فضای ذخیره‌سازی سازگار با S3 برای EDD

گزارش تغییرات

1.1.1

• Improved: File display in S3 Library now shows filename prominently with path as a subtle subtitle for better readability.
• Improved: Enhanced visual hierarchy in file listings with larger, bolder filenames and cleaner path display.
• Improved: Better responsive design for file display on mobile and tablet devices.
• Improved: Simplified file path styling with better contrast and spacing for improved user experience.
• Security: Enforced timeout limits for presigned URLs (minimum 1 minute, maximum 60 minutes) to prevent abuse and ensure reasonable download link expiration.
• Security: Enhanced endpoint URL validation with SSRF protection, blocking private IP addresses, localhost, and internal networks to prevent server-side request forgery attacks.
• Security: Added comprehensive Content-Type (MIME type) validation to prevent file type spoofing attacks where malicious files are disguised with safe extensions.
• Security: Implemented multi-layered file validation including extension matching, MIME type verification, and content-type header validation for S3 uploads.
• Security: Added filter hook (s3cs_edd_allowed_mime_types) to allow developers to customize allowed MIME types while maintaining security.

1.1.0

• Added: URL prefix customization hook (s3cs_edd_url_prefix filter) for improved developer flexibility.
• Added: Search functionality for S3 Library with real-time file filtering.
• Added: Clear search button and keyboard shortcuts (Ctrl+F/Cmd+F) for enhanced user experience.
• Improved: S3 Library interface with modern search container styling.

1.0.9

• Security: Added capability-based access control for S3 media library and upload functionality
• Security: Removed debug console.log statements to prevent file path exposure
• Security: Removed admin_post_nopriv_s3cs_upload action hook to restrict upload access to logged-in users only
• Security: Removed SVG from allowed file extensions to prevent XSS attacks via malicious SVG files
• Security: Replaced raw S3 error message display with generic user-friendly messages while logging detailed errors for debugging
• Security: Reduced XML parser logging to prevent sensitive server response data exposure in logs
• Security: Removed “No Auth” fallback from authentication methods to prevent unauthenticated requests
• Security: Deleted unused makeRequestWithoutAuth method to enhance security posture

1.0.8

• Added: File type validation with enhanced security against dangerous file uploads
• Added: Translators comments for all internationalization strings with placeholders
• Improved: Better internationalization support for translators
• Improved: Debug logging now uses WordPress standards with proper sanitization
• Fixed: All output from internationalization functions properly escaped to prevent XSS vulnerabilities
• Fixed: Proper nonce verification for all form data processing to prevent CSRF attacks
• Fixed: Removed production-unsafe debug code and replaced with WordPress-compatible logging
• Changed: Default download link expiry reduced to 3 minutes for better security

1.0.7

• Automatically prepended https:// to Endpoint URL to prevent XML parsing errors.
• Improved Endpoint URL validation and user guidance.
• XML parsing errors in S3 client and media library functions.

1.0.6

• Centralized version management using S3CS_EDD_VERSION constant
• Updated Persian translation files

1.0.5

• Removed: Dark mode support to simplify styling and improve consistency across all themes.

1.0.4

• Fixed: Responsive S3 file selection now displays file name, size, date, and select button on mobile.

1.0.3

• Fixed WP_Scripts::localize error by using wp_add_inline_script() for non-array values.
• Separated all inline JavaScript into dedicated .js files for better maintainability and performance.
• Separated inline CSS into dedicated .css files.

1.0.2

• Enhanced S3 upload section styling for a modern look and improved user experience.
• Improved responsive design for better display on various screen sizes.
• Refined the display of the current directory/bucket name in the S3 upload section.

1.0.1

• Added a non-dismissible admin notice to alert users when S3 Access Key or Secret Key are not configured, with a direct link to settings.
• Added Persian language support.
• Implemented direct file download functionality, preventing files like JSON or text from opening in the browser and forcing download.

1.0.0

• Initial release
• S3-compatible storage integration
• Secure presigned URL generation
• Media library integration
• File upload functionality
• Admin settings interface
• Security enhancements and validation
• Internationalization support