Repository navigation
Release TeamVault 3.3.0 - #19
Merged
Merged
Conversation
…views, REST wiring and i18n runtime - tests/bootstrap.php: faithful esc_* / form / redirect / locale shims, filter-aware apply_filters, action-recording nonce shims, REST route registration capture, view-capable globals - New PDMViewsEscapingTest, PDMNonceRejectionTest, PDMRestRouteRegistrationTest, PDMI18nRuntimeTest, PDMAdminHandlersTest cover the previously untested view layer, rejection paths, REST permission wiring, runtime gettext fallback and admin handler guards - Replace the source-text assertion for the interface-language allowlist with behavioral coverage Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
WordPress core concatenates the directory passed to wp_tempnam() as-is, so sys_get_temp_dir() (no trailing slash) produced malformed temp paths such as ".../TempQA-Folder-x.tmp", breaking folder and library ZIP exports whenever the path could not be touched. Pass trailing-slashed directories instead, align the wp_tempnam() test shim with core naming (direct concatenation, .tmp suffix), and add a regression test that fails against the previous path construction. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…lder search - Permission rules are now manageable only by administrators or users whose manage grant comes from an explicit folder rule; the capability-based free fallback no longer delegates rule management (governance REST guard plus a can_manage_rules flag consumed by the folder details panel) - The bundled gettext fallback map now only applies when no GlotPress language pack translation is available - Search returns matching folders alongside files, honoring the view scope Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…ey, clarify MIME mismatch, make logs pagination translatable - Delete/rename/move failures now show the server-provided message (API errors are marked so network failures still fall back to the generic localized string); closes the generic-error report from support - The reports action filter travels as log_action so it can no longer overwrite the admin-post routing parameter (previously broke the audit CSV export whenever an action filter was active) - Upload rejection explains content/extension mismatches instead of the generic "file type not allowed" (the .doc case reported via support) - Logs pagination uses complete translatable sentences; bundled map translations added for en fallback in it/fr/es/de Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…sessions - Modal confirm buttons share a double-submit guard and disable while in flight - All debounced user searches drop stale responses via a sequence counter - Concurrent upload batches are serialized with an isUploading guard - A failed folder load clears the stale items instead of showing the previous folder under the new heading; search resets the toolbar permission map - Escape closes context menus; expired REST nonces surface a dedicated session-expired message; the export toast reports the started export instead of a fake success Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…and docs - Localized strings reaching HTML attributes and governance enum fallbacks are escaped mechanically; user-search tags normalize IDs; the preview download binding is null-guarded - Drop the unused adminUrl/allowedExtensions localized payload; stop double-escaping the settings submit button (core already escapes it) - Exclude CITATION.cff and COPYRIGHT.md from the Plugin Check payload (the only warning raised by WordPress Plugin Check) - Regenerate-aligned POT: add the new strings, drop the obsolete ones - readme FAQ: role access paths, content/extension mismatch rejections, empty-folder deletion, and the tightened permission-rule management Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
- New assets/js/admin-app-helpers.js exposes dependency-free escapeHtml/buildApiUrl/normalizeSameOriginUrl; the app methods delegate to it - New tests/pdm-helpers.test.mjs covers the helper behavior with node --test (11 tests), replacing the tautological source-text assertions for the escaper, the URL builder and the same-origin normalizer; remaining source checks now assert the wiring and the browser sinks only - CI and AGENTS.md run the new syntax check and test command Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…ch helper - New bindUserSearch in admin-app-core.js owns debounce, the stale-response sequence guard, rendering and result-click dispatch; call sites provide render/renderEmpty/onShown/onPick - Governance permissions, groups, quotas and notifications plus the settings whitelist now route through the widget (single users/search call site); regression assertions updated to guard the wiring Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Create-folder, rename-folder and rename-file modals share one showTextPromptModal implementation (title, initial value, confirm handler through the double-submit guard); the per-item modals are now thin wrappers, and the regression assertion counts the three remaining bindModalConfirm call sites. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…ctory buildContextMenu renders items, clamps the menu inside the viewport and dispatches clicks; the shared SVG icons live in contextMenuIcon; the folder and file menus are now declarative item lists (the file download item keeps its disabled state when the binary is missing). Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Replace the hand-maintained template with one generated by `wp i18n make-pot` (WP-CLI 2.12.0): correct line references, the standard plugin-header metadata entries, and the proper package slug in Report-Msgid-Bugs-To. Every bundled map key is covered. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
The item key is emitted as a pdm-context-<key> class alongside the data-context-action attribute, preserving the pre-refactor class names (open, preview, download, rename, move, delete) for consumers. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Bump the version and align every release artifact: plugin header and constant, readme stable tag with changelog and upgrade notice, dated changelog.txt entry, GitHub and localized README version lines with release notes, the dated security review covering this cycle's findings (SEC-005..008), the CITATION.cff version and release date, and the POT project version. The upgrade notice calls out the only behavior change: permission-rule management now requires an explicit manage grant. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 3.3.0: governance hardening, a real-world ZIP export fix, user-facing error surfacing, folder search, a fully rebuilt regression suite, and structural cleanup of the admin app.
Security and governance
can_manage_rulesflag (verified live against a capability-holding editor: 403 + no permissions button)wp_tempnam()concatenates the provided directory as-is and the untrailedsys_get_temp_dir()produced malformed paths that broke exports (found during live staging QA; the old test shim masked it; the shim now mirrors core and the regression test fails against the previous construction)log_action, no longer overwriting the admin-post routing parameter (previously broke the export whenever a filter was active)User-facing fixes
Admin app
bindUserSearch,showTextPromptModal,buildContextMenu; pure helpers module with behavioral node testsTests and release alignment
Verification performed
Generated by Mistral Vibe.