Reviews for Tutor LMS

ڕووداوتۆمارگەریی گۆڕین

1.0.3

This is a security release. Updating is recommended for all users.

• Security: Escape review content, reviewer names and course titles before they are rendered in the reviews table. A review submitted from the front end could previously inject HTML into the moderation screen.
• Security: Require the review management capability for every moderation action. Approving, spamming, trashing and deleting reviews were previously protected by a nonce alone, without checking that the user was allowed to moderate.
• Security: Restrict the status filter and the sorting column to a known list of values before they reach the database.
• Security: Bind each row action to the nonce for the action it performs, so an approval link can no longer be reused to delete a review.
• Fix: Stop execution after redirecting, instead of continuing to render the page.
• Fix: Ignore unknown or empty bulk actions, which previously produced a database error.
• Fix: Permanently deleting reviews now works from the Spam view, not only from Trash.
• Fix: The status filter links no longer accumulate the previously selected status.
• Fix: Ratings outside the 1 to 5 range no longer raise an error on PHP 8.
• Tested with WordPress 7.0 and PHP 7.4 through 8.5.

1.0.2

• Tested with WordPress 6.7, Tutor LMS 3.0.0 and PHP 8.3.13.
• Live preview fixed.

1.0.1

• Fix: Displays the reviewer’s username, without a URL to their profile, when they do not have an account on the site.

1.0

• Initial release.