Notas da versão 2.0.0: 14 melhorias 15 correções 9 reforços de segurança
Melhoria
- Plugin moved to the Unity framework: settings are now in the "Widget Manager" menu in the dashboard with Activation, Migration, Status and Updates tabs.
- Plugin updates, purchase code activation and system status are handled by the Unity framework.
- The "Delete plugin and settings" uninstall option is moved from the Uninstall tab to the Migration tab, your choice is kept.
- Install and uninstall statistics are no longer sent, the mdp_widget_manager_send_statistics filter is not used anymore.
- Block-based widgets support (WordPress 5.8+, tested with WordPress 7.1): a "Widget Manager" panel in the block sidebar on Appearance → Widgets and in the Customizer. Rules are stored in the block itself, so they are saved together with the widget.
- Shortcode for block widgets: [widget id="block-N"] is shown in the block sidebar.
- IP rules support CIDR notation, e.g. 10.0.0.0/24.
- Date & Time rules use the site timezone (Settings → General) instead of UTC.
- "Repeat annually" periods may cross New Year, e.g. 20 Dec – 10 Jan.
- WordPress Content rule supports terms of any public taxonomy and custom post type search pages.
- Developer filters: mdp_widget_manager_display, mdp_widget_manager_visitor_ip, mdp_widget_manager_custom_php_enabled, mdp_widget_manager_user_can_edit_php, mdp_widget_manager_send_statistics.
- WIDGET_MANAGER_DISABLE_CUSTOM_PHP constant disables the Custom PHP rule entirely.
- Removed unused code: SVG upload helper, Elementor editor assets and leftover settings.
- Requirements: WordPress 6.0+, PHP 7.4+.
Correção
- No more blocking requests to the license server on every page load when the Envato item ID can't be fetched. Remote requests now run only in the dashboard, with timeouts and caching.
- "View details" for other plugins on the Plugins page (the plugins_api filter returned false).
- Plugin activation failed with "The link you followed has expired" during bulk activation and with WP-CLI.
- IP ranges were compared as text and short ranges like 46.0-46.1 never matched.
- "Repeat annually" broke dates with a single-digit day.
- "Same as other widget" read the settings of the wrong widget.
- The Cancel button did not discard changes made in the rules dialog.
- "Apply" did nothing if syntax highlighting was turned off in the user profile.
- The Copy shortcode button did not work for newly added widgets.
- Menu Items rule ignores trailing slashes and query strings, and no longer relies on the Host header.
- Categories selected in the WordPress Content rule never matched custom taxonomy archives.
- PHP 8.x warnings and errors (undefined properties and array keys, dynamic properties, non-WP_Widget widgets in the "Same as other widget" list).
- WordPress 6.7+ notice "Translation loading for the widget-manager domain was triggered too early".
- The Activation status link in the settings menu.
- Uninstall did not remove settings ("Delete plugin and settings") and did not clean up multisite sites.
Segurança
- Custom PHP rules can be created only by users with the unfiltered_html capability (Administrators on single sites, Super Admins on multisite). The code is signed when the widget is saved, and unsigned code is never executed. Existing 1.x rules are signed automatically the first time an Administrator opens the dashboard after the update.
- A broken Custom PHP rule no longer causes a fatal error on the whole site.
- The [widget] shortcode sanitizes before_widget, after_widget, before_title, after_title and title, which Contributors could use for stored XSS.
- The [widget] shortcode respects widget visibility rules, can't render inactive widgets, and is protected from infinite recursion.
- Plugin updates are downloaded with SSL certificate verification.
- Escaped widget, page, menu, term, role and sidebar names in the rules dialog, and widget titles in its header.
- Rule values are validated when saved.
- The purchase code and statistics are sent in the request body instead of the URL, and the purchase code is no longer printed on connection errors.
- The changelog on the Status tab is read from the plugin folder instead of a remote server.
