From 4caa1fa6c47c5e152742f88f48ee4daf423824ca Mon Sep 17 00:00:00 2001 From: Danny van Kooten Date: Mon, 21 Oct 2024 10:04:27 +0200 Subject: [PATCH] v4.9.18 --- mailchimp-for-wp.php | 4 +- readme.txt | 2003 +++++++++++++++++++++--------------------- 2 files changed, 999 insertions(+), 1008 deletions(-) diff --git a/mailchimp-for-wp.php b/mailchimp-for-wp.php index 16293b1f..1b38bf13 100755 --- a/mailchimp-for-wp.php +++ b/mailchimp-for-wp.php @@ -4,7 +4,7 @@ Plugin Name: MC4WP: Mailchimp for WordPress Plugin URI: https://www.mc4wp.com/#utm_source=wp-plugin&utm_medium=mailchimp-for-wp&utm_campaign=plugins-page Description: Mailchimp for WordPress by ibericode. Adds various highly effective sign-up methods to your site. -Version: 4.9.17 +Version: 4.9.18 Author: ibericode Author URI: https://www.ibericode.com/ Text Domain: mailchimp-for-wp @@ -48,7 +48,7 @@ function _mc4wp_load_plugin() } // bootstrap the core plugin - define('MC4WP_VERSION', '4.9.17'); + define('MC4WP_VERSION', '4.9.18'); define('MC4WP_PLUGIN_DIR', __DIR__); define('MC4WP_PLUGIN_FILE', __FILE__); diff --git a/readme.txt b/readme.txt index 3c576831..7d8308a3 100644 --- a/readme.txt +++ b/readme.txt @@ -4,7 +4,7 @@ Donate link: https://www.mc4wp.com/contribute/#utm_source=wp-plugin-repo&utm_med Tags: mailchimp, subscribe, email, newsletter, form Requires at least: 4.6 Tested up to: 6.6 -Stable tag: 4.9.17 +Stable tag: 4.9.18 License: GPL-3.0-or-later License URI: http://www.gnu.org/licenses/gpl-3.0.html Requires PHP: 7.2 @@ -187,1011 +187,1002 @@ The plugin provides various filter and action hooks that allow you to modify or 9. Settings page for e-commerce integration with Mailchimp. Requires [Mailchimp for WordPress Premium](https://www.mc4wp.com/). == Changelog == - - -#### 4.9.17 - Sep 17, 2024 - -- Fix compatibility with WooCommerce versions 8.5 to 8.8 because of private method that was later made public. -- Fix potential reflected XSS by stripping and escaping all HTML from `{email}` tag replacements. Thanks to kauenavarro for responsibly disclosing. -- Fix potential stored XSS for attackers with both administrator access and Mailchimp account access by escaping HTML from interest group name. Thanks to Jorge Diaz (ddiax) for responsibly disclosing. - - -#### 4.9.16 - Sep 11, 2024 - -- Add support for WooCommerce Checkout Block in sign-up checkbox integration. - - -#### 4.9.15 - Aug 13, 2024 - -- Improved anti-spam measures on the [custom form integration](https://www.mc4wp.com/kb/subscribe-mailchimp-custom-html-form/). If you are using the custom form integration (using the `mc4wp-subscribe` checkbox), please test your forms after upgrading and report any issues to us. -- Improved anti-spam measures on all sign-up forms. -- Remove unsupported filter hook from Gravity Forms integration. - - -#### 4.9.14 - Jul 17, 2024 - -- Very minor code-size improvements to public forms related JavaScript. -- Update third-party JS dependencies. -- Bump tested WordPress version to 6.6. - - -#### 4.9.13 - Apr 25, 2024 - -- Fix issue with Composer classmap throwing a fatal error when an older version of Composer is already loaded. - - -#### 4.9.12 - Apr 22, 2024 - -- Fix last 10 Mailchimp lists not being pulled-in when having more than 10 lists. - - -#### 4.9.11 - Jan 8, 2024 - -- Update third-party JS dependencies. -- Bump tested WordPress version. - - -#### 4.9.10 - Nov 20, 2023 - -- Integrations: Update CheckoutWC hook name for WooCommerce checkbox integration. -- Forms: Don't show form preview to users without `edit_posts` capability. -- Forms: Explicitly exclude form preview from search engine indexing. -- General: Don't unnecessarily go through service contrainer while bootstrapping plugin. -- General: Remove some unnecessary JavaScript now that browser support has caught up. - - -#### 4.9.9 - Oct 3, 2023 - -- Fix class "MC4WP_Usage_Tracking" not found error for WP Cron / WP CLI processes. - - -#### 4.9.8 - Oct 3, 2023 - -- Remove the opt-in usage tracking functionality as we're not