Conversation
- Moved code of conduct - Added plugin-check to wp-env - Updated readme
PCP Wave 1: i18n comments, domains, headers
PCP Wave 2: mechanical substitutions
PCP Wave 3: i18n string literals only
PCP Wave 4: output escaping
PCP Wave 5: Cooked register_setting
…without a Permalinks save. - Always soft-flush rewrite rules on a Cooked or Pro version change - Queue a one-shot flush when stored rules are missing browse page_id mappings - Delete rewrite_rules on deactivation so the next request rebuilds them - Cover version-bump flush, missing-rule queue, and core deactivation in PHPUnit
…nly browse page IDs. - Compare extra_rules_top/extra_rules against the stored rewrite_rules option - Soft-flush late on init so Pro profile, taxonomy, and other add_rewrite_rule mappings recover too - Stop queueing that check from post-type init, which ran before Pro rules existed
PCP Wave 6: Cooked display GET + recipe-meta
PCP Wave 7: Cooked AJAX
PCP Wave 10: Pro add-recipe write path
PCP Plan 2 - Mechanical PHP replacements - unlink -> wp_delete_file - wp_reset_query -> wp_reset_postdata() - Fix for cooked-timer - PHPUnit tests for wp_reset_postdata - Playwright test for bulk directions cooked-timer input
PCP Plan 4 - Fotorama @ filename
PCP Plan 6 - Filesystem calls
PCP Plan 8 - Metabox post-type hook prefix
Require edit_cooked_settings, action-specific nonces, and per-ID post type and edit_post checks so Contributors cannot rewrite other users' posts or copy private content into new recipes.
XjSv
added
bug
XjSv
added
bug
Owner
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 6a9df97. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Medium Risk
Adds capability and nonce checks on privileged migrate/import AJAX, which is security-critical but narrowly scoped; remaining changes are mostly admin CSS/JS with limited runtime impact.
Overview
v1.16.1 bumps version metadata and tightens release/dev setup (
.distignore, Playwright/gitignore paths, Plugin Check inwp-env,legacy-peer-deps).Recipe editor admin UX moves
#cooked-recipe-tabsto sticky positioning (replacing fixed “stuck” tab JS/CSS), stops scroll-to-top on tab clicks, and rework TinyMCE fullscreen (hide admin menu / other editors, adjusted z-index). License status blocks can show aninvalidstate like expired.Bulk Add preview inputs now set values via
.val()instead of HTMLvalueattributes, so directions with quotes or[cooked-timer]no longer break. SEO description saving gets dedicated decode/strip handling to avoid double-encoding.Security: migrate/import/CSV AJAX from the admin now sends nonces, pairing with server
check_ajax_refererandedit_cooked_settingschecks on those actions (Patchstack IDOR/CSRF).Reviewed by Cursor Bugbot for commit 6a9df97. Bugbot is set up for automated code reviews on this repo. Configure here.