From 052f0ca97d1a52f384adb441fac477ceb878fd7c Mon Sep 17 00:00:00 2001 From: Tom Usborne Date: Wed, 14 Feb 2024 11:46:23 -0700 Subject: [PATCH 1/4] 1.8.3 --- package.json | 2 +- plugin.php | 4 ++-- readme.txt | 4 +++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 3a5db270b..689587a55 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "generateblocks", - "version": "1.8.2", + "version": "1.8.3", "private": true, "description": "A small collection of lightweight WordPress blocks that can accomplish nearly anything.", "author": "Tom Usborne", diff --git a/plugin.php b/plugin.php index 1807499dd..ced8293b3 100644 --- a/plugin.php +++ b/plugin.php @@ -5,7 +5,7 @@ * Description: A small collection of lightweight WordPress blocks that can accomplish nearly anything. * Author: Tom Usborne * Author URI: https://tomusborne.com - * Version: 1.8.2 + * Version: 1.8.3 * Requires at least: 5.9 * Requires PHP: 7.2 * License: GPL2+ @@ -19,7 +19,7 @@ exit; // Exit if accessed directly. } -define( 'GENERATEBLOCKS_VERSION', '1.8.2' ); +define( 'GENERATEBLOCKS_VERSION', '1.8.3' ); define( 'GENERATEBLOCKS_DIR', plugin_dir_path( __FILE__ ) ); define( 'GENERATEBLOCKS_DIR_URL', plugin_dir_url( __FILE__ ) ); diff --git a/readme.txt b/readme.txt index 4736b0786..ebacba86f 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ Tags: blocks, gutenberg, container, headline, grid, columns, page builder, wysiw Requires at least: 5.9 Tested up to: 6.4 Requires PHP: 7.2 -Stable tag: 1.8.2 +Stable tag: 1.8.3 License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html @@ -83,6 +83,8 @@ GenerateBlocks was built to work hand-in-hand with [GeneratePress](https://gener == Changelog == += 1.8.3 = + = 1.8.2 = * Fix: Border colors not showing when old attributes are set. * Tweak: Add support for the newly created core function "wp_img_tag_add_loading_optimization_attrs" From 2fcaf1340ce22899f339bcc356b61708c142e7d6 Mon Sep 17 00:00:00 2001 From: Tom Usborne Date: Wed, 14 Feb 2024 11:49:24 -0700 Subject: [PATCH 2/4] Security: Add user capability check to Query Loop post status --- includes/class-query-loop.php | 9 +++++++++ .../query-loop/components/QueryLoopRenderer.js | 13 ++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/includes/class-query-loop.php b/includes/class-query-loop.php index 4ed1dbfa9..24f0a7d96 100644 --- a/includes/class-query-loop.php +++ b/includes/class-query-loop.php @@ -129,6 +129,15 @@ public static function get_query_args( $block, $page ) { $query_args['posts_per_page'] = $per_page; } + if ( + isset( $query_args['post_status'] ) && + 'publish' !