Editor de Perfiles de Usuario

Registro de cambios

[4.66] 19.08.2026

• Update: Marked as compatible with WordPress 7.1
• Required PHP version increased up to 7.4
• Required WordPress version increased up to 4.6
• Update: Plugin loading code is enhanced.
• Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
• Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
• Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
• Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.
• Fix: URE_Protect_Admin used a bitwise “&” instead of a logical “&&” when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use “&&”, and the related IN() SQL clause is now hardened with array_map(‘absint’, …).
• Update: nonce actions used on the Settings/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.
• Update: additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().
• Update: rel=”noopener noreferrer” was added to external links opened with target=”_new”.
• Update: hardcoded text strings in the role editor toolbar are now translatable.
• Fix: URE_Assign_Role used the %i SQL placeholder, which needs WordPress 6.2+, below the plugin’s declared minimum; replaced with direct interpolation of internal table names.
• Fix: URE_Editor::reset_user_roles() had an unescaped wp_die() message; further output escaping (esc_url(), esc_html(), absint()) was added across URE_Base_Lib, URE_Editor, URE_User_Other_Roles and URE_User_View.
• Fix: several request-var/database-result comparisons that could be bypassed by PHP type juggling are now strict, including URE_Grant_Roles::is_try_remove_admin_from_himself()’s “can’t remove your own admin role” check.
• Fix: URE_Base_Lib::set() now correctly rejects unknown properties instead of silently creating them; URE_View declares its $advert property explicitly.
• Update: $_SERVER[‘REQUEST_URI’] is now validated and unslashed before sanitizing in URE_Lib::is_right_admin_path() and URE_User_Other_Roles::is_user_profile_extention_allowed().
• Update: posted role IDs are now sanitized (sanitize_key(), wp_unslash()) in URE_Editor, and its ‘object’/role-selection request parameters are constrained to known values.
• Update: URE_Base_Lib::get_blog_ids() now uses get_sites() instead of a raw database query.
• Update: URE_Capability::revoke_caps() now uses get_users() instead of a raw database query.
• Update: URE_Protect_Admin::has_administrator_role() now uses user_can() instead of a raw database query.

[4.65] 21.05.2026

• Update: Marked as compatible with WordPress 7.0
• Update: Pages markup are modified to correspond WordPress 7.0 CSS changes.
• Update: “defined(‘ABSPATH’)” guard was added to all PHP files to exclude PHP files direct execution.
• Update: sanitize_text_field(), sanitize_key(), sanitize_url() functions are used to secure user input before processing.
• Update: _nonce field checking was added before data update in addition to test made already on the higher level.

File changelog.txt contains the full list of changes.