Security Enhancements<\/strong><\/p>\n\n\n- Added proper nonce verification for all form submissions and GET parameters<\/li>\n
- Implemented comprehensive input validation and sanitization for file uploads<\/li>\n
- Added isset() checks for all $_FILES array access to prevent undefined index errors<\/li>\n
- Enhanced file validation with binary signature checking for font files<\/li>\n<\/ul><\/li>\n
WordPress Standards Compliance<\/strong><\/p>\n\n\n- Replaced direct filesystem operations with WP_Filesystem API methods<\/li>\n
- Replaced move_uploaded_file() with WP_Filesystem::put_contents()<\/li>\n
- Replaced unlink() with wp_delete_file() for file deletion<\/li>\n
- Removed direct chmod() calls in favor of WP_Filesystem permissions<\/li>\n
- Added translators comments for all internationalized strings with placeholders<\/li>\n<\/ul><\/li>\n
Database Improvements<\/strong><\/p>\n\n\n- Implemented proper database query caching with wp_cache_get\/set<\/li>\n
- Added phpcs:ignore comments for necessary direct database queries<\/li>\n
- Enhanced error handling for database operations with automatic file cleanup<\/li>\n<\/ul><\/li>\n
File Upload Security<\/strong><\/p>\n\n\n- Added file size validation (10MB limit for font files)<\/li>\n
- Implemented binary signature verification for TTF, OTF, WOFF, and WOFF2 files<\/li>\n
- Enhanced filename sanitization and unique filename generation<\/li>\n
- Added comprehensive error messages for various upload failure scenarios<\/li>\n<\/ul><\/li>\n
Performance Optimizations<\/strong><\/p>\n\n\n- Implemented font data caching with 1-hour expiration<\/li>\n
- Added cache invalidation on font upload\/delete operations<\/li>\n
- Optimized database queries with proper prepared statements<\/li>\n<\/ul><\/li>\n
Bug Fixes<\/strong><\/p>\n\n\n- Fixed undefined array index warnings for $_FILES superglobal<\/li>\n
- Resolved file permission issues with proper WordPress filesystem handling<\/li>\n
- Fixed potential XSS vulnerabilities in admin interface<\/li>\n
- Corrected improper sanitization of temporary file paths<\/li>\n<\/ul><\/li>\n<\/ul>\n\n
1.1.11<\/h4>\n\n\n- Implemented custom font upload handler bypassing WordPress MIME restrictions<\/li>\n
- Added binary file signature validation for TTF, OTF, WOFF, and WOFF2 formats<\/li>\n
- Enhanced security with multi-layer file validation (extension + signature + size)<\/li>\n
- Improved error handling with specific error messages and file cleanup<\/li>\n
- Added upload success notifications with font name display<\/li>\n
- Increased maximum upload size from 5MB to 10MB<\/li>\n<\/ul>\n\n
1.1.10<\/h4>\n\n
Security & Code Quality Release<\/strong>\n* SECURITY FIX: Properly sanitized file upload inputs to prevent potential security vulnerabilities\n* SECURITY FIX: Eliminated unprepared SQL statements and improved database query security\n* SECURITY FIX: Removed intermediate SQL variables that could pose security risks\n* CODE QUALITY: Updated database queries to follow WordPress coding standards (PHPCS compliance)\n* CODE QUALITY: Improved prepared statement handling for better security practices\n* PERFORMANCE: Maintained existing caching functionality while improving query security\n* COMPATIBILITY: No breaking changes - fully backward compatible with previous versions<\/p>\n\n1.1.9<\/h4>\n\n\n- SECURITY UPDATE<\/strong>: Fixed all WordPress Coding Standards warnings and security vulnerabilities<\/li>\n
- Implemented proper input sanitization for $_FILES['font_file'] using wp_check_filetype() and wp_handle_upload()<\/li>\n
- Fixed SQL injection vulnerabilities by properly escaping table names with backticks in prepared statements<\/li>\n
- Replaced direct database queries with WordPress built-in methods ($wpdb->insert(), $wpdb->delete())<\/li>\n
- Enhanced caching implementation with wp_cache_get(), wp_cache_set(), and proper cache invalidation<\/li>\n
- Added comprehensive nonce verification and capability checks for all admin functions<\/li>\n
- Implemented secure file upload handling with MIME type validation<\/li>\n
- Added proper error handling and user feedback for upload\/delete operations<\/li>\n
- Enhanced input validation using sanitize_text_field(), wp_unslash(), and absint()<\/li>\n
- Improved database query performance with object caching (3600 second cache timeout)<\/li>\n
- Fixed WordPress.Security.ValidatedSanitizedInput.InputNotSanitized warnings<\/li>\n
- Fixed WordPress.DB.PreparedSQL.InterpolatedNotPrepared warnings<\/li>\n