== $query_args['post_status'] && + ! current_user_can( 'read_private_posts' ) + ) { + // If the user can't read private posts, we'll force the post status to be public. + $query_args['post_status'] = 'publish'; + } + return $query_args; } diff --git a/src/blocks/query-loop/components/QueryLoopRenderer.js b/src/blocks/query-loop/components/QueryLoopRenderer.js index 9698f6e02..f1b5e8a9d 100644 --- a/src/blocks/query-loop/components/QueryLoopRenderer.js +++ b/src/blocks/query-loop/components/QueryLoopRenderer.js @@ -17,9 +17,20 @@ export default function QueryLoopRenderer( props ) { getEntityRecords, isResolving, hasFinishedResolution, + canUser, } = select( coreStore ); - const queryParams = [ 'postType', query.post_type || 'post', normalizedQuery ]; + let queryData = normalizedQuery; + + // If the user can't update settings, we'll only show published posts. + if ( ! canUser( 'update', 'settings' ) ) { + queryData = { + ...queryData, + status: 'publish', + }; + } + + const queryParams = [ 'postType', query.post_type || 'post', queryData ]; return { data: getEntityRecords( ...queryParams ), From eee2fe3dc0c488579bd70a0c284ebd11abf591d1 Mon Sep 17 00:00:00 2001 From: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Feb 2024 18:40:57 +0000 Subject: [PATCH 3/4] Update dist files --- dist/blocks.asset.php | 2 +- dist/blocks.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dist/blocks.asset.php b/dist/blocks.asset.php index aa838bcf3..0374b05d2 100644 --- a/dist/blocks.asset.php +++ b/dist/blocks.asset.php @@ -1 +1 @@ - array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-rich-text'), 'version' => 'fda41331ac8ec0795fbf'); + array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-rich-text'), 'version' => '99e78c68264b9c1883a4'); diff --git a/dist/blocks.js b/dist/blocks.js index f7883f107..147d0feca 100644 --- a/dist/blocks.js +++ b/dist/blocks.js @@ -1,6 +1,6 @@ (()=>{var e={184:(e,t)=>{var a;!function(){"use strict";var l={}.hasOwnProperty;function n(){for(var e=[],t=0;te.length)&&(t=e.length);for(var a=0,l=new Array(t);a1?a-1:0),n=1;n/gm),U=d(/^data-[\-\w.\u00B7-\uFFFF]/),q=d(/^aria-[\-\w]+$/),Z=d(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),$=d(/^(?:\w+script|data):/i),K=d(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),J=d(/^html$/i),Q=function(){return"undefined"==typeof window?null:window},Y=function(t,a){if("object"!==e(t)||"function"!=typeof t.createPolicy)return null;var l=null,n="data-tt-policy-suffix";a.currentScript&&a.currentScript.hasAttribute(n)&&(l=a.currentScript.getAttribute(n));var r="dompurify"+(l?"#"+l:"");try{return t.createPolicy(r,{createHTML:function(e){return e},createScriptURL:function(e){return e}})}catch(e){return console.warn("TrustedTypes policy "+r+" could not be created."),null}};return function t(){var a=arguments.length>0&&void 0!==arguments[0]?arguments[0]:Q(),l=function(e){return t(e)};if(l.version="2.4.0",l.removed=[],!a||!a.document||9!