The toggle existed in the UI with no implementation behind it, so
uploads were rejected regardless of the setting. New SvgUploads class:
- Allowlists the SVG mime type and fixes WP's real-mime sniff, which
otherwise nulls out the file type for SVGs specifically even after
the mime allowlist is updated.
- Populates width/height metadata (parsed from the SVG's own
viewBox/width/height) — without this, wp_get_missing_image_subsizes()
throws undefined-array-key warnings that can corrupt the upload
response's JSON on environments with warnings displayed inline.
- Basic sanitization on upload (strips <script> tags, inline event
handlers, javascript: URIs).
Verified live via the REST media endpoint: clean upload with correct
dimensions, and a malicious test SVG had its script/handlers stripped
while staying valid markup.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
"Style login page" and "Login logo" existed in the Settings UI with no
implementation behind them at all. New LoginStyle class hooks
login_enqueue_scripts to apply a dark theme (background, form card,
inputs, button) and swap in the configured logo, linked to the site's
home URL instead of wordpress.org.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
- License.php now calls the aurora-licensing plugin's REST API
(/wp-json/aurora-licensing/v1/validate|activate|deactivate) instead of
treating any non-empty license_key as active. Result is cached in the
aurora_admin_license_status option for 12 hours; is_active() and
is_feature_available() read the cache instead of hitting the network on
every admin page load.
- Hooks update_option_aurora_admin_settings to activate/deactivate
immediately when the license_key setting actually changes, rather than
waiting out the cache. Instantiated in AuroraAdmin.php so that hook
registers.
- Settings page now surfaces the real status (active/invalid/unreachable,
with the server's own message) as a status line under the License key
field, instead of a field that silently does nothing.
- Verified live against the real server: a fake test key correctly came
back locked with the server's own "License key not found." message.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
- Root-cause fix for "Sorry, you are not allowed to access this page" on
Menu Creator/Activity Log/Role Editor: remove_submenu_page() was
corrupting WP core's user_can_access_admin_page() capability lookup.
Sub-apps now stay registered in $submenu; MenuSerializer filters them
out of the sidebar instead.
- Add a 6th sub-app, Comments, with a redirect from native edit-comments.php.
- Extend the window-chrome/taskbar framing to the Site Editor
(site-editor.php), including a fix for a CSS position:fixed
over-constraint bug that let its frame run past the viewport.
- Rewrite the taskbar from a single sessionStorage slot to a list so
multiple minimized windows are each independently restorable.
- Extend native-dark.css coverage to the block editor's own chrome.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Replaces the old light/dark toggle with 10 fixed color themes (plus
Black & Grey and White) that drive a coordinated gradient palette across
the whole admin UI, a Google Fonts picker, and a native-page dark-mode
stylesheet that now covers modals and plugin/theme card grids. Fixes
several background/gradient seams where the sidebar, toolbar, and content
frame were each painting their own independent copy of the page gradient
instead of sharing one continuous plane.
Also adds a macOS-style traffic-light title bar to every page (close,
minimize, maximize) and a persistent bottom taskbar so a minimized page
can be restored from anywhere, plus a Plugins management page.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