really using it for decision making anymore. -- Add missing label element to the select element for setting the logging level. -- Our JavaScript assets are now transpiled to support the same set of browsers as WordPress core. -This drops support for some very old browsers, but results in smaller bundle sizes for the supported set of browsers. -- Update third-party JS dependencies to their latest versions. - - -#### 4.9.7 - Aug 29, 2023 - -- Update third-party JS dependencies. -- Minor textual improvements. -- Bump tested WordPress version. - - -#### 4.9.6 - Jul 12, 2023 - -- Update third-party JS dependencies. -- Address some minor codestyle issues. - - -#### 4.9.5 - Jun 7, 2023 - -- Fix generated HTML for list/audience choice fields. -- Fix deprecation warning in includes/admin/class-review-notice.php. -- Update JavaScript dependencies. - - -#### 4.9.4 - May 2, 2023 - -- Fallback to default checkbox label if none given. Thanks to [Shojib Khan](https://github.com/kshojib). -- Improve WooCommerce integration settings page by disabling position field if integration is disabled. Thanks to [Shojib Khan](https://github.com/kshojib). -- Update JavaScript dependencies. - - -#### 4.9.3 - Mar 31, 2023 - -- Defend against breaking change in latest WPForms update. - - -#### 4.9.2 - Mar 21, 2023 - -- Add support for a field named `MARKETING_PERMISSIONS` to enable GDPR fields configured in Mailchimp. A [sample code snippet can be found here](https://github.com/ibericode/mailchimp-for-wordpress/blob/master/sample-code-snippets/forms/gdpr-marketing-permissions.md). -- Remove Google reCaptcha feature. This was already disabled if you were not already using it. - - -#### 4.9.1 - Feb 7, 2023 - -- Fix generated value attribute for fields of type choice (dropdown, checkboxes, radio fields). -- Fix type of `marketing_permissions` field in API requests. Thanks to [George Korakas](https://github.com/gkorakas-eli). -- Refactor list overview JS to not depend on Mithril.js anymore. -- Simplify admin footer text asking for a plugin review. -- When renewing lists, renew cached marketing permissions too. - - -#### 4.9.0 - Jan 13, 2023 - -- Removed deprecated filter hook `mc4wp_settings_cap`, use `mc4wp_admin_required_capability` instead. -- Removed deprecated filter hook `mc4wp_merge_vars`, use `mc4wp_form_data` or `mc4wp_integration_data` instead. -- Removed deprecated filter hook `mc4wp_form_merge_vars`, use `mc4wp_form_data` instead. -- Removed deprecated filter hook `mc4wp_integration_merge_vars`, use `mc4wp_integration_data` instead. -- Removed deprecated filter hook `mc4wp_valid_form_request`, use `mc4wp_form_errors` instead. -- Removed deprecated function `mc4wp_get_api()` and deprecated class `MC4WP_API`. -- Removed deprecated function `mc4wp_checkbox()`. -- Removed deprecated function `mc4wp_form()`, use `mc4wp_show_form()` instead. -- Added filter `mc4wp_debug_log_message` to modify or disable messages that are written to the debug log. -- Fix color of invalid Mailchimp API key notice. -- Sanitize IP address value from `$_SERVER['REMOTE_ADDR']` too. -- Fetch GDPR marketing permissions via first subscriber on list and show them in lists overview table. - - -#### 4.8.12 - Dec 06, 2022 - -- Minor performance, memory usage & size optimizations for all JavaScript code bundled with this plugin. - - -#### 4.8.11 - Nov 1, 2022 - -- Improved default styling for the WooCommerce sign-up checkbox integration. -- Add `` to allowed HTML elements for GDPR disclaimer text on settings pages. -- Remove all references to obsolete placeholders.js polyfill. -- Move the GiveWP sign-up checkbox closer to the email input field. Thanks [Matthew Lewis](https://github.com/Matthew-Lewis). - - -#### 4.8.10 - Sep 14, 2022 - -- Fix mc4wp_get_request_ip_address() to return an IP address that matches Mailchimp's validation format when X-Forwarded-For header contains a port component. - - -#### 4.8.8 - Aug 25, 2022 - -- Fix mc4wp_get_request_ip_address() to pass new Mailchimp validation