==a.document.nodeType)return l.isSupported=!1,l;var r=a.document,i=a.document,o=a.DocumentFragment,s=a.HTMLTemplateElement,c=a.Node,u=a.Element,d=a.NodeFilter,p=a.NamedNodeMap,b=void 0===p?a.NamedNodeMap||a.MozNamedAttrMap:p,h=a.HTMLFormElement,m=a.DOMParser,f=a.trustedTypes,L=u.prototype,X=I(L,"cloneNode"),ee=I(L,"nextSibling"),te=I(L,"childNodes"),ae=I(L,"parentNode");if("function"==typeof s){var le=i.createElement("template");le.content&&le.content.ownerDocument&&(i=le.content.ownerDocument)}var ne=Y(f,r),re=ne?ne.createHTML(""):"",ie=i,oe=ie.implementation,se=ie.createNodeIterator,ce=ie.createDocumentFragment,ue=ie.getElementsByTagName,ge=r.importNode,de={};try{de=B(i).documentMode?i.documentMode:{}}catch(e){}var pe={};l.isSupported="function"==typeof ae&&oe&&void 0!==oe.createHTMLDocument&&9!==de;var be,he,me=G,fe=W,ke=U,ve=q,ye=$,we=K,Ce=Z,_e=null,Ee=M({},[].concat(n(O),n(z),n(A),n(D),n(F))),xe=null,Se=M({},[].concat(n(H),n(P),n(V),n(j))),Te=Object.seal(Object.create(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),Le=null,Me=null,Be=!0,Ie=!0,Oe=!1,ze=!1,Ae=!1,Re=!1,De=!1,Ne=!1,Fe=!1,He=!1,Pe=!0,Ve=!1,je="user-content-",Ge=!0,We=!1,Ue={},qe=null,Ze=M({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),$e=null,Ke=M({},["audio","video","img","source","image","track"]),Je=null,Qe=M({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),Ye="http://www.w3.org/1998/Math/MathML",Xe="http://www.w3.org/2000/svg",et="http://www.w3.org/1999/xhtml",tt=et,at=!1,lt=["application/xhtml+xml","text/html"],nt="text/html",rt=null,it=i.createElement("form"),ot=function(e){return e instanceof RegExp||e instanceof Function},st=function(t){rt&&rt===t||(t&&"object"===e(t)||(t={}),t=B(t),be=be=-1===lt.indexOf(t.PARSER_MEDIA_TYPE)?nt:t.PARSER_MEDIA_TYPE,he="application/xhtml+xml"===be?function(e){return e}:w,_e="ALLOWED_TAGS"in t?M({},t.ALLOWED_TAGS,he):Ee,xe="ALLOWED_ATTR"in t?M({},t.ALLOWED_ATTR,he):Se,Je="ADD_URI_SAFE_ATTR"in t?M(B(Qe),t.ADD_URI_SAFE_ATTR,he):Qe,$e="ADD_DATA_URI_TAGS"in t?M(B(Ke),t.ADD_DATA_URI_TAGS,he):Ke,qe="FORBID_CONTENTS"in t?M({},t.FORBID_CONTENTS,he):Ze,Le="FORBID_TAGS"in t?M({},t.FORBID_TAGS,he):{},Me="FORBID_ATTR"in t?M({},t.FORBID_ATTR,he):{},Ue="USE_PROFILES"in t&&t.USE_PROFILES,Be=!1!==t.ALLOW_ARIA_ATTR,Ie=!1!==t.ALLOW_DATA_ATTR,Oe=t.ALLOW_UNKNOWN_PROTOCOLS||!1,ze=t.SAFE_FOR_TEMPLATES||!1,Ae=t.WHOLE_DOCUMENT||!1,Ne=t.RETURN_DOM||!1,Fe=t.RETURN_DOM_FRAGMENT||!1,He=t.RETURN_TRUSTED_TYPE||!1,De=t.FORCE_BODY||!1,Pe=!1!==t.SANITIZE_DOM,Ve=t.SANITIZE_NAMED_PROPS||!1,Ge=!1!==t.KEEP_CONTENT,We=t.IN_PLACE||!1,Ce=t.ALLOWED_URI_REGEXP||Ce,tt=t.NAMESPACE||et,t.CUSTOM_ELEMENT_HANDLING&&ot(t.CUSTOM_ELEMENT_HANDLING.tagNameCheck)&&(Te.tagNameCheck=t.CUSTOM_ELEMENT_HANDLING.tagNameCheck),t.CUSTOM_ELEMENT_HANDLING&&ot(t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(Te.attributeNameCheck=t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),t.