diff --git a/.plugin-data b/.plugin-data index f1b8d4b..25cc4a5 100644 --- a/.plugin-data +++ b/.plugin-data @@ -1,4 +1,4 @@ { - "version": "1.2.1", + "version": "1.2.2", "slug": "blockparty-iframe" } diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json index 44f7b42..0e20666 100644 --- a/.wordpress-org/blueprints/blueprint.json +++ b/.wordpress-org/blueprints/blueprint.json @@ -11,7 +11,7 @@ "pluginData": { "resource": "git:directory", "url": "https://github.com/BeAPI/blockparty-iframe", - "ref": "1.2.1", + "ref": "1.2.2", "refType": "tag" }, "options": { diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ff4503..1484650 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/). -## [Unreleased] +## [1.2.2] - 2026-11-11 ### Security @@ -182,6 +182,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/). --- +[1.2.2]: https://github.com/BeAPI/blockparty-iframe/releases/tag/1.2.2 +[1.2.1]: https://github.com/BeAPI/blockparty-iframe/releases/tag/1.2.1 [1.2.0]: https://github.com/BeAPI/blockparty-iframe/releases/tag/1.2.0 [1.1.2]: https://github.com/BeAPI/blockparty-iframe/releases/tag/1.1.2 [1.1.1]: https://github.com/BeAPI/blockparty-iframe/releases/tag/1.1.1 diff --git a/blockparty-iframe.php b/blockparty-iframe.php index c7b2f97..c48017b 100644 --- a/blockparty-iframe.php +++ b/blockparty-iframe.php @@ -2,7 +2,7 @@ /** * Plugin Name: Blockparty Iframe * Description: Add a block to display an embedded frame in the WordPress editor. - * Version: 1.2.1 + * Version: 1.2.2 * Requires at least: 6.7 * Requires PHP: 8.1 * Author: Be API Technical team @@ -23,7 +23,7 @@ include_once __DIR__ . '/vendor/autoload.php'; } -define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.1' ); +define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.2' ); define( 'BLOCKPARTY_IFRAME_URL', plugin_dir_url( __FILE__ ) ); define( 'BLOCKPARTY_IFRAME_DIR', plugin_dir_path( __FILE__ ) ); define( 'BLOCKPARTY_IFRAME_PLUGIN_BASENAME', plugin_basename( __FILE__ ) ); diff --git a/languages/blockparty-iframe.pot b/languages/blockparty-iframe.pot index 1ea4a78..107cf51 100644 --- a/languages/blockparty-iframe.pot +++ b/languages/blockparty-iframe.pot @@ -2,7 +2,7 @@ # This file is distributed under the GPL-2.0-or-later. msgid "" msgstr "" -"Project-Id-Version: Blockparty Iframe 1.2.1\n" +"Project-Id-Version: Blockparty Iframe 1.2.2\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/blockparty-iframe\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff --git a/package-lock.json b/package-lock.json index acca5f0..6e609bc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "blockparty-iframe", - "version": "1.2.1", + "version": "1.2.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "blockparty-iframe", - "version": "1.2.1", + "version": "1.2.2", "license": "GPL-2.0-or-later", "dependencies": { "@wordpress/block-editor": "15.17.0", diff --git a/package.json b/package.json index b545aed..a33e933 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "blockparty-iframe", - "version": "1.2.1", + "version": "1.2.2", "description": "Add a block to display an embedded frame in the WordPress editor.", "author": "Be API Technical team", "license": "GPL-2.0-or-later", diff --git a/readme.txt b/readme.txt index 9b60c71..d434f27 100644 --- a/readme.txt +++ b/readme.txt @@ -2,7 +2,7 @@ Contributors: Be API Technical team Tags: block, iframe, editor Tested up to: 6.7 -Stable tag: 1.2.1 +Stable tag: 1.2.2 License: GPL-2.0-or-later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -45,6 +45,11 @@ directory take precedence. For example, `/assets/screenshot-1.png` would win ove == Changelog == += 1.2.2 = +* Security: the iframe allow attribute only keeps low-risk features (accelerometer, autoplay, clipboard-write, encrypted-media, fullscreen, gyroscope, picture-in-picture, web-share), without origin lists. Users without unfiltered_html can no longer grant camera, microphone, geolocation, screen capture or payment to an embedded page. The list can be extended with the blockparty_iframe_allowed_features filter. +* Security: the obsolete allowpaymentrequest attribute is no longer rendered. +* Editor: the block preview is rendered on the server, with the same filtering as the front end. + = 1.2.1 = * Security: only allowlisted iframe attributes are rendered (allow, allowfullscreen, allowpaymentrequest, id, referrerpolicy, sandbox, aria-*, data-*). Event handlers, srcdoc and malformed attribute names are dropped, fixing a stored XSS reachable by contributors. * Security: the iframe source must be an http or https URL, in the editor and on the front end. diff --git a/src/blockparty-iframe/block.json b/src/blockparty-iframe/block.json index f31265e..698080a 100644 --- a/src/blockparty-iframe/block.json +++ b/src/blockparty-iframe/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "blockparty/iframe", - "version": "1.2.1", + "version": "1.2.2", "title": "Iframe", "category": "widgets", "description": "Display an embedded frame.",