Edytor ról użytkownika

Rejestr zmian

[4.66.1] 25.08.2026

• Fix: URE_Assign_Role::$lib property was changed to protected.
• Fix: URE_Uninstall::delete_options() private function changed to protected.
• Fix: URE_Uninstall::init_options_list() referenced 'ure_task_queue’, which never matched URE_Task_Queue::OPTION_NAME (’ure_tasks_queue’), so that option was never deleted on uninstall.
• Fix: URE_Core::define_files() – class URE_Uninstall was not added correctly, null was written instead of class name.
• Fix: activating Pro while free was already active caused a fatal „Cannot redeclare ure_log_error()” error; the function declaration is now guarded with function_exists().
• Fix: activating this plugin while the paired Pro plugin was already active silently left both active instead of deactivating the paired one, because the register_activation_hook() call never ran in that request; it’s now registered as a standalone function directly in the main plugin file, ahead of the class_exists(’URE_Loader’) guard that was skipping it.

[4.66] 19.08.2026

• Update: Marked as compatible with WordPress 7.1
• Required PHP version increased up to 7.4
• Required WordPress version increased up to 4.6
• Update: Plugin loading code is enhanced.
• Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
• Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
• Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
• Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.
• Fix: URE_Protect_Admin used a bitwise „&” instead of a logical „&&” when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use „&&”, and the related IN() SQL clause is now hardened with array_map(’absint’, …).
• Update: nonce actions used on the Settings/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.
• Update: additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().
• Update: rel=”noopener noreferrer” was added to external links opened with target=”_new”.
• Update: hardcoded text strings in the role editor toolbar are now translatable.
• Fix: URE_Assign_Role used the %i SQL placeholder, which needs WordPress 6.2+, below the plugin’s declared minimum; replaced with direct interpolation of internal table names.
• Fix: URE_Editor::reset_user_roles() had an unescaped wp_die() message; further output escaping (esc_url(), esc_html(), absint()) was added across URE_Base_Lib, URE_Editor, URE_User_Other_Roles and URE_User_View.
• Fix: several request-var/database-result comparisons that could be bypassed by PHP type juggling are now strict, including URE_Grant_Roles::is_try_remove_admin_from_himself()’s „can’t remove your own admin role” check.
• Fix: URE_Base_Lib::set() now correctly rejects unknown properties instead of silently creating them; URE_View declares its $advert property explicitly.
• Update: $_SERVER[’REQUEST_URI’] is now validated and unslashed before sanitizing in URE_Lib::is_right_admin_path() and URE_User_Other_Roles::is_user_profile_extention_allowed().
• Update: posted role IDs are now sanitized (sanitize_key(), wp_unslash()) in URE_Editor, and its 'object’/role-selection request parameters are constrained to known values.
• Update: URE_Base_Lib::get_blog_ids() now uses get_sites() instead of a raw database query.
• Update: URE_Capability::revoke_caps() now uses get_users() instead of a raw database query.
• Update: URE_Protect_Admin::has_administrator_role() now uses user_can() instead of a raw database query.

[4.65] 21.05.2026

• Update: Marked as compatible with WordPress 7.0
• Update: Pages markup are modified to correspond WordPress 7.0 CSS changes.
• Update: „defined(’ABSPATH’)” guard was added to all PHP files to exclude PHP files direct execution.
• Update: sanitize_text_field(), sanitize_key(), sanitize_url() functions are used to secure user input before processing.
• Update: _nonce field checking was added before data update in addition to test made already on the higher level.

Pełną listę zmian można znaleźć w pliku changelog.txt.