format. This fixes the "This value is not a valid IP." error some users using a proxy may have been seeing. - - -#### 4.8.7 - Mar 2, 2022 - -- Fix PHP 8.1 deprecation warnings in `MC4WP_Container` class. -- Fix name of action hook that fires before Mailchimp settings rows are displayed on the settings page. Thanks [LoonSongSoftware](https://github.com/LoonSongSoftware). -- Improve WPML compatibility. Thanks [Sumit Singh](https://github.com/5um17). -- Fix deprecated function for AMP integration. -- Only allow unfiltered HTML if user has `unfiltered_html` capability. Please read the below. - -Despite extensive testing, we may have missed some more obscure HTML elements or attributes from our whitelist. -If you notice that some of your form HTML is stripped after saving your form, please get in touch with our support team and provide the HTML you attempted to save. - - -#### 4.8.6 - Jun 24, 2021 - -- Add nonce field to button for dismissing notice asking for plugin review. -- Add strings from config/ directory to POT file. -- Add nonce check to AJAX endpoint for refreshing cached Mailchimp lists. -- Add capability check to AJAX endpoint for retrieving list details. -- Schedule event to refresh cached Mailchimp list upon plugin activation. - -Thanks to the team over at [pluginvulnerabilities.com](https://www.pluginvulnerabilities.com/) for bringing some of these changes to our attention. - - -#### 4.8.5 - Jun 1, 2021 - -Add nonce verification to all URL's using `_mc4wp_action` query parameter. -This fixes a CSRF vulnerability where a malicious website could trick a logged-in admin user in performing unwanted actions. - -A special thanks to Erwan from [WPScan](https://wpscan.com/) for bringing this issue to our attention. - - -#### 4.8.4 - May 7, 2021 - -- Add `defer` attribute to JS file, so page parsing isn't blocked at all. -- Rewrite plugin CSS to optimize for selector performance and get rid of some duplication. - -After installing this update, make sure to also update any add-on plugins like [Mailchimp for WordPress Premium](https://www.mc4wp.com/premium-features/) and [Mailchimp Top Bar](https://wordpress.org/plugins/mailchimp-top-bar/). - - -#### 4.8.3 - Jan 21, 2021 - -- Fix fatal error on older PHP versions when submitting form without any subscriber tags set in the form settings. -- Minor performance improvement in bootstrap method of the plugin. - - -#### 4.8.2 - Jan 20, 2021 - -- Allow short-circuiting `mc4wp_subscriber_data` filter by returning `null` or `false`. -- Use a subdirectory for the default debug log file location, so that it's easier to protect using htaccess. -- Improved reliability for fetching lists from mailchimp when lists have high stats.member_count property. - - -#### 4.8.1 - Aug 25, 2020 - -- Fix notice by explicitly setting `permission_callback` on registered REST route. -- Minor internal code improvements. - -#### 4.8 - Jul 9, 2020 - -- Plugin now requires PHP 5.3 or higher. -- Prefix overlay classname to prevent styling collissions with other plugins. -- Form sign-ups can now add tags to both new and existing subscribers. -- Update JavaScript dependencies. -- Register script early to work with Gutenberg preview. - - -#### 4.7.8 - Jun 04, 2020 - -- Add `MC4WP_API_V3::add_template` method. -- Minor code hardening to ensure a default form is always set. -- Update JS dependencies to their latest versions. -- Fix icon for Gutenberg block. - - -#### 4.7.7 - Apr 28, 2020 - -- Update JS dependencies to their latest versions. -- API client `add_list_member` method now has an additional parameter to skip merge field validation. -- Simplify code for updating an existing form. - - -#### 4.7.6 - Apr 9, 2020 - -- Update JS dependencies to their latest versions. -- Check if className is of type string, fixes a console warning when clicking inside a SVG element. -- Minor improvements to the AMP implementation to address harmless validation warnings. - - -#### 4.7.5 - Feb 10, 2020 - -- Add AMP compatibility to sign-up forms, thanks