diff --git a/.plugin-data b/.plugin-data index 57b5ffd..f1b8d4b 100644 --- a/.plugin-data +++ b/.plugin-data @@ -1,4 +1,4 @@ { - "version": "1.2.0", + "version": "1.2.1", "slug": "blockparty-iframe" } diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json index 6eb75c6..44f7b42 100644 --- a/.wordpress-org/blueprints/blueprint.json +++ b/.wordpress-org/blueprints/blueprint.json @@ -11,7 +11,7 @@ "pluginData": { "resource": "git:directory", "url": "https://github.com/BeAPI/blockparty-iframe", - "ref": "1.2.0", + "ref": "1.2.1", "refType": "tag" }, "options": { diff --git a/CHANGELOG.md b/CHANGELOG.md index 547ed38..dd730ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,13 +7,18 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/). -## [Unreleased] +## [1.2.1] - 2026-11-05 ### Security - **Iframe attributes allowlist**: Only `allow`, `allowfullscreen`, `allowpaymentrequest`, `id`, `referrerpolicy`, `sandbox`, `aria-*` and `data-*` attributes are rendered, in the editor and on the front end. Event handlers (`onload`…), `srcdoc` and malformed attribute names are dropped, closing a stored XSS reachable by contributors. - **Iframe source protocols**: The iframe source must be an `http` or `https` URL, in the editor and on the front end (blocks `javascript:` URLs in the editor). +### Fixed + +- **Translations**: Add missing French translations. +- **Developer dependencies**: Bump `wp-coding-standards/wpcs` to 3.4.1 (security advisory on earlier versions) and `config.platform.php` to 8.3.36 so Composer can resolve dev dependencies in CI. + ## [1.2.0] - 2026-04-22 ### Changed diff --git a/blockparty-iframe.php b/blockparty-iframe.php index f214e34..c7b2f97 100644 --- a/blockparty-iframe.php +++ b/blockparty-iframe.php @@ -2,7 +2,7 @@ /** * Plugin Name: Blockparty Iframe * Description: Add a block to display an embedded frame in the WordPress editor. - * Version: 1.2.0 + * Version: 1.2.1 * Requires at least: 6.7 * Requires PHP: 8.1 * Author: Be API Technical team @@ -23,7 +23,7 @@ include_once __DIR__ . '/vendor/autoload.php'; } -define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.0' ); +define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.1' ); define( 'BLOCKPARTY_IFRAME_URL', plugin_dir_url( __FILE__ ) ); define( 'BLOCKPARTY_IFRAME_DIR', plugin_dir_path( __FILE__ ) ); define( 'BLOCKPARTY_IFRAME_PLUGIN_BASENAME', plugin_basename( __FILE__ ) ); diff --git a/languages/blockparty-iframe.pot b/languages/blockparty-iframe.pot index 4c4fb13..1ea4a78 100644 --- a/languages/blockparty-iframe.pot +++ b/languages/blockparty-iframe.pot @@ -2,7 +2,7 @@ # This file is distributed under the GPL-2.0-or-later. msgid "" msgstr "" -"Project-Id-Version: Blockparty Iframe 1.2.0\n" +"Project-Id-Version: Blockparty Iframe 1.2.1\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/blockparty-iframe\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff --git a/package-lock.json b/package-lock.json index 62fdcf8..3679399 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "blockparty-iframe", - "version": "1.2.0", + "version": "1.2.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "blockparty-iframe", - "version": "1.2.0", + "version": "1.2.1", "license": "GPL-2.0-or-later", "dependencies": { "@wordpress/block-editor": "15.17.0", diff --git a/package.json b/package.json index d43ae6e..b5b998f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "blockparty-iframe", - "version": "1.2.0", + "version": "1.2.1", "description": "Add a block to display an embedded frame in the WordPress editor.", "author": "Be API Technical team", "license": "GPL-2.0-or-later", diff --git a/readme.txt b/readme.txt index 4f98e3f..9b60c71 100644 --- a/readme.txt +++ b/readme.txt @@ -2,7 +2,7 @@ Contributors: Be API Technical team Tags: block, iframe, editor Tested up to: 6.7 -Stable tag: 1.2.0 +Stable tag: 1.2.1 License: GPL-2.0-or-later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -45,6 +45,11 @@ directory take precedence. For example, `/assets/screenshot-1.png` would win ove == Changelog == += 1.2.1 = +* Security: only allowlisted iframe attributes are rendered (allow, allowfullscreen, allowpaymentrequest, id, referrerpolicy, sandbox, aria-*, data-*). Event handlers, srcdoc and malformed attribute names are dropped, fixing a stored XSS reachable by contributors. +* Security: the iframe source must be an http or https URL, in the editor and on the front end. +* Translations: add missing French translations. + = 1.2.0 = * Dynamic block: iframe markup is rendered in PHP on the front end (block attributes are stored in post content). Existing posts with the previous static HTML remain supported in the editor. diff --git a/src/blockparty-iframe/block.json b/src/blockparty-iframe/block.json index 990fade..f31265e 100644 --- a/src/blockparty-iframe/block.json +++ b/src/blockparty-iframe/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "blockparty/iframe", - "version": "1.2.0", + "version": "1.2.1", "title": "Iframe", "category": "widgets", "description": "Display an embedded frame.",