dompurify_config JS filter can be used to modify the default behaviour. |
| 331 | – Post titles are now correctly escaped whenever they are output by ACF code. Thanks to Shogo Kumamaru of LAC Co., Ltd. for the responsible disclosure. |
| 332 | – An admin notice is now displayed when version 3 of the Select2 library is used, as it has now been deprecated in favor of version 4. |
| 333 | |
| 334 | = 6.5.6 = |
| 335 | |
| 336 | Release discarded due to SVN errors. |
| 337 | |
| 338 | = 6.5.5 = |
| 339 | *Release Date 31 Jul 2025* |
| 340 | |
| 341 | *Features* |
| 342 | |
| 343 | - Connect block attributes with custom fields via UI. |
| 344 | - Remove the word 'New' from default `add-new*` label values. |
| 345 | |
| 346 | *Bug Fixes* |
| 347 | |
| 348 | - Bug fix: Prevent fatal if class does not exist on Beta Features. |
| 349 | |
| 350 | |
| 351 | = 6.5.4 = |
| 352 | *Release Date 30 Jul 2025* |
| 353 | |
| 354 | Revert from 6.5.2. |
| 355 | |
| 356 | |
| 357 | = 6.5.2 = |
| 358 | *Release Date 30 Jul 2025* |
| 359 | |
| 360 | *Features* |
| 361 | |
| 362 | - Connect block attributes with custom fields via UI. |
| 363 | - Remove the word 'New' from default `add-new*` label values. |
| 364 | |
| 365 | |
| 366 | = 6.5.1 = |
| 367 | *Release Date 2 Jul 2025* |
| 368 | |
| 369 | *Bug Fixes* |
| 370 | |
| 371 | - Command Palette: Use `@wordpress\icons` instead of Dashicons. |
| 372 | |
| 373 | |
| 374 | = 6.5.0 = |
| 375 | *Release Date 23 Jun 2025* |
| 376 | |
| 377 | *Enhancements & Features* |
| 378 | |
| 379 | - Added Command Palette support. |
| 380 | - Added editor preview to acf-field source. |
| 381 | - Added an endpoint to retrieve the custom fields of a post type. |
| 382 | - Added nav menu as field type. |
| 383 | - Added compatibility with Woo HPOS for order fields and subscriptions. ( Ported from ACF ) |
| 384 | - Create new options when editing a fields value on Selector. ( Ported from ACF ) |
| 385 | - The “Escaped HTML” warning notice is now disabled by default. ( Ported from ACF ) |
| 386 | - Added new `acf/fields/icon_picker/{tab_name}/icons` filter ( Ported from ACF ) |
| 387 | |
| 388 | *Bug Fixes* |
| 389 | |
| 390 | - Update initialization of the acfL10n object to ensure it's available globally. |
| 391 | - SCF Blocks are now forced into preview mode when editing a synced pattern. ( Ported from ACF ) |
| 392 | - SCF no longer causes an infinite loop in bbPress when editing replies. ( Ported from ACF ) |
| 393 | - Changing a field type no longer enables the “Allow Access to Value in Editor UI” setting. ( Ported from ACF ) |
| 394 | - Blocks registered via acf_register_block_type() with a `parent` value of `null` no longer fail to register. ( Ported from ACF ) |
| 395 | - Fix AJAX repeater pagination. ( Ported from ACF ) |
| 396 | - Paginated Repeater fields no longer save duplicate values when saving to a WooCommerce Order with HPOS disabled ( Ported from ACF ) |
| 397 | |
| 398 | *Testing* |
| 399 | |
| 400 | - Added an initial batch of e2e tests. |
| 401 | |
| 402 | = 6.4.2 = |
| 403 | *Release Date 14 Apr 2025* |
| 404 | |
| 405 | * Resolved issue with shortcode translation not parsing correctly. |
| 406 | * Improve validation for an URL on field admin. |
| 407 | |
| 408 | = 6.4.1 = |
| 409 | *Release Date 7 Mar 2025* |
| 410 | |
| 411 | * Forked from Advanced Custom Fields® |
| 412 | * Various updates to coding standards. |
| 413 | * Updated to rely on the WordPress.org translation packs for all strings. |
| 414 | |
| 415 | = 6.3.9 = |
| 416 | *Release Date 22nd October 2024* |
| 417 | |
| 418 | * Version update release |
| 419 | |
| 420 | = 6.3.6.3 = |
| 421 | *Release Date 15th October 2024* |
| 422 | |
| 423 | * Security - Editing a Field in the Field Group editor can no longer execute a stored XSS vulnerability. Thanks to Duc Luong Tran (janlele91) from Viettel Cyber Security for the responsible disclosure |
| 424 | * Security - Post Type and Taxonomy metabox callbacks no longer have access to any superglobal values, hardening the original fix from 6.3.6.2 even further |
| 425 | * Fix - SCF Fields now correctly validate when used in the block editor and attached to the sidebar |
| 426 | |
| 427 | = 6.3.6.2 = |
| 428 | *Release Date 12th October 2024* |
| 429 | |
| 430 | * Security - Harden fix in 6.3.6.1 to cover $_REQUEST as well. |
| 431 | * Fork - Change name of plugin to Secure Custom Fields. |
| 432 | |
| 433 | = 6.3.6.1 = |
| 434 | *Release Date 7th October 2024* |
| 435 | |
| 436 | * Security - SCF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure) |
| 437 | |
| 438 | == Upgrade Notice == |
| 439 | |
| 440 | = 6.9.5 = |
| 441 | Security: Anonymous inline forms now require OpenSSL. |
| 442 | |
| 443 | = 6.9.4 = |
| 444 | Security: front-end form submissions are now bound to the rendered form. Purge page caches after updating so visitors are served freshly rendered forms. |
| 445 | |
| 446 | = 6.4.2 = |
| 447 | Security: improves validation of an URL in an admin field. |
| 448 |