nixpanelandClaude Sonnet 5
39af8d650d
The toggle existed in the UI with no implementation behind it, so uploads were rejected regardless of the setting. New SvgUploads class: - Allowlists the SVG mime type and fixes WP's real-mime sniff, which otherwise nulls out the file type for SVGs specifically even after the mime allowlist is updated. - Populates width/height metadata (parsed from the SVG's own viewBox/width/height) — without this, wp_get_missing_image_subsizes() throws undefined-array-key warnings that can corrupt the upload response's JSON on environments with warnings displayed inline. - Basic sanitization on upload (strips <script> tags, inline event handlers, javascript: URIs). Verified live via the REST media endpoint: clean upload with correct dimensions, and a malicious test SVG had its script/handlers stripped while staying valid markup. Co-Authored-By: Claude Sonnet 5 <[email protected]>
2.9 KiB
2.9 KiB
Changelog
All notable changes to Aurora Admin are documented here, one entry per
version bump. Starts at 2.1.0 — earlier history (the theming rebuild,
window chrome/taskbar, Site Editor support, etc.) lives in git log and
PROJECT_STATUS.md, not reconstructed here.
[2.3.0] - 2026-07-04
Added
- Settings > Media's "Allow SVG uploads" toggle now actually does
something — previously existed in the UI with no implementation behind
it, so every SVG upload was rejected. Fixes both of WordPress's default
blocks (the
upload_mimesallowlist and the real-mime sniff that nulls out the file type for SVGs specifically), plus a PHP warning (wp_get_missing_image_subsizes()reading undefinedwidth/heightmetadata keys that SVGs never had) that could otherwise corrupt the upload response on environments with warnings displayed inline. Also does basic sanitization on upload (strips<script>tags, inline event handler attributes,javascript:URIs) since SVG can carry executable content.
[2.2.0] - 2026-07-04
Added
- Settings > Login's "Style login page" and "Login logo" fields now
actually do something — previously they existed in the UI with no
implementation behind them at all. Styles
wp-login.phpwith a dark theme (background, card, inputs, button) and swaps in the configured logo image in place of the WordPress logo, linked to the site's home URL instead of wordpress.org.
[2.1.1] - 2026-07-04
Fixed
- Image fields (Logo, Dark mode logo, Login logo, Admin favicon) now open
the real WordPress media library picker.
wp_enqueue_media()was never called, sowp.mediawas undefined client-side and every image field silently fell back to a plain URL prompt instead.
[2.1.0] - 2026-07-04
Added
- Free/paid feature gating: Role Editor, Activity Log, Database Explorer, Analytics, White Label, and the remote site switcher are now Pro features. Menu Creator, Admin Notices, Comments, Plugins, and the core shell/theming stay free. Locked pages show an upgrade prompt instead of the real feature; the sidebar shows a lock badge on locked items.
- Real license validation against the
auroraplugins.comlicense server (validate/activate/deactivate), replacing the earlier placeholder that treated any non-empty key as active. Status is cached for 12 hours and re-checked immediately on a license-key change. The Settings page shows a live status line (active/invalid/unreachable) under the License key field. - File-integrity tamper protection: if the code implementing the license gate has been modified, every paid feature re-locks regardless of an otherwise-valid license — makes stripping the check out of a redistributed copy not actually unlock anything.
Fixed
- Role Editor's REST endpoint 500'd when hit via the REST API — it called
get_editable_roles(), which WordPress only auto-loads for normal wp-admin page requests, not REST requests.