to Claudiu Lodromanean. This uses the [official AMP plugin for WordPress](https://amp-wp.org). -- Add settings key to WPML config so settings can easily by copied over to translated versions of a form. -- Optimize size & performance of JavaScript code, resulting in a file that is 40% smaller. -- Update CodeMirror to its latest version. -- Escape all string translations. - - -#### 4.7.4 - Dec 7, 2019 - -**Fixes** - -- htaccess config for servers running Apache 2.4 or later. - - -#### 4.7.3 - Dec 4, 2019 - -**Fixes** - -- Top Bar & User Sync add-on using API v2 since version 4.7.1. -- Revert change in formatter for date fields, breaking all forms with date fields in them. - -**Improvements** - -- Add getter method for raw (unmodified) data on form class. - - -#### 4.7.2 - Nov 27, 2019 - -**Fixes** - -- Invalid .htaccess file in case there already is one in the uploads directory. - - -#### 4.7.1 - Nov 26, 2019 - -**Improvements** - -- Update MemberPress hook names. Thanks [Ian Heggaton](https://github.com/pixelated-au)! -- Use WordPress.org translations instead of bundling translation files in plugin itself. -- Write .htaccess to directory of debug log file, to prevent file access. -- Add some convenient hooks for Checkout for WooCommerce. -- Stop parsing shortcodes in text widgets as WordPress core does this since version 4.9. - - -#### 4.7 - Nov 7, 2019 - -**Improvements** - -- Add role=alert to form notices. -- Add setting to pre-check sign-up checkbox for Gravity Forms integrations. -- Add new position for WooCommerce integration: directly after the billing_email field. -- Fix PHP notices for submitting a form and saving a form as an administrator. -- Add link to [Koko Analytics plugin](https://wordpress.org/plugins/koko-analytics/). - - -#### 4.6.2 - Oct 24, 2019 - -**Fixes** - -- Address fields in forms would always be required (even if really optional). - -**Improvements** - -- Add proper SVG admin menu icon. -- Minor overall performance and memory usage improvements. - - -#### 4.6.1 - Oct 7, 2019 - -**Fixes** - -- Fixed list cache usage for WPForms, Gravity Forms and Ninja Forms integrations. - - -#### 4.6.0 - Oct 7, 2019 - -**Improvements** - -- Improved fetch and cache mechanism for retrieving Mailchimp account details, fetching data only when it is required. -- Updated [Mithril](https://mithril.js.org/) and [CodeMirror](https://codemirror.net/) dependencies. -- Decreased size of `forms.js` from 22KB to 9KB. -- No longer requiring jQuery anywhere. -- Increase API HTTP request timeout to 15 seconds. - -Please note that installing this update requires you to also update any add-ons like [Mailchimp Top Bar](https://wordpress.org/plugins/mailchimp-top-bar/) and [Mailchimp for WordPress Premium](https://www.mc4wp.com/premium-features/) (if installed). - - -#### 4.5.5 - Sep 12, 2019 - -**Fixes** - -- Google reCAPTCHA script was still loading even if no forms have it enabled. - - -#### 4.5.4 - Sep 11, 2019 - -**Improvements** - -- Removed custom color from menu item for improved accessibility. -- Take birthday field format into account when sending data to Mailchimp. -- Print Google reCAPTCHA script in footer. - -**Changes** - -- Changed plugin name to MC4WP instead of Mailchimp for WordPress. - - -#### 4.5.3 - July 23, 2019 - -**Fixes** - -- Temporarily switch status of pending subscribers to "unsubscribe" versus deleting susbcriber before re-subscribing. -- Deprecation notice for Gravity Forms version 2.4 and higher. - -**Improvements** - -- Filter out empty tags when applying tags to new subscribers. -- Show all not installed integrations. -- Show notice when form doesn't have a Mailchimp list selected to subscribe people to. -- Check function existence for compatibility with WordPress 4.7 -- Don't submit form when Google reCAPTCHA is enabled but errors. -- Update third-party JavaScript dependencies. - - -#### 4.5.2 - May 8, 2019 - -**Improvements** - -- Accept more truthy values in custom integration for improved compatibility