chore: deny web access to everything but the browser assets Blocks dotfiles (.git included), tests/, tools/, vendor/ and any PHP, SQL, shell, lock, JSON, dist or Markdown file. mod_rewrite only, so it needs no more than the FileInfo override WordPress permalinks already use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore(deps): bump league/commonmark from 2.10.0 to 2.10.3 Fixes GHSA-3q6v-r5mr-hxv8 (quadratic-time DoS in the GFM table parser) and GHSA-97jj-33gv-5xf9 (DisallowedRawHtml bypass, unused here). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: sanitize the editor preview with DOMPurify marked passes raw HTML through, and the preview renders the stored, unfiltered Markdown on load, so a payload a contributor stored ran in the browser of whoever opened the post. The preview now goes through DOMPurify (vendored, 3.4.16), allowing iframes so embeds still show, and falls back to plain text when DOMPurify is unavailable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: filter converted HTML by author, keep backslashes, convert REST saves The stored Markdown is never filtered, and it is converted again on every save by whoever saves. KSES keyed on the current user alone let an administrator's save, even a Quick Edit, publish raw markup a contributor had stored. The converted HTML now goes through wp_kses_post() unless the post author has unfiltered_html. update_post_meta() and wp_update_post() strip slashes from what they are given, so values unslashed by hand lost every backslash: in the Markdown, in post_content, and in the legacy backup. On a legacy save the stripped content never matched the submission, so the nested save_post looped until PHP gave up. Values are now slashed, and the form handler respects the re-entry guard. The REST controller writes meta after save_post fires, so Markdown sent over REST was not converted. Conversion now runs on wp_after_insert_post. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Enhance README
Merge pull request #1 from ozh/dependabot/github_actions/shivammathur/setup-php-2.40.0 chore(deps): Bump shivammathur/setup-php from 2.37.2 to 2.40.0
ci: run the tests once per pull request, not twice Pushes now trigger the workflow on master only. A pull request branch, Dependabot's included, was tested once for the push and again for the pull request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore(deps): Bump shivammathur/setup-php from 2.37.2 to 2.40.0 Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.2 to 2.40.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/2.37.2...2.40.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
ci: bump the actions and let Dependabot keep them current actions/checkout and actions/setup-node move to v7, which run on Node 24 rather than the deprecated Node 20. setup-php is pinned to 2.37.2. Dependabot checks the workflow's actions weekly. Composer and the front end libraries are vendored, so it is not pointed at them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: stop tracking the dev container wrapper tools/dev.sh hardcodes one machine's container name and path, so it is of no use to anyone else and CI does not need it. It stays on disk, ignored locally. The unit bootstrap's hint no longer points at it. VERSIONS.md also drops a reference to the Prism line numbers setting, which went with the settings page: line numbers are always on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>