Release 4.2.2#1920
Merged
Merged
Conversation
Enforce the view capability and always target the current user in the stream_enable_live_update AJAX handler so a user can only change their own live update preference. Drop the client-supplied user field from the markup and AJAX payload, and add PHPUnit coverage for the authorization behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
The ondrej/php PPA added by setup-php changed its repository Label, which caused the apt-get update run by `playwright install --with-deps` to abort with exit code 100. Refresh apt metadata with --allow-releaseinfo-change first so browser dependency installation succeeds. Co-authored-by: Cursor <cursoragent@cursor.com>
Pin the JSON success flag in both the denial and current-user tests so a future refactor cannot silently return success without writing the expected user meta. Co-authored-by: Cursor <cursoragent@cursor.com>
Harden live update preference authorization
Reconcile develop with the 4.2.1 release that shipped from master: version bump and Plugin Check hardening (ABSPATH guards, output escaping, and related fixes) that were never merged back. Preserves develop's newer work, including the live update authorization fix. Co-authored-by: Cursor <cursoragent@cursor.com>
Sync master (4.2.1) back into develop
Bump version to 4.2.2 and document the live update authorization hardening in the changelog. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 4.2.2. This is a security-hardening patch release.
Included changes
stream_enable_live_updateAJAX handler so a user can only change their own live update preference (#1918).4.2.2instream.php,readme.txt(Stable tag), andclasses/class-plugin.php(VERSION).4.2.2.Release process
release/v4.2.2.v4.2.2-rc.1pre-release published for WP.org dry-run + ZIP smoke test.v4.2.2release published (deploys to WP.org).master, then mergemasterintodevelop.Notes
masterper the release convention (mirrors Release 4.2.1 #1916 for 4.2.1).developwas already reconciled with 4.2.1 via Sync master (4.2.1) back into develop #1919, so this diff contains only the new 4.2.2 changes.Made with Cursor