| @@ -3,10 +3,10 @@ | ||
| 3 | 3 | Tags: wp docs, memphis-documents-library, documents, library folders, directory |
| 4 | 4 | License: GPL2 |
| 5 | 5 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 6 | 6 | Requires at least: 3.5 |
| 7 | -Tested up to: 6.8 | |
| 8 | -Stable tag: 2.2.3 | |
| 7 | +Tested up to: 7.1 | |
| 8 | +Stable tag: 2.3.4 | |
| 9 | 9 | Requires PHP: 7.0 |
| 10 | 10 | A documents management tool for education portals. |
| 11 | 11 | |
| 12 | 12 | == Description == |
| @@ -135,8 +135,21 @@ | ||
| 135 | 135 | 19. WP Docs directory after importing files from Memphis directory. |
| 136 | 136 | 20. File description instead of file name. |
| 137 | 137 | |
| 138 | 138 | == Changelog == |
| 139 | += 2.3.4 = | |
| 140 | +* Security: Fixed Stored XSS (CVE-2026-81782) — hardened `sanitize_wpdocs_data()` and added `esc_html`/`esc_attr`/`esc_url` output escaping across frontend and admin views. * Security: Added capability checks to `wpdocs_add_files`, `wpdocs_delete_files`, `wpdocs_update_folder`; removed `nopriv` from `wpdocs_update_view`. | |
| 141 | += 2.3.1 = | |
| 142 | +* Enhancement: Added Memphis Documents Library verification tool to check imported files and folders integrity, "Import Missing Items Only" button, clickable folder links in verification tree, and full localization support. [Thanks to Teboho Ramonyaluoa][2026-06-05] | |
| 143 | += 2.3.0 = | |
| 144 | +* Security: Escaped all dynamic attributes and text in the folder <li> output for XSS safety using esc_attr() and esc_html__(). | |
| 145 | += 2.2.9 = | |
| 146 | +* Security: Fixed Broken Access Control in AJAX handlers `wpdocs_create_folder` and `wpdocs_delete_folder` by adding proper capability checks (`manage_options`). [Thanks to hhhai / Patchstack] | |
| 147 | +* Fix: Deleting unused folder in WP Docs. [Thanks to Jordan Wells / gclna.org] | |
| 148 | += 2.2.8 = | |
| 149 | +* Fix: Deleting unused folder in WP Docs. [Thanks to Jordan Wells / gclna.org] | |
| 150 | += 2.2.5 = | |
| 151 | +* Fix: Imagick related exceptions added. [Thanks to James Oliver / Paluma] | |
| 139 | 152 | = 2.2.2 = |
| 140 | 153 | * Fix: Discovered and reported this Cross Site Scripting (XSS) vulnerability in directory renaming functionality. [Thanks to b4orvn / Patchstack] |
| 141 | 154 | = 2.2.1 = |
| 142 | 155 | * Fix: $wpdb->prepare() for every database query that is not completely hard-coded and accepts user-supplied input to prevent SQL injection. [Thanks to Arkadiusz Hydzik / Peter Greaves / Wordfence] |
| @@ -355,8 +368,20 @@ | ||
| 355 | 368 | = 1.0 = |
| 356 | 369 | * Initial Release of WP Docs |
| 357 | 370 | |
| 358 | 371 | == Upgrade Notice == |
| 372 | += 2.3.4 = | |
| 373 | +Security release. Fixes Stored XSS (CVE-2026-81782) and adds missing capability checks to AJAX handlers. Update immediately. | |
| 374 | += 2.3.1 = | |
| 375 | +Enhancement: Added Memphis Documents Library verification tool to check imported files and folders integrity, "Import Missing Items Only" button, clickable folder links in verification tree, and full localization support. | |
| 376 | += 2.3.0 = | |
| 377 | +Security: Escaped all dynamic attributes and text in the folder <li> output for XSS safety using esc_attr() and esc_html__(). | |
| 378 | += 2.2.9 = | |
| 379 | +This update includes a **security fix** for Broken Access Control in folder creation and deletion via AJAX. Only administrators can now create or delete folders, preventing unauthorized users from modifying your documents. We also fixed an issue with deleting unused folders. | |
| 380 | += 2.2.8 = | |
| 381 | +Fix: Deleting unused folder in WP Docs. | |
| 382 | += 2.2.5 = | |
| 383 | +Fix: Imagick related exceptions added. | |
| 359 | 384 | = 2.2.2 = |
| 360 | 385 | Fix: Discovered and reported this Cross Site Scripting (XSS) vulnerability in directory renaming functionality. |
| 361 | 386 | = 2.2.1 = |
| 362 | 387 | Fix: $wpdb->prepare() for every database query that is not completely hard-coded and accepts user-supplied input to prevent SQL injection. |
