Release v7.6.71
WPDiscuz v7.6.71
What's new in v7.6.71
WPDiscuz v7.6.71 was released on . AJAX realtime comment system with custom comment form and fields. See the full changelog below and compare with the complete version history.
Release details
Released
6.8 MB
File available
Changelog
Fixed
- The comment bubble and the live comment update never showed comments posted without an email address to visitors who have no email address themselves, visitors who have not commented yet and guests who comment anonymously. A visitor's own new comments are left out of these updates by their email address, and an empty address matched every comment posted without one, so anonymous commenters were hidden from each other and from everyone who has not commented. The email address is now only used when the visitor has one, a guest commenting anonymously keeps their own comments out of the update through the ones already on their screen.
- The new comment message of the comment bubble described the newest comment of the post, even when the bubble was not notifying about that comment, the visitor's own comment or one already on their screen. It now describes the newest comment the visitor is being notified about, and is left out of the response when that comment cannot be read, a private comment an addon keeps from the visitor for instance, where it used to be built from nothing.
- The Cookies Consent and Agreement checkbox labels were printed on the comment form, and on the comment edit form, without being escaped. The labels are cleaned when the form is saved, but that only applies to what is saved from then on, so a label stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor. The labels are now filtered where they are printed, the agreement label by the same rules its own save path allows and the cookies consent label by a narrow set that keeps links and inline formatting, so a label that still holds script no longer runs it. The field name is escaped in the wrapper class of the cookies consent and text area fields as well, as it already was in the other field types.
- The info icon of the "powered by wpDiscuz" line below the comments carried its behaviour in an inline onclick attribute, which a Content Security Policy that forbids inline script blocks outright, leaving the icon unresponsive with nothing to explain why. It also reached the link through fixed element ids, so a page showing more than one comment form always toggled the first one, and it could not be reached from the keyboard at all. The icon is now handled from wpdiscuz.js, is operable by keyboard, toggles the block it belongs to, and moves focus to the link it reveals.
- The minimal theme carried none of the styles for the "powered by wpDiscuz" line. That stylesheet loads instead of the default theme one rather than alongside it, so the wpDiscuz link was shown permanently and unstyled, and the info icon beside it toggled nothing a reader would notice.
- The HTML field printed its markup on the comment form without being filtered. The markup is cleaned when the form is saved, but that only applies to what is saved from then on, so an HTML field stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor, and cloning a form or importing one copies such a value across untouched. It is now filtered where it is printed, by the same rules its own save path allows, so a field that still holds script no longer runs it. Its code is shown as plain text until the field is cleared. The number field description is escaped where it is printed as well, as it already was in the other field types.
- The titles of the comment editor toolbar buttons were passed through the translation function a second time where they are printed, against wpDiscuz's own text domain. The titles are already translated by that point, so the title of a button added by an addon was looked up in a text domain it does not belong to, and a title the addon had already escaped was escaped a second time, which shows the escape sequence itself to the reader in any title holding an apostrophe or an ampersand. The titles are now only escaped where they are printed.
- The icon height and the tab title of each card on the settings dashboard, and the icon class of the file attachment button on the comment form, were printed without being escaped. All three are supplied through settings arrays and filters an addon can extend, so a value holding a quote or a tag was printed as markup rather than as the value it was meant to be. They are now escaped where they are printed, as the values beside them already were.
- Replies from guests were rejected as spam on sites where an anti-spam plugin fills in its own hidden fields with JavaScript once the page loads, La Sentinelle for instance, while the first comment posted through the main form went through. A reply form is built by copying the markup of a hidden form on the page, and markup carries the values the page was served with rather than the ones those scripts set, so every reply went out with an untouched honeypot and timer. A second comment from the main form was rejected the same way, because the form is cleared after a comment is posted and clearing it put those fields back to the values the page wa
Compatibility
- Requires WordPress
- 6.0
- Tested up to
- 7.1
- Requires PHP
- 7.4