| @@ -2,9 +2,9 @@ | ||
| 2 | 2 | Contributors: elvinhaci |
| 3 | 3 | Tags: charts,mysql,sql,visualizer,sql chart |
| 4 | 4 | Requires at least: 5.0.0 |
| 5 | 5 | Tested up to: 7.1.2 |
| 6 | -Stable tag: 3.0.3 | |
| 6 | +Stable tag: 3.0.6 | |
| 7 | 7 | Donate link: https://guaven.com/service/small-thankyou-premium-support-service/ |
| 8 | 8 | License: GPLv2 or later |
| 9 | 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | 10 | |
| @@ -137,8 +137,24 @@ | ||
| 137 | 137 | |
| 138 | 138 | apply_filters('guaven_sqlcharts_rendered_sql'); |
| 139 | 139 | |
| 140 | 140 | == Changelog == |
| 141 | += 3.0.6 = | |
| 142 | +* FIX: Saving a chart failed with "A post type mismatch has been detected." (and edits appeared to revert) when a dynamic filter was named like a WordPress form field such as post_type. The live preview in the chart builder now renders filter inputs disabled so they are never submitted with the chart. | |
| 143 | +* IMPROVED: Hint in the Input Filters tab about tag names to avoid. | |
| 144 | +* FIX: Date/time X axis: labels of dates that are very close together are now placed one below the other instead of overlapping. | |
| 145 | + | |
| 146 | += 3.0.5 = | |
| 147 | +* FIX: Date/time X axis on Bar charts: bars now have a fixed, clearly visible width instead of shrinking to the closest pair of dates. | |
| 148 | +* FIX: Date/time X axis: the axis now labels only the dates present in the data instead of evenly spaced computed dates. | |
| 149 | + | |
| 150 | += 3.0.4 = | |
| 151 | +* SECURITY: Chart posts are now administrator-only at the capability level (all gvn_schart capabilities map to manage_options), so Contributors/Authors can no longer create or edit charts through any WordPress entry point such as XML-RPC. All guaven_sqlcharts_* custom fields are protected meta. | |
| 152 | +* SECURITY: The forbidden-command check now runs on the final SQL after all shortcode arguments and filter values are inserted, ";" is stripped from user-supplied values, and every statement must start with SELECT, WITH, SHOW, DESCRIBE or EXPLAIN. PREPARE/EXECUTE, LOCK, KILL, FLUSH and similar statements were added to the blocked list. | |
| 153 | +* SECURITY: The cached shortcode now keeps a separate cache entry per user and per dynamic filter value, so a chart using {current_user_*} tags or URL filters can no longer serve one visitor's result to another. | |
| 154 | +* SECURITY: The shortcode "params" attribute is validated and can no longer inject JavaScript into the chart script. | |
| 155 | +* The chart save handler now also requires manage_options and the gvn_schart post type. | |
| 156 | + | |
| 141 | 157 | = 3.0.3 = |
| 142 | 158 | * FIX: Using the same shortcode argument tag (e.g. {arg1}) more than once in the SQL, such as in both queries of a comparison chart, broke the chart with a fatal error. |
| 143 | 159 | * FIX: The [gvn_schart_2_cached] shortcode ignored arg1..arg19, width, height, table and params attributes; they are now passed through and each set of attributes is cached separately. |
| 144 | 160 | * IMPROVED: When the SQL contains {arg} tags, the builder shows the shortcode with the needed attributes and explains that the live preview runs without them. |
