JPKCom DB
Auf GitHub ansehen

Changelog — JPKCom Post Filter

Versionsverlauf des WordPress-Plugins JPKCom Post Filter.

Versionsverlauf von jpkcom-post-filter. Die Einträge stammen unverändert aus der README des Projekts. Eine ausführliche Anleitung mit Tipps findest du im Projekt-Guide.

1.2.3

  • CI: the lint and guard workflow now also runs on pushes to main. It only covered pull requests, so a direct push with bypass rights skipped every check
  • Changed: comments, workflow step names and CI output across the repository are now English throughout, and the developer notes in CLAUDE.md were translated and trimmed. No effect on the shipped plugin

1.2.2

  • Changed: Tested up to raised to WordPress 7.1
  • Changed: the bundled updater's runtime floor now matches the plugin's own minimum. It bailed out below WordPress 6.8 while the plugin header has required 6.9 for several releases, so the check could never fire on a supported installation
  • CI: the release manifest's fallback values for requires and tested now say 6.9 and 7.1. They only apply when the README metadata cannot be read, but a stale fallback would have published a minimum the plugin no longer supports

1.2.1

  • Added: plugin banners (assets/banner-1544x500.avif, assets/banner-772x250.avif) — a plain #3c4955 surface with no lettering. The update manifest already advertised these two URLs, but nothing was published under them, so the plugin card in wp-admin had a broken banner

1.2.0

  • Added: filter requests are answered with just the swappable zones instead of a complete page. The theme header, nav menus, sidebar widgets and the entire asset pipeline are skipped; the theme's loop still runs, because in auto-inject mode it produces the result markup. Measured on a test install: 60–72 % less transferred, 5–19 % less server time. The request goes through a /jpkpf-fragment/ URL segment rather than a query parameter, so a page cache that strips unknown parameters cannot serve a bare fragment to an ordinary visitor
  • Fixed: the noindex for filter URLs with unknown term slugs never took effect on a Rank Math site. Rank Math discards every wp_robots callback before writing its own tag, so the protection added in 1.1.7 was inert on exactly the sites it was written for. The rule now also hooks Rank Math and Yoast
  • Fixed: on a filter URL with no results the "no posts found" message and the whole filter bar were rendered below the footer. They now appear where the listing sits when there are results
  • Fixed: using the browser's back button after filtering left the previous results on screen and the filter buttons pressed — the history entry created by the initial page load carries no state, and the handler ignored it
  • Fixed: paginating a filtered list quietly stopped using AJAX. WordPress's canonical redirect did not recognise the fragment segment and appended the page it thought was missing, so the request 404'd and fell back to a full reload
  • Fixed: apcu_cache_info() raised a PHP warning wherever APCu is loaded but inactive for the running SAPI — apc.enable_cli defaults to 0, so every WP-CLI call produced one. With display_errors on it was printed into the response body
  • Added: rewrite rules are flushed once after a version change. register_activation_hook does not fire on an update, so new rules would otherwise never reach the database
  • Added: tests/browser-check.mjs drives a real filter click in headless Chromium

1.1.7

  • Fixed: the settings-directory containment check was a tautology — it compared realpath( WP_CONTENT_DIR ) with itself and never referenced the directory being validated, so it never fired. Since JPKCOM_POSTFILTER_SETTINGS_DIR is overridable from wp-config.php and holds PHP files that are later included, the path is now genuinely verified to resolve inside wp-content
  • Hardened: jpkcom_postfilter_build_query_args() no longer copies meta_key, meta_value, meta_query, s, author, year and monthnum verbatim into WP_Query. Each is now coerced to a safe shape and meta_query is not forwarded at all; callers that need it use the jpkcom_postfilter_query_args filter. No current caller passed user input, so this closes a latent path rather than an exploited one
  • SEO: filter URLs referencing term slugs that do not exist are now marked noindex, follow. They still return 200 with zero results, so existing links keep working, but they no longer generate unlimited indexable, self-canonicalising thin-content URLs. The check reuses the cached per-taxonomy term list and is keyed by taxonomy, never by the requested slugs
  • Added: tests/test-security.php — regression tests for all of the above, each written to fail against the previous implementation. Run in CI on every pull request

