EDH Restricted Site

Historique des changements

2.1.2

• Documentation only, no code changes: corrected a stale pre-2.0.0 shortcode in README.md and brought its feature and setup lists back in line with this file.

2.1.1

• Fixed a fatal error in wp-admin for any logged-in user without the manage_options capability — an Editor, Author or Subscriber opening the dashboard got a white screen. add_options_page() returns false for them, and assigning that to a string-typed property is a TypeError under strict types. Present since 1.5.x, not new in 2.1.0.
• Applied the same guard to the settings option read, which would otherwise fatal on every request rather than only in wp-admin if the option row were ever corrupted.
• Fixed an infinite redirect loop on an unconfigured install — with no unrestricted pages set, the access-denied redirect pointed at a page that was itself gated. The gate now fails closed with a 403 message instead of looping.

2.1.0

• Security: fixed a bypass that let anyone unlock the whole site by setting the access cookie to an arbitrary value — it was only ever checked for presence, never validated. Cookies are now signed with wp_salt('auth') and verified on every request.
• Verification links no longer carry the visitor’s email address, keeping it out of browser history, access logs and Referer headers. Requesting a second link no longer invalidates the first.
• Added configurable rate limiting on verification emails — per address and per IP address, either settable to 0 for no limit.
• The plugin is now fully translatable; previously no string used the declared text domain.
• The administrator bypass now checks the manage_options capability rather than the administrator role name, so multisite Super Admins are covered.
• Further plugin-review fixes: allowed-domain validation, output escaping in the form, no email address in the « failed to store token » error log, removed the empty Plugin URI: header.
• Expired options-table fallback tokens are now cleaned up by the existing daily cron event.

2.0.0

• Renamed every global identifier prefix from edh/edh_rs to edhrs (options, log table, cookie, shortcode, AJAX action, cron hook, classes, constants) per WordPress.org plugin review requirements. Breaking: existing installs lose their saved settings and log history when updating – reconfigure under Settings → Restricted Site.
• The shortcode is now [edhrs_verification_form].
• Removed the « If you get stuck, email… » line from the verification email.
• Added a « Button text colour » setting, controlling the text colour of both the frontend form’s submit button and the email’s « Verify Email Address » button. The « Button colour » setting now also applies to the email’s button.
• Verification email styles are now fully inline for better email-client compatibility.
• Additional input-sanitization and SQL-hardening changes from the WordPress.org plugin review.

1.5.5

• Fixed a « Text Domain » typo (edh-resticted-site → edh-restricted-site) and renamed the main plugin file to match.

1.5.4

• Added a « Back to Settings » button to the Logs page.

1.5.3

• Fixed the Logs page showing no heading above the table.

1.5.2

• Fixed two more Plugin Check warnings from 1.5.1’s log-viewer query fix.

1.5.1

• Fixed remaining Plugin Check warnings from 1.5.0’s log-viewer queries.
• « Restricted Site Logs » is no longer a separate entry in the Settings menu – use the « View Logs »/ »Logs » links instead.

1.5.0

• Added a verification-request log (Settings → Restricted Site Logs): email address, requested date, Pending/Used/Expired status, and used date for every successful verification send.
• Added a « Log retention (days) » setting – old entries are purged automatically.
• Added « Settings »/ »Logs » links on the Plugins screen and a « View Logs » link on the Settings page.
• Added uninstall cleanup for the new log table and its scheduled task.

1.4.0

• Replaced the fixed-palette button colour picker with WordPress’s native colour picker, accepting any valid hex colour.

1.3.0

• Fixed an edge case where the static front page or « posts page » couldn’t be correctly selected as an unrestricted page.
• Hardened the access check against caching plugins/CDNs serving a gated response to the wrong visitor.
• Added optional debug logging for diagnosing access-check behaviour.

1.2.2

• « Unrestricted pages » and « Access denied page » now only offer published pages.
• Renamed the « Default page » setting to « Access denied page » for clarity.

1.2.1

• Fixed a remaining Plugin Check input-sanitization warning on the verification link’s email parameter.

1.2.0

• Added an explicit « Access denied page » setting for where visitors without access are sent, replacing the previous implicit reliance on the first selected unrestricted page.
• Fixed several WordPress.org Plugin Check compliance issues (block API version, output escaping, input sanitization, packaging).

1.1.0

• Added a « Button colour » setting, chosen from WordPress’s default editor colour palette.
• Fixed the verification form’s stylesheet not loading in the block editor.

1.0.0

• Initial release.
• Email verification flow with a domain allow-list, shortcode and Gutenberg block, and cookie-based access passes.
• Admin settings page for allowed domains, unrestricted pages, redirect-after-verification page, sender email address, and cookie duration.
• Verification tokens stored as transients with an automatic options-table fallback for reliability.