with third-party forms. -- Update JavaScript dependencies. -- Load Google reCaptcha script in footer (if needed). - - -#### 4.5.1 - April 8, 2019 - -**Additions** - -- Add sign-up integration for [Give](https://wordpress.org/plugins/give/) -- Add sign-up integration for [UltimateMember](https://wordpress.org/plugins/ultimate-member/) - -**Improvements** - -- Write to debug log if Google reCAPTCHA secret key is incorrect. -- Validate reCAPTCHA keys when savings form settings. -- Allow setting an empty "successfully subscribed" message. - - -#### 4.5.0 - March 27, 2019 - -**Additions** - -- Built-in integration with Google reCAPTCHA to prevent bots from subscribing to your Mailchimp lists. - -**Improvements** - -- Minor improvements to the JavaScript that is loaded on admin pages. - - -#### 4.4.0 - March 1, 2019 - -**Fixes** - -- AffiliateWP integration subscribing the wrong user if affiliate ID differs from user ID. - -**Improvements** - -- Renamed "MailChimp" to "Mailchimp" to match Mailchimp's new branding. -- More accurate handling of timeouts for accounts with many MailChimp lists. -- UX improvements for integrations overview page. -- Validate MailChimp API key format when it's entered. -- Improved compatibility with Klarna Checkout in the WooCommerce checkout integration. -- Bumped required PHP version to 5.3 (soft requirement for now). - -**Additions** - -- Added Gutenberg block for easily adding a form to a post or page. -- Added subscriber tags setting to forms. - - -#### 4.3.3 - December 31, 2018 - -**Fixes** - -- Update WPForms integration to properly detect if the WPForms plugin is activated. - -**Improvements** - -- Write API request parameters to the debug log in case of connection timeouts. -- Update JavaScript dependencies. - - -#### 4.3.2 - December 11, 2018 - -**Fixes** - -- Use of `readonly` function, which is only available in WordPress 4.9 or later. - - -#### 4.3.1 - November 28, 2018 - -**Fixes** - -- Fatal error on PHP versions older than 5.5 - - -#### 4.3 - November 28, 2018 - -**Additions** - -- Added `MC4WP_API_KEY` PHP constant which can be used to set your Mailchimp API key. -- Add `mc4wp_mailchimp_list_limit` filter hook to modify the maximum number of Mailchimp lists to fetch. Defaults to 200. - -**Improvements** - -- Apply `mc4wp_integration_gravity-forms_options` filter hook on Gravity Forms integration options so the checkbox can be prechecked and the checkbox label text modified. -- The `updated_subscriber` JS event is now fired forms not using AJAX as well (when applicable). - - -#### 4.2.5 - Sep 11, 2018 - -**Improvements** - -- Only re-add subscriber to list if we want to re-trigger a double opt-in confirmation email. -- Change Gravity Forms field name to "Mailchimp for WordPress" -- Get rid of cached result of Mailchimp API connection. - - -#### 4.2.4 - July 9, 2018 - -**Improvements** - -- Ensure type-safety on some global variables. -- Stop showing trashed forms immediately. -- Pre-check Mailchimp list when creating a new form if there is only 1 list. -- Send `null` for unknown values in usage tracking data (only when opted-in). - -**Additions** - -- Add methods for accessing Mailchimp's e-commerce promo code endpoints to API class. - - -#### 4.2.3 - June 11, 2018 - -**Fixes** - -- Don't wrap "agree to terms" input in hyperlink element. -- Allow [ENTER] key again after field helper overlay is closed. - -**Improvements** - -- Fallback to meta-refresh if redirect fails because of "headers already sent" error. - - - -#### 4.2.2 - May 22, 2018 - -**Fixes** - -- Events Manager integration was not working with logged-in users. -- Form preview URL should respect admin HTTP(S) scheme. -- Removed use of PHP 5.4 function. - -**Improvements** - -- Add "agree to terms" checkbox to field helper. - -**Additions** - -- Add filter `mc4wp_http_request_args`. - - -#### 4.2.1 - April 11, 2018 - -**Fixes** - -- Namespace usage warning when running PHP 5.2 - -**Improvements** - -- Remove obsolete `type` attribute from all `