1.1.6

  • Security: update packages are now verified before installation — the verified file is handed to WordPress instead of being downloaded a second time, so the bytes that were checked are the bytes that get installed
  • Security: a missing or unfetchable SHA-256 checksum now aborts the update instead of installing unverified code (previously it silently skipped verification)
  • Security: pinned every GitHub Action to a full commit SHA and added Dependabot with a 7-day cooldown, so a moved tag can no longer change the release build
  • Security: tightened which download the updater claims, so sibling plugins cannot match each other's package
  • Fixed: sprintf() calls in the updater bound named arguments to a variadic parameter, which raises ArgumentCountError on PHP 8.3
  • Fixed: the "View Details" modal could fail with a TypeError when the manifest omitted requires_plugins
  • Performance: a failed manifest fetch is now cached for an hour instead of being retried on every admin request
  • Added: CI workflow on every pull request (PHP lint, named-argument check, YAML validation, action-pinning guard)
  • Housekeeping: removed stray editor backups and an unused messages.mo from the release package

1.1.5

  • Raised "Tested up to" to WordPress 7.0
  • Normalized license fallback defaults (updater and release workflow) to GPL-2.0-or-later with the HTTPS license URI

1.1.4

  • Security: updater prefers an exact match against the manifest download_url over the slug heuristic, so a tampered manifest can no longer bypass the checksum gate
  • Security: timing-safe checksum comparison (hash_equals()) with an is_string() guard against hash_file() failures
  • Security: manifest fetch via wp_safe_remote_get() (SSRF defense-in-depth)
  • Fixed PHP warning and missing contributor names in the plugin detail popup (display_name now provided)
  • Fixed PHP warning/deprecation on wp plugin list by completing the no_update transient entry (new_version, package, tested, requires_php)

1.1.3

  • Plus/Minus Icon styling — New CSS variables (--jpkpf-pm-color, --jpkpf-pm-font-size, --jpkpf-pm-font-weight) for independent styling of the +/– icons in filter buttons
  • Layout & Design → Filter tab — New "Plus/Minus Icon" section with Color, Font Size, and Font Weight fields
  • Force no underline — New checkbox in Layout & Design → Advanced that applies text-decoration: none !important to all filter buttons and icons, fixing themes that force underlines on links
  • Translations — Updated de_DE and de_DE_formal translations for all new strings

1.1.2

  • Plugin Updater — Fixed manual ZIP upload failing with "invalid URL" error by adding wp_http_validate_url() check in verify_download_checksum()
  • Release Workflow — Fixed ZIP packaging without top-level directory; WordPress now correctly recognises the update by using a staging directory with the plugin slug

1.1.1

  • .github/workflows/release.yml — "Build Gutenberg blocks" npm ci bugfix

1.1.0

  • Gutenberg Blocks — Three native blocks (Post Filter, Post List, Post Pagination) with live server-side preview, InspectorControls, and Full Site Editor support
  • Elementor Widgets — Three widgets (Post Filter, Post List, Post Pagination) in a dedicated category, loaded only when Elementor is active
  • Oxygen Builder Elements — Three elements (Post Filter, Post List, Post Pagination) using the OxyEl API, loaded only when Oxygen Builder Classic is active
  • Block pre-scan — Pagination blocks can be placed above or below the list block; the plugin pre-scans the block tree (FSE templates and post content) before rendering to ensure correct query availability
  • AJAX pagination swap — Standalone pagination elements (blocks/shortcodes/Elementor) are updated during AJAX filter requests via data-jpkpf-pagination attribute, keeping pagination links filter-aware
  • Pagination placeholder — When filter selection reduces results to a single page, pagination is hidden but preserved as a DOM placeholder; it automatically reappears when filters change back to multiple pages
  • Auto-inject guard — Prevents duplicate pagination insertion in auto-inject mode during AJAX swaps

1.0.0

  • Initial release
  • Faceted filtering for any post type and taxonomy
  • Four filter layouts: bar, columns, sidebar, dropdown
  • Three list layouts: cards, rows, minimal
  • SEO-friendly URL schema with WordPress rewrite rules
  • AJAX filtering with history.pushState
  • Auto-inject mode for archive/blog pages with configurable pagination position
  • Shortcodes: [jpkcom_postfilter_filter], [jpkcom_postfilter_list], [jpkcom_postfilter_pagination]
  • Interactive shortcode builder in admin
  • Custom taxonomy registration from Filter Groups admin page
  • Plus/Minus interaction mode for filter buttons
  • Show More button with configurable threshold
  • Four predefined color schemes (Default, Dark, Contrast, Monochrome)
  • Three stylesheet modes (Full, Variables only, Disabled)
  • Reset button visibility modes (Always, On selection, Never)
  • Bare Endpoint Behaviour (404, redirect to home, custom URL)
  • Max. Filters per Group limit (URL + JS enforcement)
  • Four-layer caching (object cache, transients, APCu, file cache)
  • Settings import/export (JSON)
  • Translations: de_DE, de_DE_formal