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(Te.allowCustomizedBuiltInElements=t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements),ze&&(Ie=!1),Fe&&(Ne=!0),Ue&&(_e=M({},n(F)),xe=[],!0===Ue.html&&(M(_e,O),M(xe,H)),!0===Ue.svg&&(M(_e,z),M(xe,P),M(xe,j)),!0===Ue.svgFilters&&(M(_e,A),M(xe,P),M(xe,j)),!0===Ue.mathMl&&(M(_e,D),M(xe,V),M(xe,j))),t.ADD_TAGS&&(_e===Ee&&(_e=B(_e)),M(_e,t.ADD_TAGS,he)),t.ADD_ATTR&&(xe===Se&&(xe=B(xe)),M(xe,t.ADD_ATTR,he)),t.ADD_URI_SAFE_ATTR&&M(Je,t.ADD_URI_SAFE_ATTR,he),t.FORBID_CONTENTS&&(qe===Ze&&(qe=B(qe)),M(qe,t.FORBID_CONTENTS,he)),Ge&&(_e["#text"]=!0),Ae&&M(_e,["html","head","body"]),_e.table&&(M(_e,["tbody"]),delete Le.tbody),g&&g(t),rt=t)},ct=M({},["mi","mo","mn","ms","mtext"]),ut=M({},["foreignobject","desc","title","annotation-xml"]),gt=M({},["title","style","font","a","script"]),dt=M({},z);M(dt,A),M(dt,R);var pt=M({},D);M(pt,N);var bt=function(e){var t=ae(e);t&&t.tagName||(t={namespaceURI:et,tagName:"template"});var a=w(e.tagName),l=w(t.tagName);return e.namespaceURI===Xe?t.namespaceURI===et?"svg"===a:t.namespaceURI===Ye?"svg"===a&&("annotation-xml"===l||ct[l]):Boolean(dt[a]):e.namespaceURI===Ye?t.namespaceURI===et?"math"===a:t.namespaceURI===Xe?"math"===a&&ut[l]:Boolean(pt[a]):e.namespaceURI===et&&!(t.namespaceURI===Xe&&!ut[l])&&!(t.namespaceURI===Ye&&!ct[l])&&!pt[a]&&(gt[a]||!dt[a])},ht=function(e){y(l.removed,{element:e});try{e.parentNode.removeChild(e)}catch(t){try{e.outerHTML=re}catch(t){e.remove()}}},mt=function(e,t){try{y(l.removed,{attribute:t.getAttributeNode(e),from:t})}catch(e){y(l.removed,{attribute:null,from:t})}if(t.removeAttribute(e),"is"===e&&!xe[e])if(Ne||Fe)try{ht(t)}catch(e){}else try{t.setAttribute(e,"")}catch(e){}},ft=function(e){var t,a;if(De)e=""+e;else{var l=C(e,/^[\r\n\t ]+/);a=l&&l[0]}"application/xhtml+xml"===be&&(e=''+e+"");var n=ne?ne.createHTML(e):e;if(tt===et)try{t=(new m).parseFromString(n,be)}catch(e){}if(!t||!t.documentElement){t=oe.createDocument(tt,"template",null);try{t.documentElement.innerHTML=at?"":n}catch(e){}}var r=t.body||t.documentElement;return e&&a&&r.insertBefore(i.createTextNode(a),r.childNodes[0]||null),tt===et?ue.call(t,Ae?"html":"body")[0]:Ae?t.documentElement:r},kt=function(e){return se.call(e.ownerDocument||e,e,d.SHOW_ELEMENT|d.SHOW_COMMENT|d.SHOW_TEXT,null,!1)},vt=function(e){return e instanceof h&&("string"!=typeof e.nodeName||"string"!=typeof e.textContent||"function"!=typeof e.removeChild||!(e.attributes instanceof b)||"function"!=typeof e.removeAttribute||"function"!=typeof e.setAttribute||"string"!=typeof e.namespaceURI||"function"!=typeof e.insertBefore)},yt=function(t){return"object"===e(c)?t instanceof c:t&&"object"===e(t)&&"number"==typeof t.nodeType&&"string"==typeof t.nodeName},wt=function(e,t,a){pe[e]&&k(pe[e],(function(e){e.call(l,t,a,rt)}))},Ct=function(e){var t;if(wt("beforeSanitizeElements",e,null),vt(e))return ht(e),!0;if(S(/[\u0080-\uFFFF]/,e.nodeName))return ht(e),!0;var a=he(e.nodeName);if(wt("uponSanitizeElement",e,{tagName:a,allowedTags:_e}),e.hasChildNodes()&&!yt(e.firstElementChild)&&(!yt(e.content)||!yt(e.content.firstElementChild))&&S(/<[/\w]/g,e.innerHTML)&&S(/<[/\w]/g,e.textContent))return ht(e),!0;if("select"===a&&S(/