- Fixed WordPress.DB.DirectDatabaseQuery.DirectQuery and NoCaching warnings<\/li>\n<\/ul>\n\n
1.1.8<\/h4>\n\n\n- Sanitized all
$_POST<\/code> and $_FILES<\/code> inputs with sanitize_text_field()<\/code> and wp_unslash()<\/code><\/li>\n- Added
isset()<\/code> and is_numeric()<\/code> guards for all external input<\/li>\n- Used proper
$wpdb->prepare()<\/code> syntax \u2014 avoided direct string interpolation and removed unsafe $table<\/code> placeholders<\/li>\n- Implemented WP object caching via
wp_cache_get()<\/code> and wp_cache_set()<\/code> for font listing and lookup<\/li>\n- Used
wp_cache_delete()<\/code> on upload\/delete to invalidate cache<\/li>\n- Added version parameters (
'1.1.8'<\/code>) to all styles\/scripts to fix browser cache busting<\/li>\n- Passed PHPCS codesniffing standards with WordPress-Extra + WordPress-Docs + WordPress-VIP rules<\/li>\n<\/ul>\n\n
1.1.7<\/h4>\n\n\n- Fixed
$wpdb<\/code> query interpolation warnings<\/li>\n- Sanitized inputs and replaced
rename()<\/code> with WP_Filesystem->move()<\/code><\/li>\n- Implemented object caching pattern for all fetching queries<\/li>\n
- Fixed database queries to use
$wpdb->prepare()<\/code> \u2014 no raw variable interpolation<\/li>\n- Improved sanitization and validation for
$_POST['font_name']<\/code> using isset()<\/code> and wp_unslash()<\/code><\/li>\n- Validated and sanitized
$_FILES['font_file']<\/code> input properly<\/li>\n- Replaced
rename()<\/code> with $wp_filesystem->move()<\/code> per WPCoding standards<\/li>\n- Added
version<\/code> to all uses of wp_register_style()<\/code> and wp_register_script()<\/code> to fix browser cache busting<\/li>\n- Added object caching (
wp_cache_get<\/code>, wp_cache_set<\/code>) to SELECT queries<\/li>\n- Invalidated caches on insert\/delete using
wp_cache_delete()<\/code><\/li>\n- Retained backwards-compatible shortcode:
[fotyte_font_tester]<\/code><\/li>\n<\/ul>\n\n1.1.6<\/h4>\n\n\n- Residual use of heredoc syntax cleaned<\/li>\n<\/ul>\n\n
1.1.5<\/h4>\n\n\n- Fully prefixed all functions, actions, shortcodes, and handles with
fotyte_<\/code><\/li>\n<\/ul>\n\n1.1.4<\/h4>\n\n\n- Switched from writing JS\/CSS files to using
wp_add_inline_style<\/code> and wp_add_inline_script<\/code><\/li>\n<\/ul>\n\n1.1.3<\/h4>\n\n\n- Prepend function names with unique characters fotyte_ <\/li>\n<\/ul>\n\n
1.1.2<\/h4>\n\n\n- Rearrange UI to put Font Preview on top <\/li>\n<\/ul>\n\n
1.1.1<\/h4>\n\n\n- Correcte Readme<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- Admin Interface Added<\/li>\n<\/ol>\n\n
New admin menu item under Settings \u2192 Font Tester\nClean admin interface for font upload and management\nTable view of all uploaded fonts with delete functionality\nUsage instructions for the shortcode<\/p>\n\n
\n- Front-end Changes<\/li>\n<\/ol>\n\n
Removed font upload form completely\nSimplified interface focusing only on font testing\nUsers can only select from fonts uploaded by administrators\nShows message when no fonts are available<\/p>\n\n
\n- Security Improvements<\/li>\n<\/ol>\n\n
Added capability checks (manage_options) for all admin functions\nOnly administrators can upload and delete fonts\nEnhanced permission validation<\/p>\n\n
\n- New Files Created\nThe plugin now creates 4 files:<\/li>\n<\/ol>\n\n
font-tester.css - Front-end styles\nfont-tester.js - Front-end JavaScript\nfont-tester-admin.css - Admin interface styles\nfont-tester-admin.js - Admin interface JavaScript<\/p>\n\n
\n- Enhanced Functionality<\/li>\n<\/ol>\n\n
Better caching system\nImproved database queries with prepared statements\nCleaner admin interface with WordPress styling\nAutomatic page reload after font upload for immediate feedback<\/p>","raw_excerpt":"A comprehensive font testing tool with real-time typography controls and font source obfuscation for secure font preview.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/242417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=242417"}],"author":[{"embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/mitradranirban"}],"wp:attachment":[{"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=242417"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=242417"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=242417"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=242417"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=242417"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ps.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=242417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}